waX VPN WireGuard client for Windows
A WireGuard VPN client for Windows, written in Rust - with Cloudflare WARP support being built in. In active development, built in the open.
SHA-256 0adf9290…33f4bf - unsigned build: the Windows publisher/SmartScreen warning is expected. Verify the full hash and checksum steps before running.
A Windows client.
A real WireGuard tunnel.
An open-source WireGuard GUI for Windows, with a native interface and a Rust VPN client core. Bring your own WireGuard configuration; waX VPN is a client, not a VPN server subscription.
waX VPN is being built around the official WireGuard for Windows kernel driver, with a Rust core and a Rust-rendered interface. Live CI checks passed against the official WireGuard demo server. They covered a handshake, a ping through the tunnel, DNS setup and restore on clean disconnect, and a GUI-driven connect. There is no kill switch yet: if the tunnel drops, traffic can use the normal connection. Every claim on this page is labeled: what is verified, and what is still on the roadmap.
Rust end to end
Core logic, tunnel control and interface code are all Rust. The desktop UI is egui, an immediate-mode GUI written entirely in Rust - no embedded browser engine, no JavaScript layer.
Real WireGuard tunnel
Tunnel code drives the official WireGuard for Windows kernel driver through the wireguard-nt Rust crate - a real system VPN design, not a browser trick or userspace packet relay. Live handshake, a through-tunnel ping, and a GUI-driven connect are all verified in CI.
Cloudflare WARP, built in
WARP client code is written to the wgcf-compatible protocol in Rust, strictly opt-in: nothing registers with Cloudflare until you ask it to. Live compatibility with the WARP service has not been tested yet.
Four crates, one tunnel.
The workspace layout. Each layer is a separate Rust crate with a single job.
Illustrative crate map - lines are dependencies, not live traffic or a packet route. WARP is an opt-in profile source, not a hop in the tunnel.
Interface - egui native GUI
Animated immediate-mode desktop interface written entirely in Rust. No WebView, no browser engine bundled.
Profiles and keys
WireGuard config parsing, key generation and profile storage.
Driver control - wireguard-nt
Creates and manages the kernel tunnel adapter through the official WireGuard for Windows driver.
WARP client - wgcf-compatible
Talks to the Cloudflare WARP API to register and manage WARP profiles. Runs only when you opt in.
What the client does
Profiles, connection controls and local settings, with the scope of each check stated clearly.
Profiles and keysIn v0.1.0
Import and manage WireGuard configs, generate keys, switch tunnels from one place. Profile picker included in v0.1.0.
One-click connectIn v0.1.0
Connect and disconnect with a single action, with live tunnel state in the UI. A GUI-driven connect passed a real handshake in CI.
DNS controlIn v0.1.0
Tunnel DNS is applied on connect and restored on disconnect - verified in CI. A surfaced error when the adapter is already gone was fixed in source.
System trayIn v0.1.0
Close to the tray and keep the tunnel running - exercised in the CI GUI leg. Graceful quit is checked in CI; actual notification-area menus remain unverified. Start with Windows saves only after a registry readback, warning and reverting on failure.
WARP profilesOpt-in
Register and manage Cloudflare WARP profiles inside the app, wgcf-style. Off until you turn it on. Not yet exercised live against Cloudflare.
The native Windows interface
Real Windows verification captures, not mockups. Profiles shows v0.1.41; the other captures retain their original version labels. Select any image to inspect it at full size.
Connect
v0.1.10At rest, with the demo profile selected
Connected
v0.1.15Session counters after a real CI handshake
Profile library
v0.1.41Profile actions, split exclusions and config import
Preferences
v0.1.15Startup, adapter-loss recovery and reduced motion
WARP profiles
v0.1.15Registration is opt-in; live compatibility unverified
Local diagnostics
v0.1.15Build information and local report generation
Get waX VPN for Windows
Stable release, public source and a checksum you can verify. Read the limits before installing.
The latest stable Windows x64 installer. Unsigned and requires administrator rights. Verify the checksum before running.
