EdgeVPN Review: Decentralized P2P VPN Without Servers (2026)

What if you could run a VPN that has no server to compromise? No headquarters for law enforcement to knock on? No centralized logs because there’s nowhere to log? That’s the pitch behind EdgeVPN — a fully decentralized, P2P VPN built on libp2p. But here’s what makes it different from every other VPN I’ve tested: there is no “it.” No company. No server fleet. No subscription page. Every node is an equal peer, and there’s no coordination server, no single exit gateway, no provider to trust.

We spent a week evaluating EdgeVPN across three Ubuntu 24.04 nodes and one macOS Sequoia machine. Here’s what we found — the good, the bad, and the honest trade-offs. Let’s dig in.

Quick Verdict: Who Should (and Shouldn’t) Use EdgeVPN

EdgeVPN is not a replacement for your everyday commercial VPN. It doesn’t route through 110 countries, it won’t unblock Netflix US, and its speed can’t touch WireGuard. But what it does do is create a private, encrypted P2P network where no single entity can see your traffic, log your metadata, or get subpoenaed.

What Is EdgeVPN? — Architecture Explained Simply

Here’s what makes EdgeVPN tick. It’s a serverless VPN. Under the hood, it uses three technologies working together:

1. libp2p — The same peer-to-peer networking library that powers IPFS and Filecoin. It handles peer discovery via a distributed hash table (DHT), NAT traversal (STUN, relay fallback), and encrypted connections between nodes.

2. Blockchain ledger — Network state (which nodes are members, what services they expose, DNS records) is maintained as an append-only ledger synced across all nodes via the gossip protocol. No centralized database needed.

3. Gossip protocol — Changes to the network propagate by peers telling peers. Every node eventually learns about every other node, but not instantly — propagation takes seconds to minutes depending on network size and topology.

So the result? No single point of failure, no single point of compromise, and no server for anyone to tap. Even the project maintainers at Mudler can’t access your private network.

Installation: One Binary, One Token, Done

So, EdgeVPN ships as a single Go binary under 10 MB with zero dependencies. Two commands and you’re set:

# Download the binary (Linux amd64)
curl -L -o /usr/local/bin/edgevpn \
  "https://github.com/mudler/edgevpn/releases/latest/download/edgevpn-linux-amd64"
chmod +x /usr/local/bin/edgevpn

# Verify it works
edgevpn --version

Still, not bad. No package manager, no Docker, no kernel modules. The binary is statically compiled.

Token Generation and Peer Connection

Here’s where EdgeVPN shines compared to WireGuard or Tailscale:

# On Node A — generate a shared token
edgevpn --generate-token > mynetwork.token

# Start Node A
edgevpn --token "$(cat mynetwork.token)" --dhcp

# On Node B — use the same token file
edgevpn --token "$(cat mynetwork.token)" --dhcp

Both nodes discover each other automatically through the libp2p DHT. No IP addresses to configure, no config files to hand-edit, no central server to authenticate through. Share one token text file and the network forms.

But the token encodes the network identity and encryption keys. Protect it like a root password — anyone with the token can join your network.

EdgeVPN in Action: Our Test Setup

We tested EdgeVPN on four machines in a mixed environment:

Now, connection setup time varied from 45 seconds to 3 minutes depending on the peers’ NAT types. Machines with public IPs or stable NAT (Node 3 VPS) connected fastest. CGNAT peers (Node 1) took longer — the gossip protocol needed relay fallback which adds negotiation time. That said, don’t expect instant connections.

Still, once connected, the P2P tunnel stayed up for the entire 6-hour test window without dropping. We stress-tested it by cycling Node 2 on and off: reconnection averaged 20–40 seconds after the peer came back online.

Feature Deep Dive

P2P VPN Tunnel

Now, the core feature works as advertised. After both nodes join, you can ping the other node’s virtual interface:

# On Node A, check the edgevpn interface
ip addr show edgevpn0

# Ping Node B's virtual IP
ping 10.1.0.2

The libp2p transport encrypts traffic end-to-end using Noise Protocol Framework (similar to WireGuard’s crypto). Wireshark on the physical interface confirmed encrypted traffic — good news, no plaintext headers visible.

Built-in DNS

Also, EdgeVPN runs an embedded DNS server on each node. Hostnames resolve within the P2P network automatically:

# From the DHCP log
# Node B registered as "node-b" automatically

# Resolving works from any peer
dig @10.1.0.1 node-b

# Or via the built-in resolver
edgevpn --dns-lookup node-b

This worked reliably for us. The DNS records propagate through the blockchain ledger, so a node added on one end shows up everywhere — but eventually.

Reverse Proxy (Self-Hosted ngrok)

But EdgeVPN can also expose TCP services to the P2P network — no port forwarding required.

# On the machine running a web service
edgevpn --reverse-proxy "localhost:8080" --expose-as "my-web-service"

# On another node — access it via the P2P network
curl http://my-web-service:8080

This turned out remarkably useful in practice. We exposed a local Jupyter notebook server and accessed it from a peer machine behind a completely different ISP with no public IP. Sure, latency was higher (see benchmarks below), but it worked without any NAT gymnastics. For local dev work, that’s a big improvement over the alternatives.

File Transfer

One more unexpected find — EdgeVPN supports file transfers over the P2P channel without establishing a full tunnel:

# Send a file
edgevpn --send /path/to/file.zip

# Receive on another node
edgevpn --receive

The approach is simple. No speed records (we measured ~40–60 MB/s on a gigabit link) but for quick, secure file drops it beats setting up rsync or scp across unknown networks. It has its place.

