One binary, two roles. Like frp, but built on QUIC. Expose local services over encrypted tunnels.
Full Layer 4 protocol support. HTTP, gRPC, DNS, gaming protocols — anything that speaks TCP or UDP works out of the box.
Cross-region tunnels built on QUIC with TLS 1.3. Multiplexed streams, zero round-trip connection setup, and resilience to network changes.
One binary handles both server and client roles. No separate frps/frpc to deploy or keep in sync.
Agent-to-agent token-based auth for tunnel establishment. No certificates to manage, no PKI to deploy.
Tunnels automatically reconnect with exponential backoff. Config persistence ensures recovery even after full restarts.
Built-in observability. Track tunnel state, active streams, bytes transferred, reconnect counts, and relay performance.
One binary (outpostnet-agent), two roles — like frp's frps + frpc, unified.
| Capability | OutpostNet 1.0 | FRP |
|---|---|---|
| Binaries needed | 1 (outpostnet-agent) | 2 (frps + frpc) |
| TCP & UDP Proxy | Yes | Yes |
| Transport | QUIC (TLS 1.3) | TCP / KCP / QUIC |
| Token Auth | Yes | Yes |
| Stream Mux | QUIC native | yamux |
| Auto-Reconnect | Yes | Yes |
| Metrics | Prometheus | Dashboard |
| HTTP Vhost | Roadmap | Yes |
| Dashboard UI | Roadmap | Yes |
v1.0.1 · 2026-03-31 · Linux x86_64 · Go 1.22
Coverage by Package
| Package | Coverage | Tests |
|---|---|---|
| internal/controller/webhook | 95.7% | Sidecar injection webhook |
| pkg/annotations | 95.5% | Kubernetes annotation helpers |
| pkg/agentconfig | 94.0% | Agent config generation |
| pkg/config | 88.5% | Config parsing, defaults, watcher |
| pkg/protocol | 88.5% | Service/relay header framing |
| pkg/tunnel | 85.0% | QUIC transport, TLS, stream mux |
| internal/server | 84.3% | Route management, relay fallback |
| internal/agent | 83.1% | Health, config watcher, cross-region, relay |
| pkg/tunnel/tlsutil | 81.8% | TLS cert generation & config |
| internal/sidecar | 81.3% | Export/import, reconnect, shutdown |
| internal/controller/reconciler | 77.8% | K8s EndpointSlice + Pod reconciler |
End-to-End Scenarios
| Scenario | Result | Duration |
|---|---|---|
| TCP end-to-end (single connection) | PASS | 0.36s |
| TCP multiple concurrent connections | PASS | 0.36s |
| UDP end-to-end forwarding | PASS | 0.35s |
| FRP-style tunnel, no region | PASS | 0.81s |
| Multi-service stream multiplexing | PASS | 1.05s |
| Three-node relay chain | PASS | 1.17s |
| Disconnect & reconnect, no data loss | PASS | 1.87s |
| Token auth — valid & invalid | PASS | 2.06s total |
| Relay hop limit enforcement | PASS | 1.51s / 1.92s |
| Large data transfer (cross-region) | PASS | 1.11s |
Performance Benchmarks
Full report: docs/test-report-v1.0.md
Download the single binary and expose your first service in under two minutes.