Okiyumi VPN
Windows-first VPN platform with smart routing
Systems engineering · networking
A VPN you don't keep toggling: per-application and per-domain routing.
Context
A typical VPN is a blunt tool: either all traffic goes through the tunnel or none does. Okiyumi VPN solves this with application- and domain-level routing. The project is in closed beta.
Problem
Route traffic by rules: a specific app through the VPN, a specific domain direct, something else blocked — while surviving reboots and crashes without leaving the machine in a broken network state.
Solution
- 01
Smart Routing: Application → VPN / Direct / Block and Domain → VPN / Direct / Block, with TTL-aware domain rules and route ownership tracking.
- 02
Privilege separation: the React + Tauri UI talks to a dedicated Windows service over named pipes — the UI never needs administrator rights.
- 03
Transactional network changes, two-phase VPN connection and real WireGuard handshake validation — the system recovers from crashes and reboots on its own.
Architecture
React UI
interfaceTauri
native shellRust layer
named pipes · DPAPIOkiyumiEngine
Windows serviceNetwork Safety Layer
Smart Routing · WireGuard · WFP · DNSWindows networking
FLOW
- 01Application / domainrule→ Smart Routing
- 02Smart Routing→ VPN / Direct / Block
Numbers
Rust core tests
provisioning server tests
Stack
- TypeScript
- React 18
- Vite
- Zustand
- Tailwind CSS
- Tauri 2
- Rust
- WireGuard
- WFP
- Named Pipes
- DPAPI
- Debian
- systemd
Outcome
- A full networking stack on Windows: WFP, routing APIs, a DNS resolver and a custom routing-driver boundary — not a wrapper around someone else's client.
- Stability is verified by tests: 353 core tests plus separate suites for frontend, server and deployment.