Nixosoft MeshNet 1.13.0 (latest build)

Nixosoft MeshNet 1.13.0

A private mesh network you host yourself — an independent alternative
to Tailscale and Headscale. One machine of yours is the master
server (the coordinator); every other machine joins it and they all
reach each other directly, across NATs and continents. The client runs
WireGuard itself — no external VPN process is involved, and nothing
phones home.

Every file below is listed in meshnet-manifest.json with its
SHA-256. The Windows binaries and installer are Authenticode-signed;
install.sh checks the manifest before it installs anything.

1. Your master server

tar -xzf meshnet-server-*.tar.gz && cd meshnet-server
sudo ./install-server.sh --public-url https://mesh.example.com:15068

Uses Docker if present, otherwise installs Node and a systemd unit. It
prints your admin password once and the exact command your machines
need. Open tcp/15068 and udp/45640.

2. Your machines

File	Platform	Notes
Nixosoft-MeshNet_*_x64-setup.exe	Windows 10/11	Installs the app, the meshnet CLI, the Wintun driver, and the MeshNetService background service.
Nixosoft MeshNet_*_amd64.deb	Debian/Ubuntu desktop	Install with apt install ./<file>, not dpkg -i — it carries the GUI and needs WebKitGTK.
*.AppImage	Any glibc Linux	Portable GUI. Needs meshnetd installed separately.
Nixosoft MeshNet_*_universal.dmg	macOS 11+	Desktop app, Apple Silicon and Intel in one.
meshnetd-macos-universal, meshnet-macos-universal, install-macos.sh	macOS servers	The engine on its own, installed as a LaunchDaemon: sudo ./install-macos.sh --server <url> --auth-key <key>
meshnetd-linux-x86_64, meshnet-linux-x86_64, meshnetd.service, meshnet-update.service, install.sh	Headless Linux (x86-64)	What a server should use: no GUI dependencies at all. sudo ./install.sh --server <url> --auth-key <key>
meshnetd-linux-aarch64, meshnet-linux-aarch64	Headless Linux (64-bit ARM)	Same install.sh; it picks the right pair from uname -m.
meshnetd-linux-armv7, meshnet-linux-armv7	Headless Linux (32-bit ARM, static musl/BusyBox — GL.iNet Comet KVM, Buildroot/OpenWrt boards)	Static, so it runs whatever the device's libc; packaging/openwrt/install-openwrt.sh on a BusyBox device, else install.sh.
install.ps1, meshnetd.exe, meshnet.exe, wintun.dll	Headless Windows Server	The service and CLI with no desktop app. Run elevated: .\\install.ps1 -JoinCode <code>
meshnet-server-*.tar.gz, install-server.sh	Your master server	The coordinator: device registry, access policy, relay and admin panel.

Joining a mesh

sudo meshnet up --server https://openc.hiradnikoo.com:15068 --auth-key <key>
sudo meshnet status

Generate a key in the admin panel under Add a device.

macOS and Gatekeeper

The macOS build is not signed or notarized — that needs an Apple
Developer ID certificate, which is a different credential from the EV
certificate used for Windows. Until one exists, Gatekeeper will refuse
the first launch. Right-click the app and choose Open, or
xattr -d com.apple.quarantine the download. The engine itself is
unaffected; only the first launch is gated.

The Windows installer, meshnetd.exe and meshnet.exe are
Authenticode-signed with Nixosoft's EV certificate, whose key lives in
Azure Key Vault and never leaves it — so SmartScreen does not warn, and
the service binary is signed rather than just the wrapper around it.
The bundled Wintun driver keeps WireGuard's own Microsoft-countersigned
signature; re-signing it would break the very thing that lets the
kernel load it.