# OpenP2P port forwarding rides on shared bandwidth, not on a server you host

> OpenP2P is a Go binary that maps a remote service onto a local port through other people's machines, which removes the public IP server from the bill and puts a stranger's node inside your traffic path.

**openp2p-cn/openp2p** — OpenP2P is a lightweight P2P sharing network, supporting Cone/Symmetric NAT1-NAT4, UPnP, IPv6, and both UDP and TCP hole punching for NAT traversal and SD-WAN.

- Repository: https://github.com/openp2p-cn/openp2p
- Website: https://openp2p.cn
- Stars: 2,041 · Forks: 304
- Language: Go
- License: MIT
- Published: 2026-10-13 · Updated: 2026-10-13 · Language: en
- Canonical page: https://hysenlabs.com/projects/openp2p-cn-openp2p

## A P2PApp maps one remote service onto one local port

Port ForWard, called P2PApp in the code, is the unit this project is organised around. One P2PApp maps a single remote service such as mstsc or ssh onto a listening port on the machine that hosts it, so the client at the other end dials a local port instead of an address that would have to be routable from the internet. That makes a P2PApp the unit of automation too, since managing P2PApps is described as the main job for re-development and for the REST API, so any integration effort lands there first. Devices inside one private network reach each other directly, and when they cannot, the request leaves for the public OpenP2P network and a shared node carries it. What the network shares is bandwidth rather than files, which is how the project sets itself against the BT network it names.

## Shared bandwidth is the toll for using other people's nodes

The exchange rate is explicit. A node contributes bandwidth to the share network, 10mbps is its default speed limit, and only after you have shared nodes of your own are you allowed to use shared nodes belonging to others. Fairness here is reciprocity rather than payment, which is why contributors are asked to run a node from a place with enough bandwidth, an office or a home on 100M optical fiber. Refuse to contribute anything and the README sends you to USAGE.md without naming the setting that turns sharing off, so a non-contributor has to read a second document before doing anything at all. The same tension runs through the scenario list, which calls the project "especially suitable for large traffic intranet access" while capping shared throughput at 10mbps.

## One binary, two ways into the network stack

OpenP2P can stay an ordinary process or become a network device. It runs at the application layer by itself, or installs a TUN device through kmod-tun on Linux and wintun on Windows for the SDWAN mode. The module list shows how much of that second path is borrowed: `github.com/openp2p-cn/wireguard-go` and `golang.zx2c4.com/wireguard/windows` supply the tunnel device, while `github.com/vishvananda/netlink` and `golang.zx2c4.com/wintun` are the Linux and Windows control paths, and `gvisor.dev/gvisor` gives a userspace stack for cases where no kernel driver is wanted. The tunnel is WireGuard's; what this project adds is how peers are found, punched and relayed. The layout follows that split, with `cmd/`, `core/`, `lib/`, `pkg/` and `app/` beside a `config.json` at the root, a `docker/` directory and two `example/` trees named dll and echo.

## Punching from NAT1 to NAT4 on a QUIC tunnel

Traversal tries the cheap routes first. NAT1 through NAT4 are covered, cone and symmetric, over UDP punching or TCP punching, and UPnP can open the port outright through `github.com/huin/goupnp` and `github.com/jackpal/go-nat-pmp`. `github.com/openp2p-cn/go-reuseport` exists so several nodes can hold the same port, and signalling runs over `github.com/gorilla/websocket`. The tunnel itself is QUIC, `github.com/quic-go/quic-go` at v0.34.0, and go.mod still carries both qtls-go1-19 and qtls-go1-20 as indirect dependencies, which leaves the split between QUIC TLS backends visible in the module graph. IPv6 is listed in the project description and struck through as finished in the roadmap. `golang.org/x/net` at v0.30.0 and `github.com/emirpasic/gods` at v1.18.1 handle the remaining plumbing and collections.

## make and the documented cross-compile line build different binaries

Building from source starts with `make`, and running it in the source root is the whole documented setup.

```bash
make
```

That target is not what the cross-compile example builds. The Makefile compiles a single file, cmd/openp2p.go, with default flags and no symbol stripping at all.

```make
build:
	export GOPROXY=https://goproxy.io,direct
	go mod tidy
	go build cmd/openp2p.go
.PHONY: build

.DEFAULT_GOAL := build
```

The documented line for a chosen target instead builds the ./cmd package and strips it, which is the shape that matches the 10MB filesize the project advertises.

```bash
export GOPROXY=https://goproxy.io,direct
go mod tidy
CGO_ENABLED=0 env GOOS=linux GOARCH=amd64 go build -o openp2p --ldflags '-s -w ' -gcflags '-l' -p 8 -installsuffix cgo ./cmd
```

The toolchain requirement is go version 1.20 only, kept for Windows 7 support, while go.mod still pins quic-go v0.34.0 and golang.org/x/net v0.30.0. Code arrived as recently as 2026-09-10, so the old language version reads as a choice rather than abandonment.

