Disclosure: Some links below are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you.

• NordVPN — audited commercial VPN, the mainstream paid alternative

Rayfish Review 2026: A Mesh VPN With No Server, No Account

Every mesh VPN you have used keeps a silent middleman in the loop. Tailscale funnels you through its control plane and DERP relays. Headscale just moves that middleman onto a server you now have to maintain. Netbird wants a management backend stood up before anything talks to anything else. Rayfish is the first project in this space that says you can drop the middleman entirely — no coordination server, no account, no signup. One machine runs ray create, shares an invite code, and the network forms itself.

That pitch carried the Rust project to 504 GitHub stars in five weeks after its June 22 launch, and v0.2.1 landed July 24. It sits on iroh v1, the P2P library from n0, the team behind the original IPFS work, which shipped QUIC-based connectivity in 2026. Yet this is the first iroh-ecosystem review on this site, and it fills a gap we had flagged: a mesh VPN that needs no coordination server at all.

We tested the install path, the network lifecycle, and the security posture on a single Ubuntu 24.04 box. Because the platform reality is that Windows is not yet supported, the in-house throughput run needs a second node we did not have on review day. Where numbers below are conditions-limited, we say so plainly rather than dressing up estimates as measurements.

Quick Verdict

Rayfish is a genuinely interesting answer to a question most VPN tools never bother to ask: what if the network is just the people in it?

Who it is for: homelab owners who resent paying a coordination tax to Tailscale, small teams and Discord friend-groups that want a shared network without any admin, and anyone curious about the iroh/QUIC stack. And setup is fast, the feature set is dense, and the project is honest about its own limits.

Who should skip it: anyone putting sensitive or production traffic on a network with no independent security audit. The README says it plainly — experimental, pre-1.0, don’t use it in your company yet. Rayfish is a tool you adopt with your eyes open, not a firewall you install and forget.

What Makes Rayfish Different

The core design decision is that the only shared state in the whole system is a signed record published to the public DHT. There is no control plane to trust and no server to rent. Identity is the key, not something issued by a coordinator.

Each machine derives a virtual IP from its cryptographic identity — IPv4 from the 100.64.0.0/10 CGNAT range, IPv6 from 200::/7. Nodes discover each other through the DHT and connect with iroh’s QUIC transport, which handles NAT traversal via UPnP, NAT-PMP, and PCP automatic port mapping. When hole-punching fails, traffic falls back to an encrypted relay.

“Closed by default” is a real property here, not marketing. Because a network only exists after one node runs ray create, and every new member needs an invitation — a one-time code, a reusable fleet key, or real-time approval via ray requests and ray accept. That closed-by-default posture is a firm foundation for the whole design.

The one thing to keep in your head is that “no server” does not mean “no third party anywhere.” Even the relay path routes through infrastructure run by n0, and that relay provider sees connection metadata. Here is the honest framing: the trade-off is real, and we come back to it in the security section.

Hands-On: Install and Build a Network

The install chain is refreshingly short. A single curl-pipe runs the installer, which carries a checksum check, and the install script itself sits in the repo for review before you execute it:

curl -fsSL https://rayfish.xyz/install.sh | sh
sudo ray up   # root required only on first run; user-mode afterwards

We reviewed the install script before running it — the checksum verification is real, and the file is short enough to audit in one pass. Because the first ray up needs root for the TUN device and userspace firewall, everything after that runs in user mode. That one-time elevation is the same model a lot of tailscale-install scripts use, so nothing new to distrust there.

Creating a network is three commands:

ray create my-homelab
ray invite                     # one-time code, expires in 7 days
# on the second machine:
ray join <invite-code>
ray status                     # shows direct vs relay path, RTT, traffic

Yet ray status is where the tool earns its keep. It tells you which path each peer is on — direct QUIC when hole-punching worked, relay when it did not — and surfaces latency and per-connection traffic. That visibility is the sort of thing self-hosters expect from a good mesh tool, and it is present from day one. Though we only ran it on a single node this pass, the output format is built for exactly this triage.

Magic DNS is another pleasant surprise, and the naming is the polish that sells it: every node gets a name under name.network.ray, so you reach a peer by hostname instead of remembering a virtual IP. On a multi-node network that single convenience saves more fiddling than any config flag.

Rayfish Speed: Direct vs Relay Paths

Here is where we flag the honest limit. A proper throughput run needs at least three nodes across direct and relay paths, and a second machine was not available in the review environment. What we can confirm from the tooling itself is how the measurement works and what to expect from the architecture.

The iroh v1 release notes are explicit that the QUIC transport is built for low-overhead, low-latency tunnels, so a direct path should stay close to line rate. Yet the relay path trades throughput for the guarantee that the network still works behind restrictive NATs. While on a 1 Gbps fiber line the direct path is expected to show single-digit percentage loss, we are not putting a fake number in this table. Because that would be the one thing this review must not do: get a second node and run the three-command check above; that is the honest measurement.

Honestly, ray netcheck is worth running even without a second box. It reports local UDP port reachability, relay latency, and your public address, which tells you immediately whether your router will cooperate with hole-punching or whether you will live on the relay path. And it doubles as a quick firewall sanity check, which is more than most mesh tools hand you for free.

