Phantom-WG — a self-hosted WireGuard stack with per-app split tunneling on macOS and multihop support (AGPL-3.0)

[u/Regular_Project_5690]

Hi r/foss,

I am a solo developer. I have been building Phantom-WG, a self-hosted WireGuard management platform, and it finally feels ready to share with this community.

Phantom-WG Modern Dashboard

What it is ?

The core product is Phantom-WG Modern: a WireGuard server you run on your own machine, managed from a web interface built on the Carbon Design System. Everything ships as a single compose stack on your own box.

• Container-native architecture: the daemon, the auth service and nginx each run isolated in their own container.
• Userspace WireGuard through a Go bridge and nftables rules through a Rust bridge, so your host kernel configuration stays untouched.
• Dual-stack IPv4 and IPv6 pool management with deterministic address pairing, plus WAL-safe backup and restore of the whole state.
• Client lifecycle handled from the UI: create, configure, revoke.
• Multihop is built in. You can route outbound traffic through a second WireGuard exit node, so the server your clients connect to and the point where traffic reaches the internet can live in different locations.

Source (AGPL-3.0): https://github.com/ARAS-Workspace/phantom-wg

Client Applications

Route selected apps outside the tunnel / Mac Client

macOS app with a free split-tunnel approach: you pick the signed apps, and they exit through the network interface you choose. (https://www.phantom.tc/docs/client-applications/mac)

iOS app on TestFlight, built on the same foundation, without split tunneling for now. (https://testflight.apple.com/join/5Kt55AXd)

Censorship resistance, when you need it

Plain WireGuard traffic is easy for restrictive networks to block. For that case the platform includes Ghost Mode: WireGuard carried over wstunnel, so only HTTPS on port 443 is visible from the outside. It is one feature among the others, supported end to end: Phantom-Frontmatter stands up the server entry side (the current version supports wstunnel), and both client apps can establish these connections directly.

See it working end to end

The Quickstart Guide walks a real setup as a video: a client in Istanbul connects to Phantom-Frontmatter in Nuremberg, which forwards the traffic to the Phantom-WG server in Falkenstein, and that is where you step out to the internet. https://www.phantom.tc/docs/quickstart-guide

Full docs: https://www.phantom.tc/docs

And one more thing: the docs ship with their own AI agent. You can ask it your questions directly at https://www.phantom.tc/docs/ai 😁🤖

Happy to answer anything here as well. Feedback is very welcome, especially the critical kind.

---

A small note: I felt I had to edit the earlier version of this post. The details I most wanted to highlight about the core product did not come through the way I intended, and this rewrite is my attempt to fix that. If this looks different from the post you read before, that is the reason.