Self-host nylon
v0.4.6Self-healing WireGuard mesh network
- Stars
- 518
- Ports
- 57175 (WireGuard mesh traffic (UDP)), 9090 (Observability server (HTTP, optional))
What is nylon?
Nylon implements a self-healing WireGuard mesh using the Babel routing protocol on a modified wireguard-go. It automatically finds the lowest-latency path across multiple hops and recovers from link failures in under ten seconds without any central coordination server. The entire network runs as a single statically-linked binary on one UDP port with a YAML config file. Standard WireGuard apps on phones and desktops can join as passive clients and roam between gateway nodes. The data plane achieves 10+ Gbps throughput. Linux and macOS are fully supported; Windows works via passive clients. The project is Apache-2.0 licensed.
nylon alternatives
gravitlSelf-hosted, open-source WireGuard automation: mesh VPNs, remote access gateways and site-to-site networks managed from a web UI with ACLs and DNS.Comparegravitl with nylon
awlAnywherelan is a self-hosted, open-source mesh VPN connecting devices directly without a central server. It provides SOCKS5 proxy and full-tunnel VPN gateway.Compareawl with nylon
MeshLANMeshLAN is a self-hosted, open-source virtual LAN connecting Windows devices over encrypted P2P tunnels with relay fallback and MeshDNS on your own Linux control plane.CompareMeshLAN with nylon
CalabiSelf-hosted tunneling tool giving local services HTTPS URLs for webhooks and previews, plus a private WireGuard mesh network with stable addresses.CompareCalabi with nylon
netbirdNetBird is a self-hosted, open-source zero-trust networking platform with WireGuard mesh, centralized access control, SSO/MFA, and posture checks.Comparenetbird with nylon
TunnetTunnet is a self-hosted, open-source mesh VPN replacing Tailscale and ngrok with one stack: mesh, tunnels, SSH, file transfer, and Kubernetes integration.CompareTunnet with nylon
NewtNewt is a self-hosted, open-source WireGuard tunnel client and proxy that connects private networks to the Pangolin platform without complex VPN setup.CompareNewt with nylon
YggdrasilSelf-hosted, open-source IPv6 mesh: Yggdrasil builds an end-to-end encrypted overlay that peers over IPv4 or IPv6 and runs on Linux, macOS, Windows, routers and phones.CompareYggdrasil with nylon
All self-hosted alternatives to Nebula → All self-hosted alternatives to Tailscale → All self-hosted alternatives to ZeroTier →
Should you self-host nylon?
nylon scores 51/100 on selfhost.directory (how scoring works) and ranks #34 of 56 in VPN. It has 518 GitHub stars.
It shipped 8 stable releases in the past year. The latest, v0.4.6, came out on 27 August 2026. New versions land roughly every 3 weeks.
Setup is moderate: expect some configuration beyond a single command. It is Apache-2.0-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is headscale (82/100, 45 188 stars). It scores higher overall, so compare the two before you pick. See nylon vs headscale side by side.
Features
- Config distribution
- Multi-hop routing
- Native WireGuard speeds
- No coordination server
- Port forwarding support
- Prometheus observability
- Self-healing / automatic failover
- Single binary, single port
- Split-tunneling
- WireGuard client compatibility
nylon README
FAQ
What if I use a different port than 57175?
Configure the custom port in node.yaml (local port), specify it in central.yaml endpoints (external port), and update your router's port forwarding rule accordingly.
Do I need to forward ports on every node?
No. Nylon only needs at least one node with a public endpoint (via port forwarding or public static IP) to act as a point of entry for the mesh. More open ports increase resilience.
More in VPN
octeliumOpen-source self-hosted zero trust access platform replacing VPNs, tunnels and gateways, with WireGuard/QUIC clients, clientless access and policy-as-code.
openvpnOpenVPN is an open-source, self-hosted VPN daemon for remote access and site-to-site tunnels, offering PKI auth, NAT traversal, TUN/TAP devices, and post-quantum TLS.
openvpn-asSelf-hosted OpenVPN Access Server packaged as a Docker image with a web-based VPN management interface.
openvpn_webpanel_managerSelf-hosted proprietary VPN panel managing OpenVPN, Cisco, L2TP, WireGuard, Sing-box with users, resellers, multi-node, REST API. Commercial license required.
OpenZitiOpenZiti is an open-source, self-hosted zero-trust overlay network: identity-based access, dark services with no open ports, tunnelers and SDKs instead of VPN.
opnsenseSelf-hosted, open-source firewall and routing platform on FreeBSD: stateful filtering, VPN, Suricata IPS, multi-WAN failover, all managed from a web GUI.
Outline ServerOutline Server is a self-hosted, open-source Shadowsocks proxy with a REST API for access keys, enabling your own censorship-resistant VPN.
PangolinSelf-hosted, open-source SASE stack combining a WireGuard zero-trust VPN, identity-aware reverse proxy, PAM and an AI gateway; the AGPL Community Edition is free.
phantom-wgPhantom-WG is a self-hosted, open-source WireGuard VPN platform with multihop routing, IPv6 dual-stack, and crash recovery via SQLite, all in isolated Docker containers.
pia-tunSelf-hosted Docker container for PIA WireGuard VPN with strict killswitch, port forwarding, SOCKS5/HTTP proxies, and port syncing for torrent clients.
pia-wireguardSelf-hosted WireGuard VPN client container that routes Docker workloads through a PIA tunnel, with port forwarding, a default-deny kill-switch firewall and healthchecks.
pihole-doh-wireguardSelf-hosted Docker Compose stack combining Pi-hole ad-blocking, Cloudflared DNS-over-HTTPS encryption, and WireGuard VPN for secure remote access to your home network.
0 comments