Kanpachi
Summary
Kanpachi is a private virtual LAN for playing games with friends: the spiritual successor to Hamachi. A WireGuard-encrypted peer-to-peer tunnel connects the room; the virtual adapter stays closed, opening only the chosen game's ports, only on the host, only toward members present. No accounts, no telemetry, no port forwarding. Free software under AGPL-3.0, in three languages: Flutter UI, Go binaries and CLI, Rust tunnel engine.
Highlights
- Split the product across three languages by what each does best: Flutter for the desktop window, Go for every binary (client, daemon, seed), Rust for the tunnel engine, built on a pinned fork of EasyTier instead of its official binary. That binary opens an unauthenticated admin portal on 0.0.0.0:15888, reachable by any local process; linking the library keeps the portal out of the build. — 0 listening sockets in the engine, against 0.0.0.0:15888 open in easytier-core, across 3 languages and 4 binaries (kanpachi, kanpachid, kanpseed, kanpachi-engine)
- Designed the security model around a virtual adapter born without a single allow rule. Every opening is explicit, per game profile, toward the IPs of members present, recomputed whenever somebody joins, leaves, or switches games. — The FirewallRule type has no way to express 'any'
- Split the privileged daemon from the window: the Windows service runs as LocalSystem and holds the room, the Flutter app has no privileges. Closing the window keeps the room open; playing never asks for administrator again. — 1 UAC prompt in the whole life of the product, at install
- Built the JSON game profile catalog (ports, LAN discovery, executable verification) so nobody has to know Project Zomboid speaks UDP 16261-16262. Some ports, starting with 445 and 3389, no profile can ever request. — 11 game profiles, each tested in a real match
- Packaged both platforms: an Inno Setup installer for Windows, a Debian package for Ubuntu 22.04+, systemd units, and a quarantine that keeps SMB, RDP, and remote management closed from the internet even while Kanpachi is stopped. — Windows installer, .deb package, 3 release workflows on GitHub Actions
- Hunted memory leaks in the production daemon: every read of the Windows firewall store left its enumerator behind, holding a snapshot of every rule on the machine. Six cycles of opening and closing a room took the process from 80 MB to 426 MB with no way back. — 346 MB leaked over 6 room cycles, closed