Smart Routing
Match by domain, CIDR, GeoSite, GeoIP, source address, destination port, inbound type, or ALPN. Specific rules win over broad ones automatically — you don't hand-sort your rule file.
Now on iPhone and iPad · Desktop coming soon
DNS. Routing. Mesh.
One private network you control.
Orange is a local-first private networking app: DNS, routing, gateway and WireGuard mesh in one core. Reach your NAS at home, machines at the office, and services in the cloud at once — without switching VPNs or sending traffic through Orange servers.
3
Subsystems in one core — DNS, gateway, and mesh.
0
Orange servers in your data path. We don't run any.
4
Upstream protocols, plus direct and reject.
150+
Metrics exposed, so you can explain what happened.
Your private network · Live
HOME · OFFICE · CLOUD
Protocols
Flexible in, flexible out.
Accept traffic through the entry point that fits your environment, then send every destination through the egress mode it needs.
Inbound
04
- HTTP / HTTPS CONNECT
- SOCKS5 — TCP and UDP
- Mixed — one port, both
- TUN — whole-system
Upstream
04
- HTTPS CONNECT
- Trojan — TCP + UDP
- Shadowsocks 2022
- WireGuard
- Direct — no upstream
- Reject — drop it here
DNS
04
- UDP
- TCP
- DoT — DNS over TLS
- DoH — DNS over HTTPS
Upstream pools keep one hostname on one exit so a site never sees your address jump, or spread load round robin. Turn on health probing and a member leaves the pool only after two failures in a row.
Remote DNS lets name-aware egresses resolve the hostname at the far end instead of leaking it to your local resolver.
Core
One core. DNS, gateway, and mesh.
Three subsystems that share one configuration, one routing model, and one set of diagnostics — built on a single Rust core that stays lightweight and predictable.
Intelligent DNS
A full resolver, not a forwarder. UDP, TCP, DoT and DoH listeners; per-domain upstreams; rules that can differ by source network; caching that serves stale answers while it refreshes in the background.
System Gateway
Captures traffic from every app on the device. Everything works as-is — no per-app setup, no SDK, no changes to the apps you already run.
Private Mesh
Give every device a stable private address and a name that resolves anywhere. Traffic is WireGuard-encrypted end to end and rides your own relay from the first packet, then upgrades to a direct peer-to-peer path once that path proves itself — and drops back if it stops working. No manual peer lists.
Explainable by Design
Every request carries a trace: which rule matched, which upstream was picked, how long DNS took, and why it failed. Live dashboards ship inside the core — no extra agent to install.
Self-Hosted by Default
Orange sells no proxy nodes, runs no relay, and hosts no account service. Upstreams and mesh servers are yours; the client only connects to infrastructure you configured yourself.
Use cases
Built for real private networks.
Most users start with one of these, then grow into multi-site private networking as their environment gets more complex.
Remote Home Access
Reach your NAS, router, lab, and IoT from anywhere through a private encrypted path.
Corporate Intranet
Connect to internal services, dashboards, and private APIs without an all-or-nothing corporate VPN.
Multi-Site Office
Keep several branches reachable at once. Route by destination instead of switching profiles.
Device to Device
SSH from your phone to your laptop across two different networks — peer-to-peer, by name, no port forwarding.
Dev Environment
Reach dev databases, SSH targets, staging APIs, and private registries — leave public traffic untouched.
Self-Hosted Services
Access your own Nextcloud, Gitea, and media stack without exposing them to the public internet.
Pricing
Simple and transparent.
Orange Desktop for macOS and Linux is launching soon as a one-time purchase. iOS and iPadOS are a separate annual subscription, available now — and $19.99 instead of $39.99 until September 30, 2026. Purchasing one does not include the other. The self-hosted mesh server is free, and no traffic is metered.
Desktop
macOS · LinuxPersonal
1 device
$
49
One-time purchase
- All features included
- Free updates throughout v1.x
- macOS · Linux
Coming soon
Power User
3 devices · $33 each
$
99
Best value · laptop + desktop + server
- All features included
- Free updates throughout v1.x
- macOS · Linux
Coming soon
Team / Family
5 devices · $29.80 each
$
149
For small teams and households
- All features included
- Free updates throughout v1.x
- macOS · Linux
Coming soon
iOS / iPadOS
Available on App StoreYearly
Every iPhone and iPad on your Apple Account
50% off until September 30, 2026 · we only ask you to subscribe when you first start the network
- DNS, routing, proxy, TUN and mesh edge
- Traces, metrics and diagnostics included
- No device limit set by us
- Import, edit and export configs before you subscribe
- Cancel anytime in your Apple Account
Mesh server
Self-hosted · Linuxorange-mesh-server
$
0
Free download · no Orange account required
The control and relay side of your mesh, published as a standalone binary. It issues identities and addresses, distributes policy, and relays sealed packets when a direct path isn't available.
- Peer-to-peer traffic and your own relay are never metered or billed
- No dependency on Orange-hosted control, discovery, or state
- Ships without the DNS, proxy, or client UI code — server roles only
- Publicly downloadable, but not open source
FAQ
Common questions.
Is there a free trial?
No — the iOS subscription has no trial period. What is free is everything up to the moment traffic moves: downloading the app costs you nothing and starts nothing, and you can import, edit, validate and export your whole configuration without subscribing at all. Orange only asks you to subscribe when you first start the network. The price is $19.99 a year until September 30, 2026 as a launch offer, down from $39.99, and you can cancel anytime in your Apple Account.
Does Orange provide proxy nodes or VPN servers?
No, and this is deliberate. Orange never creates a default upstream, never bundles one, and never routes you through infrastructure we operate. You supply the servers — a VPS, a home gateway, a WireGuard peer — and Orange decides how traffic reaches them. Adding a new upstream doesn't silently change your routing either; it only becomes a target after you say so.
Do I have to pay for the mesh server?
No. orange-mesh-server is a free binary you deploy on your own machine, and it doesn't require an Orange account or a client license. Peer-to-peer traffic and traffic through your own relay are never metered. There is no hosted control plane, and the client contains no cloud endpoint to silently fall back to.
Is my traffic private?
Your traffic flows between your own devices and your own endpoints. Mesh payloads are encrypted with WireGuard end to end — a relay forwards sealed packets and never holds the session keys, so it cannot read them. Orange does keep local diagnostics on your device: logs, metrics, and request traces. Traces are off or subscriber-driven by default, log files are capped, and none of it is uploaded anywhere.
What happens if my subscription ends?
Orange stops starting and maintaining the network, but your configuration stays yours. You can still open, edit, validate, export and back up every profile — the same editor as before, not a crippled read-only mode. Nothing is deleted, encrypted, or held hostage, and stopping the tunnel always works.