Encrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and intrusion detection across NAT and firewalls.
MESH is a networking tool, to support remote logical forensics acquision on mobile devices
MESH gives analysts a direct, encrypted path to mobile devices for wireless debugging, network monitoring and forensic acquisition, even when those devices sit behind NAT, firewalls, or restrictive mobile networks. It builds a private overlay so a remote device behaves as if it were on the same local subnet. It does not require central VPN servers, no port forwarding, and no permanent infrastructure to maintain or defend. This allows for seemless and easy remote, over the internet, network monitoring and acquision with the likes of MVT and AndroidQF.
Meshes are ephemeral and analyst-controlled: bring devices online, collect, then tear the network down. Nothing is left running, which supports the avoidance of fingerprinting activity.
[!IMPORTANT] Public Alpha: Currently in public alpha and under active development. A full third-party penetration has been completed and we have patched all major vulnerabilities. Things may change and breaking changes should be expected. It currently requires some level of technical expertise. Please report bugs or security concerns via GitHub Issues."
For full documentation:
https://docs.meshforensics.org/
docker compose, not legacy docker-compose). Install instructions.sudo snap install task --classicbrew install go-task[!NOTE] Most runtime operations work with plain
docker compose, but the interactive setup tasks (.envmanagement, config templating, auth-key rotation) require go-task.
git clone https://github.com/BARGHEST-ngo/mesh.git
cd MESH
task build
task controlPlane
task controlPlane walks you through setup interactively and starts all required services. For most users selecting Ephemeral with an Automatic domain is the recommended route - it requires no server or DNS configuration.
Choose a deployment type. An ephemeral control plane runs on your workstation and is accessible over the internet via a secure tunnel. A persistent control plane runs on a dedicated internet-facing server you manage.
Choose a domain. Selecting Automatic lets MESH provision a public HTTPS address for you. Select Manual if you want to use your own domain.
Enter API key. If you have chosen an Automatic domain then you will be prompted to enter an API key. This will be provided to you by the team at Barghest, contact us to request access.
Confirm configuration. Review the generated settings before MESH starts.
If these settings are incorrect, or if setup was interrupted, delete .env and run task controlPlane to start again.
CONTROL_PLANE_TYPE=Ephemeral
PROXY_DOMAIN_TYPE=Automatic
MESH_SUBDOMAIN=<random 10 character slug>
FRP_AUTH_TOKEN=<secret token>
CONTROL_PLANE_URL=https://<slug>.tunnels.meshforensics.app
LOGIN_URL=https://<slug>.tunnels.meshforensics.app
Containers start and an API key is generated. Once all services are healthy, MESH prints a one-time API key to log into the web UI.
Control plane API key (enter this in the web UI to log in):
<SECRET API KEY>
Navigate to your control plane URL and enter the API key when prompted to log in.
https://<slug>.tunnels.meshforensics.app
The web UI is served over HTTPS with a certificate issued automatically by Let's Encrypt.
[!IMPORTANT] The default ACL allows nodes in each network talk to each other. Production deployments should use restrictive policies. Modify these via the ACL tab.
Your MESH network is now ready to accept nodes.
See the documentation for node enrollment and forensic workflows.
task down destroys the MESH network, disconnecting all users, and if you chose an Ephemeral deployment with an Automatic domain, these and all traces are removed and can no longer be accessed.
MESH is a heavily modified fork of the Tailscale protocol, but does not require Tailscale infrastructure.
To establish peer-to-peer, end-to-end encrypted channel is created using UDP hole punching. If UDP is unavailable or blocked, it will fail over to E2EE HTTPs relays called DERP relays. The DERP protocol DERP (Designated Encrypted Relay for Packets) servers relay traffic between nodes when a direct peer-to-peer connection cannot be established.
MESH follows the same model. By default, if an operator has not configured their own DERP infrastructure (which can be done using MESH's control plane), MESH uses Tailscale’s public DERP servers to ensure reliable connectivity, particularly in restrictive network environments. However, MESH does not require Tailscale infrastructure: operators can deploy and use their own DERP servers via the control plane, which includes an embedded DERP implementation. This makes MESH fully self-hostable when desired.
DERP servers act purely as transport relays. They facilitate connectivity between devices but do not have visibility into the data exchanged, which remains end-to-end encrypted.
Enhancements include (but are not limited to):
The control plane is responsible only for peer discovery and key exchange. Forensic traffic flows directly between endpoints whenever possible.
Traditional VPN and hub-and-spoke architectures introduce:
MESH separates coordination from data transport:
MESH is optimized for transient, high-risk environments rather than permanent enterprise networking.
android-client — Android endpoint APKcontrol-plane — Coordination serveranalyst — Analyst CLI clientWorkflow:
mesh-analyst-client.main.MESH is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later).
Portions of this software are a derivative work of Tailscale, which is licensed under the BSD 3-Clause License. The original Tailscale copyright and license are preserved in accordance with the BSD-3-Clause requirements. AmneziaWG/Wireguard code is licensed under MIT license. See .licenses/ for details.
All modifications and additions by BARGHEST are Copyright (c) BARGHEST and licensed under AGPL-3.0-or-later.
WireGuard is a registered trademark of Jason A. Donenfeld.