## Relay nodes sit in the middle by construction

When your own private network cannot connect, someone else's machine carries the bytes, and the project admits it: a relay node is a man in the middle by design. Two layers answer that. Traffic runs inside a TLS1.3 channel, and the content carries a second AES layer whose key is exchanged through the server, so a node relaying packets never holds the plaintext. Authority is temporary, since a shared node authorises use with TOTP using hmac-sha256, handed out by a scheduling model on the server side that weighs bandwidth, ping value, stability and service duration. Scope is limited by design too, because a shared node only relays data and other users of the network cannot reach resources inside yours. None of this documents revocation: the README does not say how a retired node or a compromised account leaves the network, nor when the AES key changes after a P2PApp stops being used.

## Registration and the unsigned Windows download are the install path

There is no package manager here. Registration comes first, at https://console.openp2p.cn, with an email address, and that same console is where P2PApps are created. On the local and the remote machine you download the binary and double-click it for a one-click install. Two constraints come with that. Windows warns about a program not signed by a Microsoft certificate, and you select Run anyway. And the README is emphatic that the file name must not be changed once the browser has saved it, which it never explains further. First real use is a remote desktop: point a P2PApp at the office machine, open MSTSC on the home machine, and dial the local listening port shown in the console.

```bash
127.0.0.1:23389 /admin
```

Everything else, including how to run the process by hand, sits in USAGE.md, which is linked rather than reproduced here.

## Where OpenP2P is the wrong tool

The case against it starts with the relay. OpenP2P differs in approach by falling back to shared nodes drawn from the public network, which is how it drops the server with a public IP from the bill. A WireGuard mesh reaches similar ground with peers you configured yourself, and this repository already carries wireguard-go plus wintun for the device, so the difference is where the far endpoint comes from, not whether the tunnel is encrypted. Two documented limits cut against heavy use: the 10mbps share cap, and the path for anyone who will not contribute a node, which the README routes to USAGE.md. Portability claims need the same care. The build section names seventeen GOOS values including hurd, nacl, zos and js, and twenty-four GOARCH values, while the platform section promises only Windows, Linux and MacOS, and one architecture there, mipsle64, never appears in the project's own GOARCH enumeration, which spells it mips64le. The roadmap stops mid-entry after two completed items. The code is MIT licensed, so shipping it inside a product brings no copyleft obligation, and the first thing an adopter should read is what USAGE.md demands of a non-contributor.

## Conclusion

OpenP2P fits a team that needs a handful of remote services reachable and can accept that some of its bytes pass through a node belonging to a stranger, on pain of registering an account first. It is the wrong tool for offline-only deployments, for transfers above the 10mbps share cap, and for anyone unwilling to contribute a node, since that route leads to a document the README does not reproduce. Before exposing a real service, read what USAGE.md asks of a non-contributor and confirm the 10mbps cap against the transfer sizes you actually have.

## FAQ

### Does OpenP2P need a server with a public IP address?

Not for the relay plane, because a private network that cannot connect falls back to shared nodes in the public OpenP2P network instead of a hosted server. Registration at https://console.openp2p.cn is still required, and the AES key is exchanged through the server.

### How much bandwidth does an OpenP2P node share with strangers?

10mbps is the default share speed limit. You may use shared nodes belonging to others only after you have shared nodes of your own, and the project asks contributors to sit on a connection such as 100M optical fiber.

### Can I run OpenP2P without installing a VPN driver?

Yes. It runs at the application layer on its own, or installs a TUN device through kmod-tun or wintun for the SDWAN mode. The tunnel device in that second case is WireGuard's.

### How do I build OpenP2P for Linux on amd64?

Run make in the source root, or use the documented line with CGO_ENABLED=0 and GOOS=linux GOARCH=amd64. The required toolchain is go version 1.20 only, stated as the price of keeping Windows 7 support.

### What is a P2PApp in OpenP2P?

It maps one remote service such as mstsc or ssh onto a local listening port. Managing P2PApps is named as the main job for re-development and for the REST API the project offers.

## Sources

- [License: MIT](https://github.com/openp2p-cn/openp2p/blob/master/LICENSE)
- [openp2p-cn/openp2p on GitHub](https://github.com/openp2p-cn/openp2p)
- [Project website](https://openp2p.cn)
- [README](https://github.com/openp2p-cn/openp2p/blob/master/README.md)
- [Releases](https://github.com/openp2p-cn/openp2p/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/openp2p-cn-openp2p