GitHub - klauscam/BastionRoute: An outbound-initiated WebSocket relay fabric for UDP datagram binary streams that operates with zero-inbound port architecture · GitHub
/" data-turbo-transient="true" />
Skip to content
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
klauscam
BastionRoute
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>75 Commits<br>75 Commits
cmd
cmd
images
images
LICENSE
LICENSE
Makefile
Makefile
README.md
README.md
go.mod
go.mod
View all files
Repository files navigation
BastionRoute (v0.1.0-alpha)
An outbound-initiated WebSocket relay fabric for UDP datagram binary streams that operates with zero-inbound port architecture.
This is the official and original repository for BastionRoute maintained by klauscam
BastionRoute is a stateless, outbound-only UDP datagram binary stream relay fabric designed to route binary traffic over a stateful Layer-7 WebSocket transport.
By initiating all data pipelines via outbound-only connections, BastionRoute eliminates the concept of an internet-facing listening socket at your network edge. It provides deterministic routing of raw data streams between identified peers over an outbound WebSocket relay fabric, acting as a payload-agnostic transport layer.
Core Intent & Design Philosophy
What is BastionRoute for?
BastionRoute is a specialized, stateless transport utility built to complement a strict zero-inbound listening port policy on your edge firewall while maintaining real-time remote access to private network resources (like native WireGuard).
It acts as low-level digital plumbing designed to plug seamlessly behind existing public web infrastructure (like Cloudflare Proxy, Nginx, Caddy, or Traefik). This lets you bridge network segments over untrusted public space without exposing your private infrastructure to the internet.
Architectural Pillars
BastionRoute leverages a decoupled, multi-shim architecture that completely separates the data plane from the control plane to preserve payloads as-is.
Attack Surface Reduction (Zero-Inbound): Traditional topologies require an edge gateway to "listen" on a public port. BastionRoute reverses this logic. Both your isolated Server Shim and remote Client Shim initiate standard outbound-only Layer-7 connections to an external, transient Relay Broker. Because your gateway firewall maintains zero listening ports, your network edge remains dark to internet scans.
Deterministic "UDP Physics" Over TCP: Wrapping real-time UDP streams inside stateful TCP tunnels traditionally causes Head-of-Line blocking ("TCP Meltdown"). When a packet drops, standard proxies stall the pipeline to force a retransmission, introducing devastating latency spikes that break VPN handshakes. BastionRoute’s concurrent data engine fixes this by leveraging non-blocking Go channel selectors to explicitly drop frames at the application layer during network congestion. By perfectly emulating real-world, lossy UDP physics rather than backing up an internal queue, interactive streams stay completely fluid and lag-free.
Blind Transport Brokerage (Zero-Trust): BastionRoute is entirely payload-agnostic and does not interpret application payload semantics. The external Relay functions entirely in transient memory, terminates no internal VPN encryption, and requires no cryptographic keys. Security remains entirely end-to-end at the application layer (e.g., WireGuard).
📦 Deployment Mechanics
Prerequisites
Go 1.21+ compiler toolchain
make utility installed (standard on Linux/macOS)
Installation & Compilation (Ubuntu)
BastionRoute utilizes a standard multi-binary cmd/ architecture. The compilation step automatically leverages the Makefile to pull down required dependencies (including github.com/gorilla/websocket) and verify the Go environment.
To download dependencies and compile all binaries into a localized execution folder simultaneously, run:
git clone https://github.com/klauscam/BastionRoute.git<br>cd BastionRoute<br>make
Once completed, both production-ready binaries will be available inside the local target execution directory:
bin/bastionroute-shim
bin/bastionroute-relay
To clean up build artifacts and purge compiled binaries from your workspace at any time, run:
make clean
🚀 Execution Guide
Running the Relay
Deploy the relay binary on a web accessable server or localized DMZ boundary. This acts as a payload-agnostic relay broker that maintains transient routing state in memory. It is highly recommended to deploy this behind an edge reverse proxy (Nginx/Caddy) or Cloudflare Proxy:
./bin/bastionroute-relay...