Trusty — VPN Client

Trusty is a cross-platform GUI client for TrustTunnel VPN.

Platforms: Windows 10/11, macOS 11+ (alpha)
Status: Community-developed GUI wrapper for TrustTunnel CLI

• Material Design 3 interface with light/dark theme
• One-click VPN connection
• Server deployment to VPS — automatic setup via SSH
• Split tunneling (General/Selective modes)
• Domain groups with automatic discovery of related resources
• Real-time VPN log monitoring
• System tray integration (Windows, macOS)
• HTTP/2 and HTTP/3 protocols
• IPv6, custom DNS (DoH/DoT/DoQ)
• Random password generation for VPN accounts

1. Download Trusty-Windows-vX.X.X.zip from Releases
2. Extract to your preferred location
3. Run Trusty.exe
4. Configure server in "Settings" or deploy your own via "Server"
5. Click "Connect"

The archive includes everything: GUI, CLI client (trusttunnel_client.exe), Wintun driver.

1. Download Trusty-macOS-vX.X.X.zip from Releases
2. Extract and move .app to /Applications
3. Place client/ folder next to .app
4. First launch: Right-click → Open (Gatekeeper bypass)
5. Configure server in "Settings"
6. Click "Connect" — on first connect only, a macOS password dialog appears to grant VPN tunnel access (one-time setup, no terminal required)

macOS version is in alpha — no code signing.

git clone https://github.com/Meddelin/trusty.git
cd trusty
flutter pub get
flutter build windows --release   # Windows
flutter build macos --release     # macOS

See BUILDING.md for details.

Trusty can automatically deploy a TrustTunnel server on a VPS:

1. Open the Server tab
2. Enter SSH credentials for your VPS (IP, username, password or key)
3. Specify a domain (must point to VPS via A record)
4. Set VPN username/password
5. Click Install Server

Trusty will automatically: connect via SSH → install TrustTunnel → upload configs → obtain TLS certificate via Let's Encrypt → start systemd service.

After installation, click "Apply Client Settings" to auto-fill connection settings.

See CONFIGURATION.md for details.

Settings tab:

See CONFIGURATION.md for details.

Two modes:

• General — all traffic through VPN, except exclusions
• Selective — only specified traffic through VPN

Supports: domains, IPs, CIDR, applications (.exe on Windows, .app on macOS).

Domain groups with auto-discovery: when adding a domain, Trusty finds related resources (CDN, API) and offers to group them.

trusty/
├── lib/
│   ├── main.dart                    # Entry point, window, tray, navigation
│   ├── models/                      # Data models
│   │   ├── server_config.dart       # VPN client config + TOML
│   │   ├── server_setup_config.dart # Server deployment config
│   │   ├── setup_step.dart          # Server setup steps
│   │   ├── domain_group.dart        # Domain groups
│   │   └── vpn_status.dart          # VPN statuses
│   ├── services/                    # Business logic
│   │   ├── vpn_service.dart         # VPN process management
│   │   ├── config_service.dart      # Configuration and files
│   │   ├── server_setup_service.dart # SSH server deployment
│   │   └── domain_discovery_service.dart # Domain discovery
│   └── screens/                     # UI screens
│       ├── home_screen.dart         # Home (connection)
│       ├── settings_screen.dart     # Server settings
│       ├── split_tunnel_screen.dart # Split tunneling
│       ├── server_setup_screen.dart # Server deployment
│       └── logs_screen.dart         # Log viewer
├── assets/
│   ├── icon.png                    # App icon (1024x1024)
│   ├── tray_icon.ico               # Tray icon (Windows)
│   └── tray_icon.png               # Tray icon (macOS)
├── windows/                        # Windows platform
├── macos/                          # macOS platform
├── .github/workflows/
│   ├── release.yml                 # CI/CD Windows
│   └── release-macos.yml           # CI/CD macOS (alpha)
└── client/                         # CLI binaries (runtime)

• Make sure the CLI binary is in client/ next to the application
• Windows: client/trusttunnel_client.exe
• macOS: client/trusttunnel_client

• Close other VPN clients (AmneziaVPN, WireGuard, etc.)
• Wintun driver can only be used by one application at a time
• Wait 5 seconds after disconnecting before reconnecting

• Right-click on .app → Open → Open
• Or: System Settings → Privacy & Security → Allow

• On the first VPN connection, a macOS password dialog appears — this is expected
• Trusty sets the setuid bit on the CLI binary (one-time) so it can open the TUN device
• After confirming, subsequent connections work without any dialogs
• If the dialog was cancelled: just click Connect again

If you see Failed to bind socket for UDP traffic (10055) in logs, Windows has run out of socket buffer space. Fix with PowerShell (run as Administrator):

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name MaxUserPort -Value 65534 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name TcpTimedWaitDelay -Value 30 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\AFD\Parameters' -Name DefaultSendWindow -Value 65536 -Type DWord -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\AFD\Parameters' -Name DefaultReceiveWindow -Value 65536 -Type DWord -Force

Then restart Windows.

1. Check server hostname, IP and port
2. Check username and password
3. Try switching protocol (HTTP/2 ↔ HTTP/3)
4. Review logs in the "Logs" tab

Apache License 2.0 — see LICENSE.

Included components:

• TrustTunnel Client CLI — Apache 2.0
• See NOTICE for full license information

• TrustTunnel Protocol — core protocol and server
• TrustTunnel Client — CLI client
• Issues — report a problem

Made with Flutter