veil v0.1.0 — free edition

veil routes any application through any tunnel chain (WireGuard, OpenVPN, SOCKS5, HTTP, Tor) inside its own Linux network namespace, with a per-profile kill switch and isolated state. This is the free edition.

Highlights

• Zero-capability uplink — the engine runs unprivileged (no cap_net_admin, CapEff=0) via user namespaces + a userspace uplink (pasta). install.sh builds a known-good pasta from source, so it works across Debian, Ubuntu, Fedora, and Arch.
• All chain backends (WireGuard / OpenVPN / SOCKS5 / HTTP / Tor) with multi-hop chaining.
• Per-app netns isolation, per-profile kill switch (fails closed), per-profile DNS + data dir.
• GUI + CLI; bulk import of Mullvad / Proton / IVPN configs.
• No telemetry — zero phone-home.
• Docker: a hardened capless image (+ an optional browser variant for headful isolated browsing). See packaging/docker/.

Install

git clone https://github.com/mstampfli/veil && cd veil
sudo ./install.sh

Or grab the prebuilt static CLI below (veil + veil-bridge, linux/amd64). The GUI builds from source via install.sh.

License

Free edition: PolyForm Noncommercial 1.0.0 (source-available — use, modify, and contribute for noncommercial purposes; commercial use needs a separate license). See LICENSE. A commercial Pro edition adds an anti-detect stack — see the project site.

Disclaimer

Provided "as is", no warranty. The authors accept no liability for any damages — including IP/DNS leaks, kill-switch failure, deanonymization, or data loss. Verify your setup (veil doctor, veil selftest) and use at your own risk.

Found a bug?

Run veil bug-report, or open an issue here. Reports are welcome and genuinely help.

Verify downloads against SHA256SUMS.