English | Русский

Rosetun is a Windows VPN client powered by sing-box. A Windows service maintains the kill switch and DNS lock; routing rules split traffic by app and website, and provider subscriptions supply servers.

Beta software: expect bugs.

Features

• A Kill switch blocks traffic when the tunnel drops. Without it, a DNS lock keeps system DNS from leaking outside the tunnel throughout the session, including while the engine restarts.
• Routing rules for apps and websites, with Quick templates and actions Through VPN, Direct and Block.
• Provider subscriptions in plain or base64-encoded link lists, Xray JSON and sing-box JSON. Send device ID (HWID) is optional for providers that require it.
• VLESS, VMess, Trojan, Shadowsocks and Hysteria2 nodes (Salamander obfuscation and port hopping); TCP, WebSocket, gRPC and HTTPUpgrade transports for TCP-based nodes; plain, TLS and Reality security modes. Hysteria2 uses QUIC over UDP.
• DNS through the tunnel via a configurable DNS-over-HTTPS resolver.
• Change the server, rules or DNS while connected: Rosetun restarts the tunnel in a second or two without disconnecting, and the kill switch keeps traffic blocked meanwhile.
• Temporary rules: add a rule only until disconnect; it applies at once and is never saved.
• Reconnect automatically after sleep or an engine failure, with a DNS watchdog while connected.
• Server checks: a TCP ping and a URL test that sends a request through each server, even while connected.
• System tray, Start with Windows, and English and Russian interfaces.

Install

Download the installer from Releases. Windows 10 or 11, x64, is required. The installer is not code-signed yet; if SmartScreen says "Windows protected your PC", select More info and then Run anyway.

See the code signing policy for the planned signing process; current releases remain unsigned.

You can choose an installation folder, but not inside a user profile or where standard users can change it; the SYSTEM service requires a protected folder. Uninstalling keeps your configuration in %APPDATA%\Rosetun by default, or you can choose to delete your settings, subscriptions and rules. When the configuration format is upgraded, Rosetun keeps a copy of the previous file beside it (such as config.v1.json); the copy contains the same subscription URLs.

Verify the download

Compare Get-FileHash .\rosetun-<version>-setup.exe -Algorithm SHA256 with the entry in the release's SHA256SUMS.txt. For a public tagged release, verify provenance with gh attestation verify .\rosetun-<version>-setup.exe --repo eoftgge/rosetun.

Privacy and network access

Rosetun makes these network requests:

• To the VPN server for the tunnel; TCP ping also makes a TCP connection attempt to each server being checked while the tunnel is down.
• URL test and the current server's delay on the connection screen each send one HTTPS request to https://cp.cloudflare.com/generate_204 through the server being checked or the current server. URL test connects directly to each server, outside the tunnel.
• To your subscription provider to fetch or update subscriptions, using User-Agent: Rosetun/<version> by default. When Send device ID is on, the request also includes x-hwid, x-device-os, x-ver-os and x-device-model. Subscription URLs may contain credentials; an HTTP subscription sends its token without encryption.
• To the configured DNS-over-HTTPS resolver through the tunnel. The service also checks DNS by querying example.com during connection and random names beneath example.com while the tunnel is up.
• To https://1.1.1.1/cdn-cgi/trace through the tunnel for the exit country and public IP shown on the connection screen. The exit IP is hidden by default and is not written to the log.
• To https://api.github.com/repos/eoftgge/rosetun/releases for the release list at launch if it has never been checked or the last successful check was over a day ago, then once a day, and when you click Check now. The request goes through the tunnel when connected. Automatic checks are on by default; turn them off under Settings → About → Check for updates. The last successful check time and any skipped version are saved in the settings file. Nothing is downloaded or installed automatically.
• If DNS stalls, the watchdog also sends an HTTP HEAD request to 1.1.1.1:80 through the tunnel to distinguish a DNS failure from a lost path.
• Before connecting, system DNS resolves the VPN server name; provider and ping hostnames may also be resolved by the operating system.
• When changing servers while connected, the new server's name is resolved through the current tunnel.

The engine's control API is contacted only over local loopback. There is no telemetry or Rosetun account. The application update check only reports a new version; it does not download or install it. Logs stay on this machine; the service log is accessible only to administrators. When Verbose log is off, destination addresses in engine messages are replaced with [hidden]; the VPN server address and error cause remain. Site addresses are logged only while the temporary Verbose log setting is enabled. Automatic subscription updates are separate from application updates.

Troubleshooting

• Another VPN client in TUN mode can prevent the tunnel from starting. Disconnect it and retry.
• Traffic-modifying programs such as zapret can disrupt the connection to the VPN server. Exclude the server addresses in that program's settings.

How it works

GUI (user) ──named pipe──► Rosetun service (SYSTEM) ──► sing-box.exe ──► TUN
                                    └── WFP: kill switch / DNS lock

The service owns protection, so closing the GUI does not remove it. If the service itself crashes, Windows removes its firewall filters (fail-open). This avoids leaving the computer permanently offline.

Build from source

Use Rust 1.96 or newer with the MSVC toolchain on Windows. Run cargo build --release to build the binaries and cargo test --workspace to run tests. See installer instructions for packaging and the VM test rig for elevated failure testing.

Before committing, run git config core.hooksPath tools/hooks once. The hooks reject AI attribution and non-Conventional commit messages, patch files, real proxy hosts and your Windows account name in added lines, and unformatted code on push. CI runs the same message and added-line checks.

Security

See SECURITY.md for private vulnerability reporting.

Licenses

Rosetun is licensed under GPL-3.0-or-later, © 2026 Sandaar. See LICENSE. The bundled sing-box executable is the unmodified official build and is licensed under GPL-3.0-or-later. The executable embeds Wintun 0.14.1, copyrighted by WireGuard LLC and distributed under the Wintun Prebuilt Binaries License; its license and notice are installed as licenses/wintun-prebuilt-binaries-license.txt and licenses/wintun.txt. The Manrope and Cormorant Garamond fonts use OFL-1.1. Notices for Rust crates are installed as licenses/third-party.html.

Rosetun is not affiliated with sing-box or SagerNet.