Mesh Network
Cosineq
/koʊˈsiːnɪk/ • A post-quantum zero-trust mesh VPN that isolates every connection between devices and services. You have complete control, including rolling out in your own infrastructure.
Performance matters in Cosineq: relayed sessions sustain 992 Mbit/s on roughly one core of the relay. Direct peer-to-peer QuicN traffic runs at 11–12.3 Gbit/s.
Relay figure measured with localised device-relay-device setup, iperf3 single TCP flow, and batched forwarding. June 2026.
Every connection between two devices in a Cosineq mesh is its own isolated, authenticated, post-quantum QuicN tunnel. There is no flat network in the middle that everything shares. Each device connects explicitly to another device, all with unique secure identities. Access must be granted before a connection starts and every packet runs through filtering, including fine-grained rules configurable on each device themselves. Deploy it as an overlay mesh or a traditional server model; the choice is yours.
Connectivity, resiliency, security - all three are fundamental to the Cosineq architecture.
The control plane
Post-quantum connectivity to every device, individually.
- High availability
- Cosineq mesh controllers can be configured as an active-active cluster that scales to however many you need for your deployment. New controllers can be added without re-enrolling any device or STUN/relay subordinate.
- Server groups
- Designed for horizontal services scaling, such as VPN egress machines. Every server has its own key-based identity, individually revocable, and device only needs to connect to a single address of the set.
- Multiple overlay networks
- Independent and isolated overlay networks, with their own IPv4 and/or IPv6 subnets. Treat each just like a physical network. All services and routes advertised on the networks are policy-gated - for both who and what.
Relays and reachability
- High-performance relays
- Post-quantum QUIC-session relays that forward peer-to-peer connections when the devices cannot reach each other directly. Along with a thin packet encapsulation for low latency, the controller determines the shortest relay path for the devices to use.
- Temporary relaying
- While relayed, both peers will keep gathering potential direct path candidates. When one is available, they will move their sessions onto it transparently and drop the relay; all while keeping that session alive.
- Dealing with NAT
- With NAT and firewalls enforced by most internet connections, Cosineq will work to find a connection path through them. Devices attempt direct IPv6, direct IPv4, signed STUN with synchronised hole punching, and a relay.
Zero trust applied
- Access policy enforced by the receiving device
- Just because the controller allows it doesn't mean the device should - a device can apply additional security by blocking specific peers, dropping inbound connections, filtering by tag, and rejecting advertised routes. Access control policy is checked at connection time and again for each packet on the receiver side, to ensure no strays.
- Extensive access policy
- Almost like a firewall but focussed only on mesh traffic.
Rules can be built from tags applied to users and devices:
from tag:admin to tag:prod. - Device isolation
- Designed to be like classic VPNs, for businesses and VPN providers. Turn it on and clients only see and connect to the servers advertised; devices do not know of each other's identity or presence. All connection policies are still driven by the controller so knowing another device's identity does not mean a connection will succeed.
- Anti-spoofing at the tunnel
- Only packets belonging to the peer and its authorised backend routes are permitted. Everything else gets dropped.
The clients
- Desktop, mobile, headless
- Linux, Windows and macOS desktop clients, native iPhone, iPad, macOS, and Android apps, along with root and rootless command-line clients. Graphical apps have a built-in SSH client for direct mesh-to-host access.
- Several meshes, one install
- Multiple profiles on all clients with pinned identity keys, each tied to its own independent controller managed or direct peer-to-peer setups.
- Services advertisement, not just systems
- A device can advertise what it hosts, say a media server or a traditional service, to appear in the mesh network roster. Example use: SSH and RDP consoles open in one click from the device view.
- Unprivileged containers
- Userstack-only mode removes operating system changes entirely and does not rely on a kernel tunnel device: no administrative privileges, no host routing changes, no kernel firewall rules and no domain resolver rewriting. SOCKS5 at the initiator and completely transparent ICMP, UDP and TCP connections at the target.