Latest change: a Network page with public IP before/after, a live throughput graph, an HTTPS latency graph and a manual 10 MB speed test. Only the local throughput graph is on by default. Public IP checks, latency probes and the speed test are opt-in; those requests share your IP with Cloudflare by default. These are observations, not leak tests or proof that the VPN changed your public IP on a real Windows connection. No speed claim.
No kill switch: traffic can use the normal connection if the tunnel drops. No physical-network roaming or IPv6 leak-protection claim. The real Windows public-IP-change path, Internet reachability, real UAC and actual tray menus remain unverified.
SHA-256 0adf9290a1d51bbafe5e443bda9cae673831ed7743a31d656165dbd9c533f4bfVerification scope and known limits
Unsigned build that needs administrator rights (it creates a network adapter) - Windows publisher/SmartScreen warnings are expected. The v0.1.41 baseline was verified in the exact stable gate (43013058134) on release target (495ce06; product source e33c059), with the full preview run (43010809620) passing a peer handshake and tunnel-side ping, DNS apply and restore, split-tunnel exclusions and a fresh install, quit and uninstall; retained exact stable results cover owned adapter-loss recovery, pending-retry disable, manual reconnect with recovery off, original window and Connect-rail restoration, graceful quit with adapter removal, and the profile, settings and BOM warnings (a CI Windows runner, not a consumer-PC/SmartScreen test). New: the split-tunneling field label uses 12px primary text instead of 11.5px secondary text. Label wording, wrapping, spacing, parsing, saving, routes and connection policy are unchanged. The release notes report readable label, profile context, count, guidance and exclusion input in normal, partial-warning and failed-reload Profiles at 880x600; Import stays within the existing scroll area. Unicode/long-name preservation is formatter-fixture proof only, not glyph or wrapping screenshot proof. Test-only cancellation ownership and one-shot Notifications/Snapshot fixtures remain groundwork, not production observation, continuous monitoring, quit acknowledgement or physical-network roaming. Earlier stale-test and undiagnosed handshake/capture failures remain in the notes. Verify the checksum before running.
Still outstanding: a real tray-initialization failure was not reproduced - the minimize fallback is unit-tested command selection, and the fallback warning pixels and taskbar restoration without a tray are untested; real UAC acceptance and cancellation, the native-restart failure pixels and the full parent-to-child handoff are untested (carried from v0.1.11); the startup directory-error pixels and the manual-Connect guard from a stale profile snapshot are untested (source-checked only); the tray menu is manual-only; a live WARP test against Cloudflare is still pending. Network roaming is not proven; recovery handling is scoped to adapter loss. There is no kill switch: if the tunnel drops, traffic can use the normal connection. No IPv6 leak-protection claim. The interface is the native Rust redesign - neutral surfaces, text navigation, no particles - and still being refined.
Recent development history Latest entries, original wording
Read the full waX VPN development history
- v0.1.37 held the download card (replacing v0.1.36, now replaced by v0.1.38; exact release source 65e3ebb, exact stable gate 42989763965, full preview 42987951097). Profiles shows "N profile(s) loaded" beside Reload profiles and "Previous list: N profile(s)" after a failed reload. Layout/label only: loading, import, delete, selection, storage and networking are unchanged. Per the final release body, normal and partial-warning Profiles show "1 profile loaded"; failed reload shows "Previous list: 1 profile" with the retained list and disabled Connect/Delete controls. Count, warning and buttons are readable without overlap at 880x600. Empty/plural wording is formatter-fixture proof only, not a separately captured UI state. All 42 app, 40 core, 6 WARP, 4 diagnostics and 1 tunnel tests passed, and all 14 exact-release screenshots were inspected. The exact gate passed build, demo-tunnel/GUI verification, fresh-runner install/quit/uninstall and publish. Test-only cancellation ownership and one-shot Windows Notifications/Snapshot fixtures remain groundwork, not production observation, continuous monitoring, quit acknowledgement, OS cancellation-failure safety or physical-network roaming. Earlier stale-test expectation 42944794908 was fixed by a fixture-only follow-up; earlier handshake/capture failure 42939812475 remains undiagnosed despite a later unchanged pass. Earlier installed-quit and PowerShell/CLR failure causes stay unproven. Checksum independently re-verified against a fresh installer and separately downloaded SHA256SUMS (10,959,142 bytes). Limits unchanged: unsigned, no kill switch, WARP unregistered, no Internet-reachability, speed or IPv6 leak-protection claim; adapter-loss recovery only, physical-network roaming unimplemented, real UAC and actual tray menus unverified. Site stills remain labeled v0.1.15, v0.1.10 for Connect and v0.1.9 for settings save-warning, not v0.1.37 captures.
