Go to file

E. Kaparulin 278cbf4fb4 docs: add a server quickstart and disclose the UDP relay provisioning

Same audit as konduit-public (c61664c), applied to koridor. The conclusion
is the opposite: there is no server binary and no config format, so nothing
can be documented wrongly. The source backs the README - ffi/src/ssh.rs:389
uses per-flow channel_open_direct_tcpip, with no streamlocal, remote TUN or
forwarded-tcpip anywhere in the crate. No contradictions found; the gap was
thinness.

Added docs/server-quickstart.md. The whole server story was previously one
clause in the README:

- The real requirement (AllowTcpForwarding yes), and that it is already the
  OpenSSH default, so most servers need no configuration at all.
- What you do NOT need: ip_forward, masquerade rules, /dev/net/tun, root.
  Anyone who has set up a VPN server before assumes all four are required.
- Keypair generation, since the user supplies the key; koridor does not
  generate one for the tunnel.
- Host key trust on first connect. The connect is refused until the
  fingerprint is accepted, and a later change is fatal rather than retried.

The finding that justified the work: UDP forwarding provisions itself on the
user's server on first enable - it writes ~/.koridor/udp-relay.sh, appends a
forced-command line to ~/.ssh/authorized_keys marked # koridor-udp-relay, and
requires socat (hardcoded in ffi/src/udp_relay/script.rs:12). So "No special
server-side software required" is true for TCP and false once that toggle is
on. Nothing public said so. It is off by default and idempotent, and
remove_marked_line strips only koridor's own line, leaving every other key
untouched - but a user's authorized_keys and home directory are modified
without them being told. The README now carries that caveat inline.

#k-ops/#6/#212

2026-10-10 22:58:19 +03:00

docs

docs: add a server quickstart and disclose the UDP relay provisioning

2026-10-10 22:58:19 +03:00

images

Add Play Store feature graphic

2026-07-30 00:48:07 +03:00

privacy-policy.md

Add privacy policy

2026-07-30 00:36:33 +03:00

README.md

docs: add a server quickstart and disclose the UDP relay provisioning

2026-10-10 22:58:19 +03:00

README.md

koridor

VPN over your own SSH server.

koridor is a full-device VPN client built around a single idea: you already have a server you trust — just tunnel through it.

Instead of operating its own VPN infrastructure, koridor routes your device's traffic through a plain SSH server you configure yourself. There's no koridor-operated backend, no account, and no third party in the middle.

Why koridor?

Most VPN apps ask you to trust the app vendor's servers. koridor doesn't have any — it connects to a server you already own or personally trust, using nothing more exotic than standard SSH port forwarding on the wire. If you can run sshd, you can run a koridor server.

Features

Full-device tunnel — a TUN-based VPN, not just an app-aware SOCKS proxy. Every app on the device is covered, with no per-app setup.
Bring your own server — connects to any SSH server with AllowTcpForwarding yes. No special server-side software required. (One opt-in exception: UDP port forwarding provisions a relay script and an authorized_keys line on your server — see the Server Quickstart.)
Simple onboarding — set up a connection profile, toggle on, done.
Fail-closed reconnects — transient drops are retried with exponential backoff; if the tunnel can't recover, the route is torn down rather than silently leaking traffic in the open.
Tunnel-only DNS — lookups are resolved through the server's own resolver over the tunnel, never leaked to a third-party DNS provider.
No telemetry — no analytics, crash reporting, or usage tracking of any kind.
Cross-platform — Linux, Windows, Android (macOS and iOS planned).

Download

Android

Linux · Windows

Releases are published on the Releases page.

macOS · iOS

Coming soon.

Setup

Server Quickstart — what your SSH server needs, the keypair, host-key trust, and what UDP forwarding provisions on your box

Architecture

Flutter UI (Dart)
      │
FFI (cdylib)
      │
koridor engine (Rust)
      ├── TUN device
      ├── smoltcp netstack (packets → TCP flows)
      ├── russh SSH client (direct-tcpip per flow)
      └── Route manager

Each TCP flow captured off the TUN device is proxied over its own SSH direct-tcpip channel — the same kind of traffic an ordinary SSH port-forward produces, indistinguishable on the wire from routine SSH use.

The TUN device and OS route management layer is shared with Konduit, other VPN client from K-Ops Oy , and is published for transparency and audit as konduit-platform.

Security

Your SSH private key and passphrase are stored only in the OS secure credential store (Android Keystore / platform-equivalent) and are only ever sent to the server you configure, as part of establishing the tunnel.
All traffic between client and server is carried inside the SSH transport.

See the Privacy Policy for full details on what koridor does and does not process.

Support & Contributing

Bug reports: file an issue on Gitea Issues.

Vulnerabilities: report directly to koridor@k-ops.eu.

Contributing: core development is handled internally. We do not currently accept external pull requests.

About

Created by Eugen Kaparulin. Official binaries distributed by K-Ops Oy.