The short version
OrbitLan creates encrypted links between the devices in a room. It tries direct peer-to-peer paths first and can fall back to a relay when restrictive networks prevent a direct connection. The coordinator introduces nodes and exchanges connection signaling; it does not receive the Ethernet frames carried through the virtual LAN.
Traffic encryption
Virtual-LAN frames are protected with ChaCha20-Poly1305 authenticated encryption. OrbitLan derives a separate directional key for each pair of nodes using HKDF-SHA-256 and protects packets against replay with a sliding counter window.
The current v1 protocol derives those keys from the shared room code. It does not yet use a per-peer Noise or X25519 handshake and therefore does not provide forward secrecy. This is an explicitly documented limitation, not an undisclosed guarantee.
Coordinator and relay
| Component | What it handles | What it does not receive |
|---|---|---|
| Coordinator | Room membership, display names, virtual IP assignment, edition, ICE signaling, host state, and short-lived connection metadata. | LAN Ethernet frames and application payloads. |
| Direct peer link | Encrypted virtual-LAN packets sent directly between two nodes. | No central OrbitLan server carries that traffic. |
| Relay fallback | Encrypted packets when a direct path cannot be established. | The relay forwards ciphertext and does not hold the room-derived decryption key. |
Coordinator room and signaling state is ephemeral and kept in memory. Nodes that stop polling are removed, and an empty room resets. Cloudflare or a self-hosted operator can still observe ordinary service-level metadata such as request addresses and timestamps.
Local privileges
Windows needs administrator approval during initial setup to install the TAP adapter, background network service, and firewall rule. The graphical app runs normally after setup. Linux requires permission to create and configure a TAP interface, normally through sudo or the included systemd service.
Current trust boundaries
- Share room codes only with people you trust and replace a code if it becomes public.
- Software inside the virtual LAN can reach other nodes according to each operating system's firewall rules.
- OrbitLan does not make an unsafe game server safe and does not replace normal host firewall maintenance.
- The project has not undergone an independent professional security audit.
- Current Windows binaries are not code-signed, so Windows may show an Unknown Publisher warning.
- OrbitLan is not an anonymity or public-internet privacy VPN.
Verify the software
Community releases and their SHA-256 checksum files are published from the official GitHub repository. The same repository contains the complete engine, client, coordinator, build scripts, and MIT license.
Report a vulnerability
For a sensitive vulnerability that should not be posted publicly, email furqanshaheer@gmail.com with the subject “OrbitLan security”. Avoid including real room codes, private keys, passwords, or personal data in a public issue.
Start from an official build.
Choose the stable Windows client or the Linux headless preview.