- v0.1.38 held the download card (replacing v0.1.37, now replaced by v0.1.39; product source 342787b, release metadata 20fcd6a, final notes 356bca0, exact stable gate 42996054493, full preview 42993266597). Profiles Split tunneling shows "Editing profile: <name>" above the exclusions field. UI text only: parsing, settings, routes and connection policy are unchanged. Per the final release body, normal, partial-warning and failed-reload Profiles show "Editing profile: demo" readable without overlap at 880x600; Import shifts down within the existing scroll area. Unicode/long-name preservation is formatter-fixture proof only, not actual glyph or wrapping screenshot proof. All 43 app, 40 core, 6 WARP, 4 diagnostics and 1 tunnel tests passed, and all 14 exact-release screenshots were inspected. The exact gate passed build, demo-tunnel/GUI verification, fresh-runner install/quit/uninstall and publish. Test-only cancellation ownership and one-shot Windows Notifications/Snapshot fixtures remain groundwork, not production observation, continuous monitoring, quit acknowledgement, OS cancellation-failure safety or physical-network roaming. Earlier stale-test expectation 42944794908 was fixed by a fixture-only follow-up; earlier handshake/capture failure 42939812475 remains undiagnosed despite a later unchanged pass. Earlier installed-quit and PowerShell/CLR failure causes stay unproven. Checksum independently re-verified against a fresh installer and separately downloaded SHA256SUMS (10,959,296 bytes). Limits unchanged: unsigned, no kill switch, WARP unregistered, no Internet-reachability, speed or IPv6 leak-protection claim; adapter-loss recovery only, physical-network roaming unimplemented, real UAC and actual tray menus unverified. Site stills remain labeled v0.1.15, v0.1.10 for Connect and v0.1.9 for settings save-warning, not v0.1.38 captures.
- v0.1.39 held the download card (replacing v0.1.38, now replaced by v0.1.40; product source d8bbe80, release target ab29057, final notes b11a5ed, exact stable gate 43000796483, full preview 42998862323). Split tunneling says "Enter CIDR ranges separated by commas or spaces." and "Applies to the named profile on next connect." Guidance text only: parsing, settings, routes and connection policy are unchanged. Per the final release body, normal, partial-warning and failed-reload Profiles retain readable format guidance, named profile context, count and exclusion field without overlap at 880x600; Import remains in the existing scroll area. Unicode/long-name preservation remains formatter-fixture proof only, not actual glyph or wrapping screenshot proof. All 43 app, 40 core, 6 WARP, 4 diagnostics and 1 tunnel tests passed, and all 14 exact-release screenshots were inspected. The exact gate passed all four build, installer, GUI/demo verification and publication jobs. Test-only cancellation ownership and one-shot Windows Notifications/Snapshot fixtures remain groundwork, not production observation, continuous monitoring, quit acknowledgement, OS cancellation-failure safety or physical-network roaming. Earlier stale-test expectation 42944794908 was fixed by a fixture-only follow-up; earlier handshake/capture failure 42939812475 remains undiagnosed despite a later unchanged pass. Earlier installed-quit and PowerShell/CLR failure causes stay unproven. Checksum independently re-verified against a fresh installer and separately downloaded SHA256SUMS (10,959,322 bytes). Limits unchanged: unsigned, no kill switch, WARP unregistered, no Internet-reachability, speed or IPv6 leak-protection claim; adapter-loss recovery only, physical-network roaming unimplemented, real UAC and actual tray menus unverified. Site stills remain labeled v0.1.15, v0.1.10 for Connect and v0.1.9 for settings save-warning, not v0.1.39 captures.
