BastionRoute
bastionroute.io · Egress and tunnels · 1 record · JSON
BastionRoute Egress and tunnels
caveatanonymousno cardRvolume-quota
| Free tier | A deliberately minimal forwarding fabric for WireGuard endpoints operating behind CGNAT, mobile networks and other NAT environments. No price, plan or allowance is published; the repository is v0.1.0-alpha. unit unlimited; metered on unstated |
|---|---|
| Price | USD 0 |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | No allowance is published. The relay is described as seeing connections, timing, traffic volume, frame sizes and connection state, but no cap is named.; ingress: udp free_allowance: none published |
| Identity | anonymous The README defines no authentication or accounts: BastionRoute intentionally does not define encryption, authentication, authorization, payload schemas, or application semantics. |
| Limits |
|
| Binding | volume-quota With no meter published and an alpha relay, the first failure at 1 TiB/month would be relay capacity or availability, not a stated cap. |
| Interface | cli, unknown Relay plus shim binaries; the README describes a multi-shim architecture with no command reference. |
| Tooling | Shim plus relay from GitHub; no packaged client. |
| Composes with | Run the relay on a free VM and the shim next to the WireGuard endpoint; the free VM gets a UDP path it would not otherwise have. |
| Reliability | Alpha, single author, no authentication layer; the site itself says a hostile relay can drop, delay or disrupt traffic. |
| Notes | The most direct 2026 answer to the exact problem: a UDP relay that is explicitly designed to carry WireGuard from behind CGNAT. It is alpha, single-author, and has no hosted plan, so the client would run the relay on its own free VM. |
| Evidence rung | reported Only the project's own README, site and a Show HN post exist; no hosted signup and no pricing page were found. Running the relay would move this to measured. |
| Checked | 2026-10-23 (live); stale on 2026-11-06 |
| Parsed numbers |
|
Evidence (3)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | bastionroute.io/ | A forwarding fabric for WireGuard endpoints behind CGNAT: outbound WebSocket, opaque forwarding, WireGuard as the trust boundary; no price or plan. |
| 2026-10-23 | github.com/klauscam/BastionRoute/blob/main/README.md | v0.1.0-alpha; relays UDP datagram streams between outbound-connected peers over WebSocket; defines no authentication. |
| 2026-10-23 | news.ycombinator.com/item?id=48856767 | Show HN submission for an outbound-initiated WebSocket relay fabric for UDP; the item's own timestamp could not be retrieved from the HN API. |
More fields (7)
{
"wg_path": "inside-udp",
"wg_detail": "Its stated purpose is to carry WireGuard: the endpoint establishes an outbound WebSocket connection; the relay forwards opaque traffic; WireGuard remains the endpoint-to-endpoint security layer. The relay carries UDP datagrams as binary WebSocket frames.",
"ingress": "udp",
"volume_tib_month": null,
"volume_stated": "No allowance is published. The relay is described as seeing connections, timing, traffic volume, frame sizes and connection state, but no cap is named.",
"bytes_transit": "yes",
"transit_note": "A self-run or third-party relay forwards opaque frames between peers."
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable