Wave VPN: open-source WireGuard client for Android and Linux (unofficial, v0.1.1)

[VesselWave 1]

Hi all,
 

I built Wave VPN, an open-source (GPL-3.0) WireGuard client for AirVPN on Android and Linux. Sign in with your AirVPN account, pick a server, and connect. AirVPN does not endorse this independent project.

Download: vpn.vwave.me. On Android, add my F-Droid repository to get automatic updates.

Version 0.1.1 is an early release. Anyone can use it, but I have not tested it on every device and setup yet.

Disclosure: AI coding agents (Claude Opus 5.5 and GPT 6.1 Sol) wrote most of the code, tests, and documentation under my direction. The source code and every test report, including failures, are public.

Features

• Pick the lowest-latency server or search the full list, with ping, load, and saved favorites.
• Android supports split tunneling and Always-on VPN.
• On Linux, AirVPN verifies that your IPv4, IPv6, and DNS traffic go through the tunnel.
• Linux includes a Network Lock firewall that stays active until you turn it off, a recovery button, and an Eddie account importer.
• The app contains no analytics or telemetry. It talks only to AirVPN.
• The client supports WireGuard only.

Sign-in details. Sign in with your AirVPN username and password. The app uses the same encrypted protocol as Eddie, so you do not need to generate an API key. Your device encrypts your credentials using Android Keystore or your Linux desktop keyring, and sends them only to AirVPN.

Comparison with Eddie

Eddie handles many tasks, and Wave relies on Eddie's published protocol implementation. Wave takes a different approach:

• The interface uses Jetpack Compose on Android and Rust on Linux, centered on a single Connect control.
• The settings include only basic WireGuard options and sensible defaults.
• On Linux, the app runs as an unprivileged user while a dedicated helper executes a fixed list of network commands. The firewall rules stay active if the main process exits unexpectedly.
• Every test report is public, including runs that failed.
• The Linux version can import your saved Eddie account.

Eddie supports OpenVPN, Windows, macOS, and advanced routing options. If you need those options, use Eddie.

Known issue

Android reminder: Android can leak DNS during VPN reconnects or app crashes, even with Always-on VPN and blocking enabled, as documented by Mullvad. I also observed this in my Samsung tests.

Links

• Android source
• Linux source
• Release key: 4140 18C0 BBB8 C0A7 0A80 BF57 0AA3 2CCB 2C0B 3951 (verified on keys.openpgp.org)

Bugs and feedback

• Bug reports: open a GitHub issue on the Android or Linux repository. Include the app version, operating system version, and reproduction steps.
• General questions: post in this thread.
• Security disclosures: email vesselwave@protonmail.com.

Do not post passwords, private keys, or WireGuard configuration files. I maintain this project in my spare time and respond as schedule permits.

Thanks for trying it! ♡

Edited ... by VesselWave

[Staff 10693]

Hello!

First of all, thank you for writing free and open source software dedicated to AirVPN. We had a quick look at both repositories. The code is careful and we did not find any telemetry and/or third-party endpoints. The client identifies itself honestly and the documentation describes our protocol accurately. We appreciate it.

There are three points that affect our infrastructure, which you might like to take into account for the next releases. References are to wave-vpn-desktop at commit ce9a15fd and wave-vpn-mobile at commit 64a2be1b.

1. Periodic tunnel verification (desktop)
verify_tunnel() in src/platform/linux.rs runs every 60 seconds for the whole session: the tun check for each IP family and the dns check on https://<server>_exit.airservers.org:89/check/, plus a checkdns.airvpn.org query. Any failure tears the tunnel down. Eddie runs these checks only once, right after connecting. With a 60 second loop, a short outage of the check service would disconnect every Wave VPN user at the same time, and they would all reconnect together. You might like to consider running the checks only at connection time, or much less often with some random jitter, and not disconnecting on a single failed check.

2. Latency measurement (desktop and Android)
The "ping" is a TCP connection to port 443 on the first entry IPv4 of every server (src/gui.rs on desktop, vpn/Connection.kt on Android), so about 250 connections are opened and closed at every login, launch and refresh. The desktop refresh can go down to 15 seconds from the command line, and the Android manual refresh has no rate limit. A lighter probe such as ICMP echo, fewer probes in parallel, cached results with a minimum interval between refreshes, and no probes while connected (they go through the tunnel and skew the ranking anyway) would help a lot. Also, on desktop an unreachable server currently counts as 0 ms (src/documents.rs), so "Best server" ends up preferring servers that do not answer.

3. Bootstrap servers (desktop and Android)
The desktop client always uses the bootstrap URLs and the RSA key from the AirVPN.json compiled into the binary and ignores the ones in the manifest (src/lib.rs, src/documents.rs). If we change bootstrap addresses or rotate the key, older builds would stop working. It might be worth storing and using the bootstrap URLs and key from the latest manifest, and keeping the embedded ones only as a first-run fallback. On Android, Protocol.kt and Session.kt send user and manifest at every refresh, always to the first URL, with no backoff while the bootstrap servers are unreachable. Trying the other URLs when one fails, with an increasing delay between retries, would make the client more robust and lighter on our side.

Thank you again for your work. Feel free to ask here if anything about the protocol is unclear.

Kind regards