- v0.1.40 held the download card (now replaced by v0.1.41), replacing v0.1.39 on the stable line (product source f02ec9b, release target afee7d4, final notes e610a84, exact stable gate 43007081041, full preview 43005252907). The Split tunneling field label says "Excluded IP ranges for profile: <name>", replacing "Editing profile: <name>". Text only: existing wrapping, spacing, accessible input name, parsing, settings, routes and connection policy are unchanged. Per the final release body, normal, partial-warning and failed-reload Profiles retain readable label, profile context, count, guidance and exclusion input without overlap at 880x600; Import stays within the existing scroll area. Unicode/long-name preservation remains formatter-fixture proof only, not actual glyph or wrapping screenshot proof. All 43 app, 40 core, 6 WARP, 4 diagnostics and 1 tunnel tests passed, and all 14 exact-release screenshots were inspected. The exact gate passed all four build, installer, GUI/demo verification and publication jobs. Test-only cancellation ownership and one-shot Windows Notifications/Snapshot fixtures remain groundwork, not production observation, continuous monitoring, quit acknowledgement, OS cancellation-failure safety or physical-network roaming. Earlier stale-test expectation 42944794908 was fixed by a fixture-only follow-up; earlier handshake/capture failure 42939812475 remains undiagnosed despite a later unchanged pass. Earlier installed-quit and PowerShell/CLR failure causes stay unproven. Checksum independently re-verified against a fresh installer and separately downloaded SHA256SUMS (10,959,337 bytes). Limits unchanged: unsigned, no kill switch, WARP unregistered, no Internet-reachability, speed or IPv6 leak-protection claim; adapter-loss recovery only, physical-network roaming unimplemented, real UAC and actual tray menus unverified. Site stills remain labeled v0.1.15, v0.1.10 for Connect and v0.1.9 for settings save-warning, not v0.1.40 captures.
- Website cohesion pass: real version-labeled captures moved into a dedicated Screenshots gallery with full-size viewing. Navigation, spacing, typography and surfaces aligned; download summary separates essential limits from expandable verification detail. Installer remains v0.1.40. The unsigned build and Windows warning notes remain.
- v0.1.41 replaces v0.1.40 on the download card. Product source e33c059, release target 495ce06; exact stable gate 43013058134 and full preview 43010809620 passed. Split-field label changes from 11.5px secondary to 12px primary text only; wording, wrapping, spacing, parsing, saving, routes and connection policy are unchanged. Released installer independently downloaded: 10,959,264 bytes, SHA-256 matched a separately downloaded SHA256SUMS. The real v0.1.41 Profiles capture replaces the older gallery image. Remaining stills keep their original versions. All existing network, WARP, UAC, tray and Unicode-fixture limits remain.
- v0.1.42 replaces v0.1.41 on the download card. Installer cleanup helpers now run without a console window. Silent fresh-install, upgrade and uninstall checks found no new visible console window in 150, 364 and 329 samples; shorter flashes could be missed. App and installer website links now use https://waxvpn.pages.dev/. Released installer independently downloaded: 10,963,400 bytes, SHA-256 matched separately downloaded SHA256SUMS. No measured speedup claimed. Unsigned/SmartScreen warnings remain; no kill switch or leak-protection proof. UAC and actual tray menus remain untested.
- v0.1.43 replaces v0.1.42 on the download card. Network page added: public IP before/after, local live throughput, HTTPS latency and a manual 10 MB speed test. Only local throughput is on by default; external checks are opt-in and share your IP with Cloudflare by default. Observations, not leak tests. Real Windows IP-change remains unproven. Installer independently downloaded: 11,061,755 bytes; SHA-256 matched separately downloaded SHA256SUMS. No speed claim. Unsigned, no kill switch and no leak/IPv6 proof; real UAC and tray-menu limits remain.
- Remaining: interface refinement continues (the design bar is not yet met); the tray menu and Quit/reopen behavior (a manual Windows-desktop check - CI runners have no notification area); a live WARP test against Cloudflare.
Straight answers.
Can I download waX VPN yet?
Is it a real VPN or a proxy?
What does WARP built in mean?
Which platforms?
Is the source public?
Follow the next
waX VPN release
New builds land on GitHub with honest release notes about what works and what does not yet.
Browse the waX VPN source