Minimal dependency-free UDP/TCP tunnel for embedded Linux targets.
Ships as a userspace daemon and an optional standalone kernel module.
Cameras and other devices behind NAT connect out to one camex server; the server gives each a tunnel address and, with nginx in front of them, opens each device's web UI by name, with a start page of all of them.
- Client/server architecture over UDP or TCP
- Auto-config mode — client fetches tunnel parameters from the server
- Protocol v2 — Noise handshake (
NKpsk0, X25519, ChaCha20-Poly1305, BLAKE2b), fresh keys per session and direction, always encrypted - No external dependencies — only libc required
- Cross-platform builds — x86_64, ARM, AArch64, MIPS (via CI)
- Custom kernel module —
camex.koreplacestun.kowith no external deps - Compact codebase — ~3,500 lines total, easy to audit
One command installs the server: camex of the latest release, its key pair,
/etc/camex/camex.conf with a new pre-shared key, and the systemd service.
At the end it prints what the clients need:
curl -fsSL https://raw.githubusercontent.com/OpenIPC/camex/master/install.sh | sudo shWith --domain, nginx in front of the clients too: each client's web UI at
http://<client ID>.<domain>/, the start page at http://<domain>/:
curl -fsSL https://raw.githubusercontent.com/OpenIPC/camex/master/install.sh | sudo sh -s -- --domain openipc.clickRun it again to update camex; --uninstall lists every file of camex and how
to remove them. The steps, the files on the server, installing by hand on other
systems: docs/install.md.
A camera (or any Linux device) with camex-<arch> from
Permanent links, with the public key and psk the installer
printed:
camex --mode client --auto --name 0203A104B5AE \
--server-host vpn.example.org --port 5800 \
--server-pubkey <public_key> --psk <psk>Every option: docs/usage.md.
The app connects in auto mode: the server sends the address, routes and MTU (docs/android.md).
| Main screen | Settings |
|---|---|
 |
 |
The start page of the devices at http://<domain>/, each name a link to the
device's web UI at http://<client ID>.<domain>/
(docs/nginx.md).
| Start page | On a phone |
|---|---|
 |
 |
The binaries are published as one release, latest,
rebuilt by CI from every push to master. Its title shows the camex version
(Camex X.Y.Z); the file names carry no version, so these links never change:
- release page:
https://github.com/OpenIPC/camex/releases/latest - a file:
https://github.com/OpenIPC/camex/releases/latest/download/<file>
| File | Platform |
|---|---|
camex-aarch64 |
Linux AArch64, static (musl) |
camex-arm |
Linux 32-bit ARM, static (musl): OpenIPC cameras |
camex-mipsel |
Linux MIPS little-endian, static (musl, soft-float): Ingenic cameras, routers |
camex-x86_64 |
Linux x86_64, static (musl) |
camex-android.apk |
Android 8.0 and later |
camex-macos.zip |
macOS (utun): camex, LICENSE, README |
camex-windows-x86_64.zip |
Windows 64-bit: camex.exe and wintun.dll |
camex-windows-i686.zip |
Windows 32-bit: camex.exe and wintun.dll |
URL=https://github.com/OpenIPC/camex/releases/latest/download
curl -fL -O $URL/camex-armThe change history is in CHANGELOG.md.
| Document | Contents |
|---|---|
| Installation | install.sh, installing by hand, the files on the server, clean reinstall |
| Usage | the command line: keys, modes, every option, TUN backends |
| Server configuration | camex.conf, camex --status, the auto pool and the number of clients |
| nginx in front of the clients | each device's web UI by name, the start page, firewall, DNS, TLS |
| Security model | the protocol, its limits, recommended deployment |
| Android app | settings, VPN and routes |
| Kernel module | camex.ko: design, building (OpenWrt too), API, limitations |
| Building | requirements, building, cross-compiling, binary sizes |
| Versions and releases | versions, the latest release, CI |
MIT. See LICENSE for the full terms.
- Questions and bug reports: GitHub Issues
- Documentation: openipc.org
