All builds are statically linked where possible, reproducible, and verified with SHA256 checksums. The fastest way in is the one-line installer.
curl -fsSL https://assets.rvpn.org/install.sh | sudo bash v1.3.4 patch — hardens the client’s DNS path end to end and fixes long-running memory growth in the CLI. A gateway that previously needed a weekly restart now runs flat indefinitely, and name resolution survives flaky upstream resolvers instead of dropping every connection on the hour. The mobile apps move to v1.2.9 with multi-server routing — details below.
When the configured resolvers drop queries — observed in the field on both major CN public resolvers — the client now falls through to last-resort resolvers (1.1.1.1, 8.8.8.8) instead of answering SERVFAIL. A slower answer beats no answer: the recurring “everything stops resolving once an hour” report is gone.
The CLI now allocates through mimalloc. glibc’s malloc arenas never returned memory under the client’s churn, growing a long-running gateway by ~5 MB an hour — 850 MB after a week. The same workload now holds flat at ~25 MB with no environment workarounds and no restarts.
NS, TXT, MX and HTTPS queries are now resolved properly instead of returning empty or type-mismatched answers — dig works against the proxy, root servers and all. Genuine resolution failures come back as SERVFAIL rather than a misleading empty success.
v1.2.9 — a profile can now carry extra exit servers, seeded from the profiles you already have, each with its own route domains and route IPs. Traffic that matches a rule egresses through that exit; everything else uses the profile's default server. Rolling out now on iOS and Android; macOS follows the build currently in App Store review.
Route domains use suffix matching — google.com also covers *.google.com — and route IPs accept plain addresses or CIDRs. Matched traffic goes out its exit and never silently falls back to the default. Rules load when the tunnel starts, so reconnect after editing.
Each exit resolves names through its own DNS-over-HTTPS channel inside the tunnel. Every answer is recorded against that exit, so follow-up connections to those IPs take the same route automatically — no hand-maintained IP lists for services with rotating addresses.
An exit server is one of your existing profiles reused as an egress point. Exits connect lazily on first use and reconnect independently, each with its own TOFU identity pinning. Export/import carries the whole setup — per-exit prekey bundles included when exporting with keys — and old exports still import cleanly.
The iOS tunnel now answers DNS inside the extension through a local resolver — the same architecture as macOS — instead of relaying queries to the server: required for per-exit routing, and more robust under interference. Also fixed: a crash loop on iOS 26 (EXC_BREAKPOINT in the downlink packet reader) that could take the tunnel down seconds after connecting.
SOCKS5, HTTP proxy, or TUN — on every desktop and every router. Statically linked where possible, with a matching SHA256 checksum for verification.
Confirm your binary matches the published SHA256 before you run it. Instructions below.
Same six targets as the client. Automatic Let’s Encrypt TLS out of the box — enable [server.acme] and point DNS at the box, done.
rvpn-server obtains and rotates its own Let’s Encrypt cert via TLS-ALPN-01 on the same :443 listener. Full config in the reference.
Two commands. Download the checksum file, then verify it against the binary you downloaded. Anything but OK means don't run it.
Mobile clients are commercial — revenue funds continuous protocol development. The core remains open source under AGPLv3.
iPhone & iPad with NetworkExtension support. Multi-profile editor with identity generation and .rvpn file handling.
Native menubar application with direct TUN mode and settings aligned to Apple's Human Interface Guidelines.
Material Design 3 interface with swipe-to-delete profile cards and tap-to-activate switching.
A native client for Huawei devices, built on the same open-source core. In active development.
Prefer scripted setup over grabbing a binary directly? The universal installer auto-detects your platform, verifies the checksum, and walks you through TLS + keys. All code is open source under AGPLv3 — clone and build with Cargo whenever you want to audit or patch.
Use the same installer with a server-only flag. See the docs for systemd and cloud deployment guides.
curl -fsSL https://assets.rvpn.org/install.sh | sudo bash -s -- --server-only Clone the repository and build the release binary locally. Requires a recent stable Rust toolchain.