CONNECTED · PQC ACTIVE · WFP KILL SWITCH
Paris · FR
CAP
10 Mbps
PEERS
/32 isolated
DNS
100.64.0.1 tunnel
One identity. One free seat. The Windows client ships today — self-contained, WireGuard bundled, no separate driver install. macOS and Android land in Phase 4. iOS, Linux desktop, and a Linux CLI are explicitly out of stage-1 scope — no half-shipped clients.
A connect button bigger than the rest of the UI. We don't bury the thing you came to do — and the privileged service does the dangerous parts so the UI never needs admin rights at click-time.
.\StandVPN-amd64-installer.exe(Get-FileHash -Algorithm SHA256 .\StandVPN-amd64-installer.exe).Hash.ToLower()StandVPNService with the SCM. Sign in. Click Connect.net start StandVPNService # already done by installerWFP-level filters from wireguard-windows engage automatically when AllowedIPs covers 0.0.0.0/0. Drop the tunnel, drop the network — packets do not leak.
Traffic to RFC1918 ranges (10/8, 172.16/12, 192.168/16) bypasses the tunnel. Your printer, NAS, smart-home hub keep working. Toggle off in one click.
UI runs as your user. The dangerous parts (interface management, firewall, Wintun) live in StandVPNService behind a named-pipe ACL with caller-identity checks (audit-fix C1).
The privileged service ships wireguard-go statically linked. No separate WireGuard for Windows install. No driver. No second installer. One binary, 10.15 MB.
On network change, sleep/resume, or VPN drop, the service re-handshakes without user action. MTU fallback included for hostile NATs.
Out of stage-1 scope. Listed here so it is visible we cut these — not so we can claim them.