DuctIO · Overlay · VPN — three layers, one stack
DUCT is a team of networking and blockchain engineers. We build DuctIO, a high-performance I/O runtime; an overlay that keeps routes alive through NAT, firewall, partition, and DPI; and a VPN service on top. No central routing server.
A C framework for high-throughput network services. I/O threads handle epoll and raw sockets; worker threads run crypto, framing, and protocol logic — connected by lock-free queues.
Dedicated I/O threads read and write fds via epoll. Workers never touch sockets — they decrypt, parse, and dispatch frames through callbacks. Clean separation, predictable latency.
epoll → OLB → WFQ → on_frame
Ring buffers (OLB) for RX/TX transfer. Weighted fair queues (WFQ) between I/O and workers. Session and connection tables use CAS — no mutex on the hot path.
conn slab · session table · timer heap
Protocols and transport adapters load as shared libraries.
Implement on_frame and on_timer —
the runtime handles sessions, framing, and backpressure.
dlopen("my_proto.so") → duct_proto_t
A decentralized overlay network: bootstrap, discovery, routing, and data plane. Nodes find each other by cryptographic NodeID and build relay paths when direct IP is unavailable.
DHT-based node discovery. NodeID = SHA256(Ed25519) — your cryptographic address, not an IP.
Ed25519 on control plane. X25519 + ChaCha20-Poly1305 on data. No unencrypted modes.
Source routing with failover FSM. Primary + backup routes, link scoring. Sub-200ms route switch.
A consumer-facing VPN built on DuctIO and the overlay. Your traffic rides encrypted relay paths — censorship-resistant, decentralized, and designed to ship as a standalone product.
VPN sessions run over the overlay data plane — not a single central gateway. Traffic finds paths through relays when direct routes fail.
your traffic → overlay → exit
A VPN session binds network and TUN interfaces under one DuctIO session — multiplexed streams, generation-checked handles, clean lifecycle.
session: network conn + TUN conn
VPN is the first consumer service in the DUCT suite. It may launch as a separate product — the overlay and I/O runtime remain the shared foundation underneath.
DuctIO → Overlay → VPN
Rotate pipes to build a working route from source to exit. Every click is a hop. No central planner — you are the router.