🌐 English | 中文 | 한국어

A mesh relay network built on Hysteria 2 QUIC tunnels, managed from a web UI.

Nodes connect to each other directly through QUIC; each node can act as a relay, an exit, and a VPN server (L2TP, IKEv2, WireGuard, SOCKS5, HTTP, Shadowsocks). All configuration is done from the browser; there is no coordination server.

Full mode (host network — everything enabled, including routing rules):

docker run -d --name hy2scale \
  --network host --privileged \
  -v hy2scale-data:/data \
  --restart unless-stopped \
  frankoong/hy2scale:latest

Bridge mode (VPN + proxies, no routing rules):

docker run -d --name hy2scale \
  --cap-add NET_ADMIN --cap-add NET_RAW \
  -p 5565:5565/tcp -p 5565:5565/udp \
  -p 500:500/udp -p 4500:4500/udp -p 1701:1701/udp -p 51820:51820/udp \
  -v hy2scale-data:/data \
  --restart unless-stopped \
  frankoong/hy2scale:latest

Open http://<host>:5565/scale/ — default login admin / admin. Change the password from Settings → System on first login.

See Installation for other deployment modes.

• Installation — Docker deployment, compose, ports, environment variables
• Nodes — mesh networking, graph view, nested discovery, multi-IP peers
• Proxies — Hysteria 2, SOCKS5, HTTP, Shadowsocks, L2TP, IKEv2, WireGuard
• Users — user management, per-user exit routing, traffic limits
• Rules — IP and domain routing rules
• TLS — certificate management, CA signing
• Settings — system, password, HTTPS, upgrade, backup
• Router Systems — running on stripped-kernel router distros
• iKuai v4 Installation — .ipkg install on iKuai firmware
• API Reference — REST endpoints

L2TP, IKEv2, and the five application-layer proxies share a single user database; WireGuard uses its own per-peer key store. Per-user exit_via paths apply to every protocol in the first group.