{"rid":"egress/bastionroute","card":{"rid":"egress/bastionroute","eid":"bastionroute","topic":"egress","slug":"bastionroute","provider":"BastionRoute","url":"https://bastionroute.io/","domain":"bastionroute.io","category":"udp relay","tier":"free","verdict":"qualifies-with-caveat","vorder":1,"grp":"usable","confidence":"reported","binding":"volume-quota","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-06","n_evidence":3,"usd_month":null,"usd_per_tb_month":null,"summary":"A deliberately minimal forwarding fabric for WireGuard endpoints operating behind CGNAT, mobile networks and other NAT environments. No price, plan or allowa...","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"bastionroute","provider":"BastionRoute","url":"https://bastionroute.io/","category":"udp relay","tier":"free","free_tier":{"stated":"A deliberately minimal forwarding fabric for WireGuard endpoints operating behind CGNAT, mobile networks and other NAT environments. No price, plan or allowance is published; the repository is v0.1.0-alpha.","unit":"unlimited","metered_on":"unstated","source_url":"https://bastionroute.io/","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://bastionroute.io/","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://bastionroute.io/","notes":""},"egress":{"terms":"No allowance is published. The relay is described as seeing connections, timing, traffic volume, frame sizes and connection state, but no cap is named.; ingress: udp","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://bastionroute.io/"},"interface":["cli","unknown"],"interface_detail":"Relay plus shim binaries; the README describes a multi-shim architecture with no command reference.","tooling":"Shim plus relay from GitHub; no packaged client.","chaining":"Run the relay on a free VM and the shim next to the WireGuard endpoint; the free VM gets a UDP path it would not otherwise have.","limits":[{"kind":"volume-quota","value":"no published allowance; relay capacity unknown","source":"https://bastionroute.io/"}],"limits_note":"","binding":"volume-quota","binding_note":"With no meter published and an alpha relay, the first failure at 1 TiB/month would be relay capacity or availability, not a stated cap.","identity_cost":{"kind":"anonymous","detail":"The README defines no authentication or accounts: BastionRoute intentionally does not define encryption, authentication, authorization, payload schemas, or application semantics.","country":"None"},"reliability_note":"Alpha, single author, no authentication layer; the site itself says a hostile relay can drop, delay or disrupt traffic.","confidence":"reported","confidence_note":"Only the project's own README, site and a Show HN post exist; no hosted signup and no pricing page were found. Running the relay would move this to measured.","evidence":[{"url":"https://bastionroute.io/","date":"2026-10-23","proved":"A forwarding fabric for WireGuard endpoints behind CGNAT: outbound WebSocket, opaque forwarding, WireGuard as the trust boundary; no price or plan."},{"url":"https://github.com/klauscam/BastionRoute/blob/main/README.md","date":"2026-10-23","proved":"v0.1.0-alpha; relays UDP datagram streams between outbound-connected peers over WebSocket; defines no authentication."},{"url":"https://news.ycombinator.com/item?id=48856767","date":"2026-10-23","proved":"Show HN submission for an outbound-initiated WebSocket relay fabric for UDP; the item's own timestamp could not be retrieved from the HN API."}],"verdict":"qualifies-with-caveat","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"The most direct 2026 answer to the exact problem: a UDP relay that is explicitly designed to carry WireGuard from behind CGNAT. It is alpha, single-author, and has no hosted plan, so the client would run the relay on its own free VM.","extras":{"wg_path":"inside-udp","wg_detail":"Its stated purpose is to carry WireGuard: the endpoint establishes an outbound WebSocket connection; the relay forwards opaque traffic; WireGuard remains the endpoint-to-endpoint security layer. The relay carries UDP datagrams as binary WebSocket frames.","ingress":"udp","volume_tib_month":null,"volume_stated":"No allowance is published. The relay is described as seeing connections, timing, traffic volume, frame sizes and connection state, but no cap is named.","bytes_transit":"yes","transit_note":"A self-run or third-party relay forwards opaque frames between peers."}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:volume-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0,"unit":"TB","per":"month","currency":"USD","usd":0,"fx_date":null,"parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}