Rayfish Privacy and Security

The security story is the part that makes this project worth a second look.

On leak testing, the defaults are solid. The TUN device binds traffic into the mesh, and the per-device userspace firewall is on by default. DNS resolves through Magic DNS inside the tunnel, and the firewall policy is deny-by-default for inbound connections from outside the network.

Yet the catch is the audit state: there is no independent security audit, and the project says so in its own README. Code is fresh, the attack surface of a pre-1.0 networking tool is not trivial, and the maintainers explicitly recommend against using it for sensitive or production workloads today. That candor is worth more than a clean audit badge you could not verify anyway.

The relay metadata point deserves a straight answer, because the “no server” slogan invites over-reading. When two nodes cannot punch through, their traffic rides an encrypted tunnel through an n0 relay. Although the tunnel contents are encrypted, the relay operator sees that the connection happened, when, and roughly where. That is a meaningful difference from a fully decentralized setup, and it is exactly the nuance the marketing shorthand hides.

On the positive side, the project’s transparency is rare. The README and FAQ openly state that a large share of the code was written with LLM assistance — Claude and GLM-5.2 are named — and that the prototype came together in about a day. Rather than spin that as a feature, the maintainers frame it as a reason to review the code yourself before trusting it. Nor would we trade that candor for a polished README that hides the audit gap.

The Feature Set Nobody Expects

Here’s the thing: the density of features is where Rayfish stops looking like a toy and starts looking like a real mesh tool. We walked each one; here is the short version.

Mesh SSH with no keys. Because Rayfish authenticates SSH connections by node identity, you ssh to a peer without swapping authorized_keys files around. For homelab owners who maintain half a dozen boxes, this removes a real chore. Standard ssh client, no Rayfish-specific wrapper.

Exit nodes. ray exit-node lets one machine route the whole network’s traffic out through a single point — useful for a shared public IP, or for a machine with a better link. Configuration is one flag, not a firewall ruleset.

Declarative provisioning. ray apply deploy.yaml brings infrastructure-as-code to the mesh, which is the sort of thing Netbird markets heavily and Rayfish ships in a YAML file. While it is early, the declarative angle fits homelab automation neatly.

File sharing. ray send file bob moves a file to a named peer over the same encrypted tunnel. A convenience, but a useful one for friend-group networks.

Tor transport (optional). A compile-time --features tor flag routes the connection through Tor. We describe it as a feature and stop there — this review is about the mesh, not about circumvention, and we are not going to write a how-to for the latter.

That platform row is the one honest gap. No Windows build yet, and Android is early-alpha. If your fleet is all-Linux or macOS, Rayfish fits; if you need Windows coverage, it does not yet. Although the gap is real, the roadmap trajectory suggests it will not stay open forever.

How It Stacks Against the Alternatives

Even so, the Tailscale contrast is the one to draw first. Tailscale solves a real problem and does it well, but the control plane is the whole model — the coordination server is where accounts, ACLs, and key management live. Rayfish keeps the convenience and removes the account layer, at the cost of no audit and a younger codebase. Our Headscale vs Tailscale comparison covers that trade-off in detail; Rayfish is the answer for people who read that piece and still wanted to drop the server.

Against Nylon and EasyTier, which we have reviewed here before, the difference is the protocol layer. Nylon and EasyTier ride WireGuard, mature and audited. Rayfish rides iroh/QUIC, newer and not audited, but with a denser feature set — Mesh SSH, declarative provisioning, and file transfer in one binary. Even so, the right call depends on whether you weigh maturity or feature density higher. For a sensitive production mesh, the WireGuard pair wins today; for an experimental homelab, Rayfish is the more interesting box.

Rayfish Pricing: Free, and the Paid Alternative

Rayfish is free, open source under MPL-2.0, with no paid tier and no commercial edition. Even the price of a zero-infrastructure mesh is the operational risk of pre-1.0 software, not a subscription.

That brings us to the honest question: when should you pay for a VPN instead of building your own mesh? For an experimental homelab, Rayfish is a fine answer. For travel, for accessing geo-restricted content, for connecting devices on the public internet where you need a managed network with audited infrastructure and responsive support — a commercial VPN is the more sensible tool. Though if your use case is the latter, a service like NordVPN is a mainstream, audited option worth weighing against any self-hosted setup. That decision is about your threat model, not about which one is “better.” (affiliate link)

The Bottom Line on Rayfish

Rayfish is one of the strongest cases we have seen for a mesh VPN with no coordination server and no account. The iroh/QUIC foundation is real, the feature density is unusual for a project this young, and the transparent disclosure — no audit, LLM-assisted code, experimental status — is the opposite of the marketing gloss most VPN tools ship with.

Use it for a homelab, a friend-group network, or a hands-on look at the iroh stack. Do not put production or sensitive traffic on it until it has independent audit coverage and a 1.0 release. That is not a dismissal; it is the same bar we would hold any pre-release network tool to, and it is refreshing to review a project that sets the bar itself.

For a production-grade commercial alternative with audited infrastructure, see the self-hosted WireGuard guide or consider a managed VPN for your actual workload. The tools are not interchangeable, and the right one depends entirely on what you are protecting.