Written by Furqan Ahmed · Updated September 27, 2026

The short version

OrbitLan creates encrypted links between the devices in a room. It tries direct peer-to-peer paths first and can fall back to a relay when restrictive networks prevent a direct connection. The coordinator introduces nodes and exchanges connection signaling; it does not receive the Ethernet frames carried through the virtual LAN.

Use OrbitLan with people you trust. The room code is both the invitation and the shared secret used to derive traffic-encryption keys. Anyone who knows the code should be treated as a member of that trusted room.

Traffic encryption

Virtual-LAN frames are protected with ChaCha20-Poly1305 authenticated encryption. OrbitLan derives a separate directional key for each pair of nodes using HKDF-SHA-256 and protects packets against replay with a sliding counter window.

The current v1 protocol derives those keys from the shared room code. It does not yet use a per-peer Noise or X25519 handshake and therefore does not provide forward secrecy. This is an explicitly documented limitation, not an undisclosed guarantee.

Coordinator and relay

ComponentWhat it handlesWhat it does not receive
CoordinatorRoom membership, display names, virtual IP assignment, edition, ICE signaling, host state, and short-lived connection metadata.LAN Ethernet frames and application payloads.
Direct peer linkEncrypted virtual-LAN packets sent directly between two nodes.No central OrbitLan server carries that traffic.
Relay fallbackEncrypted packets when a direct path cannot be established.The relay forwards ciphertext and does not hold the room-derived decryption key.

Coordinator room and signaling state is ephemeral and kept in memory. Nodes that stop polling are removed, and an empty room resets. Cloudflare or a self-hosted operator can still observe ordinary service-level metadata such as request addresses and timestamps.

Local privileges

Windows needs administrator approval during initial setup to install the TAP adapter, background network service, and firewall rule. The graphical app runs normally after setup. Linux requires permission to create and configure a TAP interface, normally through sudo or the included systemd service.

Current trust boundaries

  • Share room codes only with people you trust and replace a code if it becomes public.
  • Software inside the virtual LAN can reach other nodes according to each operating system's firewall rules.
  • OrbitLan does not make an unsafe game server safe and does not replace normal host firewall maintenance.
  • The project has not undergone an independent professional security audit.
  • Current Windows binaries are not code-signed, so Windows may show an Unknown Publisher warning.
  • OrbitLan is not an anonymity or public-internet privacy VPN.

Verify the software

Community releases and their SHA-256 checksum files are published from the official GitHub repository. The same repository contains the complete engine, client, coordinator, build scripts, and MIT license.

Report a vulnerability

For a sensitive vulnerability that should not be posted publicly, email furqanshaheer@gmail.com with the subject “OrbitLan security”. Avoid including real room codes, private keys, passwords, or personal data in a public issue.

Start from an official build.

Choose the stable Windows client or the Linux headless preview.