Summary
Bifrost is a self-hosted VPN for Windows 11 and Linux, written in Rust. Its public MVP provides a background service and command-line client, focused on the tunnel lifecycle and preventing traffic from escaping outside it.
Role and scope
I design and develop Bifrost: tunnel orchestration, traffic filtering, DNS handling, system integration, and test tooling.
Problem and constraints
A tunnel can stop, reconnect, or encounter a DNS failure. The system must coordinate these transitions with traffic filtering, rather than treating a successful connection as sufficient protection.
Architecture
The Rust workspace separates the state machine, privileged daemon, CLI, authenticated IPC, firewall, DNS, and secret storage. WireGuard integrates with the Linux kernel and WireGuardNT on Windows; filtering uses nftables and Windows Filtering Platform respectively.
Decisions and trade-offs
The state machine produces actions without making system calls. Firewall policies are represented as data, allowing their behavior to be tested separately from privileged execution. The kill switch is designed to remain armed across connection failures and reconnects.
Testing and verification
The public repository includes leak-test benches and automated Linux and Windows checks. The CI run linked below passed its Linux and Windows jobs, leak suite, dependency audit, and software-component inventory generation. Tests that cannot run in a given environment are tracked separately.
Resources and links
Scope and current status
The project remains in development. The public version provides a daemon and CLI; the graphical interface is not yet published, and no GitHub release is available. Anti-censorship transports and OS telemetry reduction are ongoing work: DNS filtering is implemented, while some Windows layers remain unfinished. This MVP does not guarantee leak-free operation or anonymity in every environment.