After countless requests for a desktop application, the first version of WG Tunnel for desktop is now available!

Motivations​

The primary motivation for creating WG Tunnel for desktop was the staggering amount of user requests I received for creating such an app. One of the goals of this project is for the features to be driven by users. Due to these requests, I decided to take on this very challenging endeavor, with a focus on Linux and Windows support (with macOS to follow).

Secondary motivations were twofold:

• I also found myself wanting a more robust WireGuard client, specifically for Linux.
• For WG Tunnel to truly become one of the best clients for WireGuard, it was inevitable that it needed to expand beyond the scope of being an Android-only application.

Managing Expectations​

All things considered, it is important to manage expectations for WG Tunnel on desktop. I spent countless hours over a roughly three-month period to create the first version of this app. This first version is relatively simple and not as feature-rich as the Android app. This is due to the challenging nature of desktop (and especially VPN clients on desktop). Coupled with supporting multiple platforms in the first version, this was no trivial task.

It is also important to consider that features and releases will be much slower for desktop than for Android. There are a lot more moving parts on desktop to make a VPN client work and supporting multiple desktop platforms further increases the development and testing burden.

Conclusion​

All of that being said, I will continue to work hard to add features and improvements to this app as time progresses and my schedule allows.

Thank you for your continued support of this project.

Zane

Links​

Source code

Explanation​

A few months ago, it came to my attention that F-Droid has been receiving substantial funding from the Open Technology Fund (OTF), which is supported and funded by the U.S. government. While this wasn't an immediate dealbreaker, I have reservations about a platform that presents itself as primarily driven by community donations and volunteers, yet accepts large sums of money from government sources. This funding ultimately comes from taxpayer money collected coercively, and I have ethical concerns about F-Droid's taking such funds. I also question the independence of projects that take funds from institutions whose goals directly oppose their own. Governments especially are known for using money as a form of soft power in areas they would otherwise have no control.

More recently, I learned that F-Droid has initiated a campaign against religious texts on their platform, including the Bible and the Quran. These apps have been marked as NSFW (Not Safe for Work), with all Bible apps specifically tagged as promoting "porn and violence content." There are also ongoing discussions about potentially removing all NSFW-tagged apps from the store entirely. The NSFW tag alone effectively shadow bans these apps, hiding them behind a filter by default.

F-Droid themselves have publicly admitted that this moderation policy shift was driven by the funding they received from the OTF:

"Since we have been awarded funding from the OTF Sustainability grant to explore F-Droid policies, we have taken a look at some EU, UK and global content moderation regulations and guidelines to how it may impact F-Droid." source

As a Christian and proponent of independent projects, I can no longer in good conscience keep my app in their store.

Despite F-Droid rolling back this policy, it has become clear that F-Droid is no longer an independent project. Their reliance on government money for their day-to-day operations has effectively rendered them no longer in charge of their own app moderation policy.

For F-Droid users, there are two options for how to use F-Droid repository compatible clients to get the app:

• IzzyOnDroid's F-Droid repository (Recommended)
• WG Tunnel's F-Droid repository

There are also options like Obtainium for an app store-like experience with the standalone version.

Thank you,

Zane

References​

F-Droid Merge Request Marking Bible Apps as NSFW

WG Tunnel Removal Request

Significant progress has been made on WG Tunnel during the first half of 2025. The release of version 4.0.0 has brought major improvements and features to the app. A few notable features include:

• AmneziaWG 1.5 Support - improved DPI protection with protocol mimicking feature.
• Proxy Mode - share tunnel on a local HTTP/SOCKS5 proxy.
• Lockdown Mode - robust kill switch solution using a dummy VPN tunnel interface and SOCKS5 proxy.
• Dynamic DNS auto-update - dynamically update peer endpoints for DDNS users without restarting the tunnel.

What's Next​

With the remainder of the year, the next items on the roadmap are as follows:

Improve Auto-tunnel UX​

The UX for auto-tunnel has been lacking for some time. Questions constantly arise around how to configure specific tunnels to connect on specific Wi-Fi networks. This feature has been available in the app for a long time now, but its placement is not intuitive. The goal of this change is to consolidate all auto-tunnel specific "rules" to the auto-tunnel screen or child screens.

Global Split-Tunneling​

This feature has been requested many times and is long overdue. The goal is to allow users to configure split-tunneling at a global level and apply it to all tunnels.

Domain Filtering​

The goal of this feature is allow users to download/configure domain block lists and expose these lists to the core WireGuard logic. The app will then filter for outbound DNS traffic and drop the DNS requests to domains contained in the block list. Users must disable DoT (Android’s Private DNS feature) for this feature to function. The app will have to detect if this feature is enabled and request that the user disable it.

App Block List​

This is another highly requested feature. Split-tunneling allows users to exclude certain applications from the tunnel, but it does not allow users to block certain applications' traffic. This feature will query all installed application identifiers and drop any traffic that is marked with a matched blocked identifier.