# Orange

> Orange is a local-first private networking app that combines a full DNS resolver, rule-based
> routing, proxy egress and a WireGuard-encrypted private mesh in a single Rust core. It lets one
> device reach a NAS at home, machines at the office and self-hosted services in the cloud at the
> same time, over infrastructure the user owns. Orange sells no proxy nodes, runs no relay and
> hosts no account service — the client only connects to endpoints the user configured.

Key facts:

- Configuration is a single TOML file; unknown fields are rejected rather than ignored, and every
  listener defaults to `enabled = false`.
- Three subsystems share one config, one routing model and one set of diagnostics: DNS, proxy and mesh.
- Inbound: HTTP / HTTPS `CONNECT`, SOCKS5 (TCP and UDP), Mixed (one port, both), TUN (whole system).
- Egress: HTTPS `CONNECT`, Trojan (TCP + UDP), Shadowsocks 2022, WireGuard, plus `direct` and `reject`.
- DNS: a full resolver, not a forwarder — UDP, TCP, DoT and DoH listeners, per-domain upstreams,
  rules that can differ by source network, and stale-while-revalidate caching.
- Routing matches on domain, CIDR, GeoSite, GeoIP, source address, destination port, inbound type
  or ALPN. Specific rules beat broad ones automatically; rule files are not hand-sorted.
- Mesh traffic is WireGuard-encrypted end to end. It starts on the user's own relay and upgrades to
  a direct peer-to-peer path once that path proves itself, falling back if it degrades.
- `orange-mesh-server` is a free, self-hosted Linux binary. No Orange account, no hosted control
  plane, no metered traffic. It is publicly downloadable but not open source.
- Platforms: iOS and iPadOS available now (annual subscription, 14-day trial); macOS, Windows and
  Linux desktop launching as a one-time purchase.
- Contact: contact@orangenet.app · Last updated: 2026-08-17

## Documentation

- [Configuration reference](https://orangenet.app/documentation.html): The authoritative TOML
  reference. 39 sections covering DNS listeners and resolver, proxy listeners, upstreams and pools,
  routing rules, TUN, sniffing, timeouts, tracing, datasets and the mesh — every option with its
  type, default and constraints. Each section is anchor-linkable (e.g. `#dns-rules`, `#mesh-relay`).
- [Use cases and rule atlas](https://orangenet.app/cases.html): Five complete deployments plus 32
  copy-ready DNS and routing rules in real TOML.
- [Mesh server deployment](https://orangenet.app/mesh-server.html): Install, initialize, verify and
  operate `orange-mesh-server` on Linux — ports, address pool, enrollment, backup, migration,
  troubleshooting, access control and TLS.

## Product

- [Overview and pricing](https://orangenet.app/): What Orange is, the protocols it speaks, who it is
  for, and what it costs.
- [Privacy policy](https://orangenet.app/privacy-policy.html)
- [Terms of use](https://orangenet.app/terms-of-use.html)

## Optional

- [llms-full.txt](https://orangenet.app/llms-full.txt): The complete configuration reference, rule
  atlas and mesh server guide as one plain-text document.