tsunagi/dist/windows

Running tsunagi on Windows

The installer (recommended)

tsunagi-setup-<version>-x86_64.exe does everything in one go. Run it as an administrator (it asks):

• installs tsng.exe, the tray app and Wintun to C:\Program Files\Tsunagi;
• registers and starts the Tsunagi Windows service (it starts at boot and restarts after a crash), running as the system account;
• adds tsng to the PATH and an inbound Windows Firewall rule for the agent (both are tasks you can untick);
• starts the tray icon at sign-in.

Where things live: the device's identity and networks in %ProgramData%\Tsunagi\data (readable only by administrators and the system), the log in %ProgramData%\Tsunagi\logs\tsng.log. The service keeps its own state: networks joined by an agent you started by hand (tsng up, which keeps its data in your user profile) are not carried over; join them again with tsng join. The installer stops such an agent, because it cannot run beside the service.

tsng status, tsng join and the tray work from an ordinary, non-elevated terminal. Manage the service with the Services app or sc stop Tsunagi / sc start Tsunagi. Silent install: /VERYSILENT /SUPPRESSMSGBOXES; choose tasks with /TASKS="!autostart,addtopath,firewall". Uninstalling removes the service, the firewall rule and the PATH entry, and asks before deleting the data.

By hand (the zip)

This archive holds tsng.exe. The overlay interface is a Wintun adapter, so the agent needs two things to carry real traffic:

1. wintun.dll beside the executable. Download it from https://www.wintun.net, take the DLL for your architecture (amd64), and put it in the same folder as tsng.exe.
2. An elevated process. Creating the adapter requires Administrator rights.

Open PowerShell or Command Prompt with Run as administrator and start the agent there:

.\tsng.exe up

Run the commands that control it (join, status, dns, network) as the same user with the same elevation. The agent serves its control interface on a named pipe under %ProgramData%\tsunagi, so an elevated client finds it regardless of which account started the agent.

Without touching the OS

.\tsng.exe up --no-tun

Tunnels form and handshake between agents, but no adapter, address or route is created, so traffic never reaches the operating system. Needs no Wintun and no elevation.

What the agent installs

Everything is tagged to its own adapter, computed from local state, and reversible — removed when a network leaves, broadcast is turned off, or the agent stops:

• a Wintun adapter configured with netsh (addresses, MTU);
• while broadcast is on, a 255.255.255.255 route through the adapter and an inbound-UDP firewall allowance from the overlay range;
• the Name Resolution Policy Table entry that sends the overlay zones' questions to the local resolver.

Nothing taken from a remote peer ever becomes a path, a command argument or an OS setting.