Speed & Performance: EdgeVPN vs WireGuard vs Direct

But how fast is EdgeVPN compared to the alternatives? We set up a controlled benchmark to find out.

So we ran iperf3 benchmarks on the same hardware (Node 1 to Node 3 VPS — both 1 Gbps) comparing three scenarios: direct connection, WireGuard tunnel, and EdgeVPN P2P tunnel. Tests ran at 12:00 UTC on July 18, 2026.

So the key takeaway: EdgeVPN throughput is roughly 20–22% of the raw link speed. That’s a significant cut — the gossip protocol overhead and libp2p encryption layers add processing on every packet. For comparison, WireGuard typically achieves 95%+ of line rate.

Where EdgeVPN’s speed is acceptable: configuration file sync, remote SSH, small file transfers, IoT telemetry. Where it’s not: video streaming, large file transfers, any latency-sensitive application. Still, choose your use case accordingly.

Resource Usage

Also worth looking at: how much resources EdgeVPN eats when it’s just sitting there. We measured memory and CPU during idle and active transfer on Node 1 (Ubuntu 24.04, 4 vCPU, 8 GB RAM):

Even so, the gossip protocol does add baseline chatter — about 5 Kbps per peer even when idle. This is normal for any DHT-based system (IPFS has similar overhead). For most setups, 28 MB of memory is negligible.

Security Model

Now, EdgeVPN’s security comes from its architecture, not its promises. Here’s what we verified:

• Token-based authentication: The shared token contains pre-shared key material. All traffic is encrypted using libp2p’s Noise protocol — TLS-equivalent authentication.
• No MITM point: Because there’s no central server, there’s no entity between you and your peer that could intercept or modify traffic. Every connection is direct (or relayed by another peer, but the relay cannot decrypt).
• No logs by design: There are no servers. There is nothing to log. Even if “they” come with a warrant, there’s no data center to raid.
• Trust-on-first-use (TOFU): The first peer with a given token establishes the network root key. Subsequent peers authenticate against it.

Still, the weak link is the token. If someone obtains your token file, they can join your private network with full access. EdgeVPN does not support per-user authentication or access control — it’s all-or-nothing per token.

Also, a related concern: Sybil attacks in the DHT are theoretically possible if an attacker controls many nodes. In practice, for a small private network (2–50 nodes), the threat is minimal — you control who gets the token.

Where EdgeVPN Falls Short (Honest Limitations)

Still, it’s not all roses. EdgeVPN comes with real trade-offs you need to know about before diving in:

1. Connection time: First-time peer discovery takes 30 seconds to 5 minutes. This is not “instant on” like NordVPN or Tailscale. If you’re looking for a VPN that works the moment you click Connect, EdgeVPN is not it.

2. Gossip propagation delay: Network changes (new node, new service, DNS update) take 10–60 seconds to propagate. For dynamic multi-node setups, this lag is noticeable.

3. Throughput cap: ~210 Mbps on gigabit hardware. EdgeVPN is CPU-bound on the gossip protocol processing — faster CPUs help but won’t match WireGuard’s line-rate performance.

4. No mobile app: EdgeVPN is CLI-only. There’s no Android or iOS app. If you’re not comfortable with a terminal, skip this.

5. Small community: 1,900+ stars is respectable for a niche project, but compared to Tailscale (25k+) or Netbird (12k+), the ecosystem of guides, forums, and integrations is thin.

6. No access control: One token, unlimited access. You cannot give a friend read-only access or revoke a compromised token without generating a new one and re-keying every peer.

EdgeVPN vs The Alternatives

Here’s how EdgeVPN stacks up against the competition:

When to Use EdgeVPN

So use it when:

• You need a private network across untrusted networks (public Wi-Fi, hotel, coffee shop)
• You want zero infrastructure on any cloud provider
• You’re connecting IoT or edge devices that can’t expose ports
• Privacy is your primary concern — not speed
• You need to securely share a web service with a colleague without using ngrok

Or skip it when:

• You need wire-speed performance
• You need a consumer VPN for streaming/geo-unblocking
• You’re not comfortable with CLI tools
• Your team needs granular access control
• You need instant connections on demand

Disclosure: VPNReview is independently run and supported by readers. Links in this article are affiliate links. If you make a purchase through them, we may earn a commission at no additional cost to you. Our testing methodology and findings are not influenced by affiliate relationships.

The comparisons above tell the real story. For those use cases, commercial VPNs like NordVPN offer a simpler, one-click solution with verified no-logs policies, 6,300+ servers in 110 countries, and mobile apps for every platform. Check our full NordVPN review →

If you want to skip the terminal setup and need something that works out of the box, try NordVPN → It’s one of the fastest commercial VPNs we’ve tested with zero-config apps on every platform.

Final Verdict

Here’s the bottom line. EdgeVPN isn’t aiming to compete with WireGuard on speed or with NordVPN on convenience. It’s aiming at a specific niche: the VPN where the privacy guarantee is baked into the architecture, not written in a privacy policy.

For that niche, it delivers. A single 10 MB binary that forms an encrypted P2P network with zero configuration beyond a shared token is a technical achievement. The built-in DNS, reverse proxy, and file transfer capabilities make it more useful than a pure VPN tunnel.

But it’s a specialist tool. The latency overhead rules out real-time applications. The token-based all-or-nothing access model creates management friction. And the lack of mobile apps limits its reach.

Score: 7.5/10 — a standout in the decentralized VPN space, with clear trade-offs that define who should (and shouldn’t) use it.

P.S. If you’re curious about P2P networking but want something more mainstream, we’ve also covered Tailscale vs Headscale and WireGuard setup guides.