Kanpachi
Project links
Summary
Kanpachi is a private virtual LAN for playing games with friends: the spiritual successor to Hamachi. A WireGuard-encrypted peer-to-peer tunnel connects the room; the virtual adapter stays closed, opening only the chosen game's ports, only on the host, only toward members present. No accounts, no telemetry, no port forwarding. Free software under AGPL-3.0, in three languages: Flutter UI, Go binaries and CLI, Rust tunnel engine.
Highlights
Three languages, four binaries0 listening sockets in the engine, against 0.0.0.0:15888 open in easytier-core, across 3 languages and 4 binaries (kanpachi, kanpachid, kanpseed, kanpachi-engine)
Split the product across three languages by what each does best: Flutter for the desktop window, Go for every binary (client, daemon, seed), Rust for the tunnel engine, built on a pinned fork of EasyTier instead of its official binary. That binary opens an unauthenticated admin portal on 0.0.0.0:15888, reachable by any local process; linking the library keeps the portal out of the build.
Security model with zero allow rulesThe FirewallRule type has no way to express 'any'
Designed the security model around a virtual adapter born without a single allow rule. Every opening is explicit, per game profile, toward the IPs of members present, recomputed whenever somebody joins, leaves, or switches games.
Privileged daemon split from the window1 UAC prompt in the whole life of the product, at install
Split the privileged daemon from the window: the Windows service runs as LocalSystem and holds the room, the Flutter app has no privileges. Closing the window keeps the room open; playing never asks for administrator again.
Tested game profile catalog11 game profiles, each tested in a real match
Built the JSON game profile catalog (ports, LAN discovery, executable verification) so nobody has to know Project Zomboid speaks UDP 16261-16262. Some ports, starting with 445 and 3389, no profile can ever request.
Windows and Debian packagingWindows installer, .deb package, 3 release workflows on GitHub Actions
Packaged both platforms: an Inno Setup installer for Windows, a Debian package for Ubuntu 22.04+, systemd units, and a quarantine that keeps SMB, RDP, and remote management closed from the internet even while Kanpachi is stopped.
346 MB memory leak closed346 MB leaked over 6 room cycles, closed
Hunted memory leaks in the production daemon: every read of the Windows firewall store left its enumerator behind, holding a snapshot of every rule on the machine. Six cycles of opening and closing a room took the process from 80 MB to 426 MB with no way back.
Six releases after launch6 releases and 61 commits after v0.6.8
Kept shipping after launch: v0.7.0 through v0.7.5 persisted the member list so a restarted host can still kick people, showed measured round-trip time per member, and redirected container traffic to games listening on loopback.