Orion
A self-hosted VPN only you can see. Obfuscated WireGuard, Tor-enforced ghost mode
HOW IT WORKS
What you're watching: your traffic's path. The tunnel is obfuscated WireGuard, so your ISP reads noise. The kill-switch drill seals the machine before anything leaks, then ghost mode routes every exit through Tor, enforced on the server.
The problem
Every commercial VPN has the same shape: you don't remove trust, you move it. Your traffic is encrypted, but the company running the exit node knows who you are, where you paid, and everything you do. Add the fact that vanilla WireGuard is trivially fingerprinted by DPI middleboxes, and "private" turns out to mean "private from everyone except the people you're hiding from."
The alternative, wiring up your own two servers with WireGuard, Tor, firewall rules, and a client, is a weekend of YAML and a year of edge cases.
Orion is that stack, productized for exactly one user: me.
The approach
Two VPS nodes (512MB of RAM each, a few dollars a month) provisioned end-to-end by an Ansible playbook: key-only SSH, fail2ban, volatile logs, and a consolidated nftables ruleset. On top of them:
- AmneziaWG obfuscation. The tunnel is WireGuard with junk packets and obfuscated handshake, so DPI sees noise on :4500/UDP, not a WireGuard signature.
- Ghost mode, enforced server-side. The egress node force-routes all TCP and DNS through Tor with nftables. The enforcement lives on the server on purpose: a buggy or compromised client cannot simply "not use Tor."
- Fail-closed kill switch. Firewall rules install before the tunnel comes up. If the tunnel or the root helper dies, the machine is sealed, never exposed.
- Keys generated client-side. The servers only ever see public keys. There are no accounts and no telemetry.
Two clients talk to it: a Tauri desktop app with a root helper daemon over IPC, and a Kotlin Android app over a plain WireGuard listener. One tap rotates the Tor circuit for a fresh exit identity.
The hard parts
- Fail-closed ordering. The kill switch only works if the rules exist before the interface does. Getting nftables to guarantee that, per connection mode, was the difference between a VPN and a liability.
- Ghost mode without breaking DNS. Routing DNS through Tor's DNSPort while keeping the tunnel's own resolution separate took its own ruleset.
- A root helper that isn't a hole. The desktop app needs root to drive the firewall; the helper exposes exactly four operations over IPC and nothing else.
Honest limits
This protects against an ISP, a local network, and casual surveillance. It does not protect against a global passive adversary, and the VPS payment trail is a known, accepted trade-off. The README says so out loud.