What it does
A fiber line plus a cellular modem, two different ISPs, whatever you've got — mlvpn-rs bonds them into a single resilient, Noise-encrypted VPN tunnel. It uses all of your links at once rather than treating extras as pure backup, and load-balances/fails over between them based on continuously measured latency, jitter, loss, and throughput. It runs as a background service on two Linux machines, one at each end of the link you want to bond, with everything in between encrypted.
A memory-safe Rust rewrite of the original MLVPN by Laurent Coustet, which the core bonding/monitoring/failover idea is credited to — no code is shared between the two. Notable changes: binds to a network interface instead of an IP address so it survives DHCP/roaming changes, and a modern authenticated-key-exchange handshake instead of a shared password.
Built for real link hardware
- Dual-stack.IPv4 + IPv6 tunnel interface, with adaptive MTU detection and TCP MSS clamping — real link hardware decides sizing, not a hand-tuned config value.
- Automatic failover.Traffic shifts to healthy links the moment one degrades or drops, with no manual intervention and no dropped sessions.
- Cross-platform packaging.Targets current Debian/Ubuntu and Fedora/RHEL-family systemd-based distributions, on both amd64 and arm64, with proper
.deb/.rpmpackages. - A real terminal monitor.
mlvpn-tuigives a live view of link status, daemon state, and logs — not just a log file to tail.
Under the hood
Pure Rust, built around a Noise_IK handshake for the tunnel's authenticated key exchange, per-link EWMA stats tracking, and a smooth weighted round-robin scheduler for link selection.