Testing HulyNet

HulyNet is a private network that spans countries, and we are building it. Your computer connects to it, where no other tester’s computer can reach it, and sends all of its Internet traffic through it. Each connection leaves HulyNet where it is served best: a site in Russia is reached from Russia, the rest of the Internet from another country. A site sees HulyNet’s address, not yours. The names of the sites you open are looked up inside HulyNet too, so your provider neither sees them nor answers them.

So what your own connection does not reach opens, and a service that serves only its own country still does. The computer of ours that carries your traffic out is called the exit. Testers in Russia can also connect to HulyNet inside the country, through an entry.

If the connection breaks, nothing leaks: your computer has no Internet until the connection is back or you stop HulyNet.

This is a test version. We ask you to install it, use your computer as usual for a few days, and tell us how it went. A failed attempt helps us as much as a working one.

How HulyNet differs from OpenVPN, WireGuard, VLESS and others, and why there is no “OpenVPN file”: the comparison.

1 What we want to learn

• whether it connects from your networks: home, mobile, work, public Wi-Fi;
• how fast it is;
• what breaks, and when;
• how long it stays up.

2 Before you start

• Your decision. A tool that carries your traffic through another country may be unwelcome where you live. Decide for yourself whether to test, and stop whenever you want.
• What someone watching your connection sees: that your computer talks to our servers (their addresses, and our server’s name), and how much data goes back and forth. They do not see which sites you open or what you send. The traffic is encrypted, but not yet disguised as ordinary browsing.
• What we see: your computer’s ID (the public half of a key HulyNet makes on it), its name with us, the addresses it connects from, and how much traffic it sends. Like any VPN provider’s, our servers that carry your traffic see which sites it goes to, but not the contents of encrypted (HTTPS) pages, and they look up the sites’ names for you.
• You need the invite code from the testers’ chat. If you came here by its link, the code is filled in below already.

Invite code

3 macOS

You need macOS 13 or newer, on Apple Silicon or Intel, and an administrator account: you type its password when a command starts with sudo.

3.1 Install and join

Open Terminal (in Applications → Utilities), paste this line, and press Return:

curl -fsSL https://yl5ako37.nothing.md/install.sh | sudo sh -s -- YOUR-CODE

Terminal asks for your Mac’s password: type it and press Return. Nothing appears while you type; that is normal. The installer downloads HulyNet, checks it, installs two programs, hulyscaled (the service) and hulyscale (the command you use), starts the service, which starts again with the Mac, and connects your computer to HulyNet. When it says Done, your traffic goes through it.

macOS reports Background Items Added: that is HulyNet, leave it allowed.

Your computer gets a name, such as tester-7. To choose one yourself, add --name and the name at the end of the line, for example --name owl: up to 20 lowercase Latin letters, digits and -, starting with a letter, and nothing that identifies you.

3.2 Check that it works

• curl https://ifconfig.me; echo prints the exit’s address, not yours.
• A site that your own connection does not reach opens.
• A DNS leak test (for example dnsleaktest.com) shows the exit’s address, or resolvers near the exit with an older version, not your provider’s.
• hulyscale status says which of our servers your traffic goes through (via exit or via entry); hulyscale peers shows that server, and how you reach it.

3.3 Pause or stop

sudo hulyscale stop     # your own connection again
sudo hulyscale start    # through the exit again

HulyNet also starts again when the Mac restarts. If it crashes, macOS restarts it within seconds, and in between you have no Internet: that is how nothing leaks. Whatever happened, sudo hulyscale stop gives you your own connection back.

3.4 Uninstall

curl -fsSL https://yl5ako37.nothing.md/install.sh | sudo sh -s -- --uninstall --purge

Without --purge, your computer’s key (its ID) stays, and a new installation keeps its registration.

4 Linux

You need a 64-bit PC (x86_64 or ARM64) with a current distribution that uses systemd, and sudo. For DNS to go through the exit, the system must use systemd-resolved, as Ubuntu and its derivatives (Mint, Pop!_OS) and Fedora do: resolvectl status prints your network’s settings if it does. On Debian, install it first:

sudo apt install systemd-resolved

Your network keeps working, and names now go through it. If you ran the line before that, run it again afterwards: it keeps your registration. Other systems without it (Manjaro, say) cannot use the exit yet: please do not run the line there, it would take up a registration for nothing.

4.1 Install and join

In a terminal:

curl -fsSL https://yl5ako37.nothing.md/install.sh | sudo sh -s -- YOUR-CODE

It picks the right version for your computer, checks it, installs two programs in /usr/bin, hulyscaled (the service) and hulyscale (the command you use), starts the service, and connects your computer to HulyNet. When it says Done, your traffic goes through it. The service runs as root, because the system takes DNS settings only from root, and keeps a single permission: managing the network. To choose your computer’s name, add --name and the name, as on a Mac.

If your system cannot send DNS through the exit, HulyNet does not start its network: your traffic goes the ordinary way, not through the exit, and curl https://ifconfig.me; echo prints your own address. journalctl -u hulyscaled says why.

4.2 Check that it works

The same as on a Mac: curl https://ifconfig.me; echo prints the exit’s address, a site your own connection does not reach opens, a DNS leak test shows the exit’s address, and hulyscale status says via exit or via entry, and for all names on its dns line.

4.3 Pause or stop

The same as on a Mac: sudo hulyscale stop gives you your own connection back, and sudo hulyscale start sends everything through the exit again. HulyNet also starts again with the computer; if it crashes, systemd restarts it within seconds.

4.4 Uninstall

curl -fsSL https://yl5ako37.nothing.md/install.sh | sudo sh -s -- --uninstall --purge

5 Windows

You need Windows 10 or 11 on a 64-bit PC (x64), and an administrator account. Windows on ARM does not work yet.

5.1 Install and join

Open a terminal as administrator: right-click the Start button, choose Terminal (Admin) (on Windows 10: Windows PowerShell (Admin)), and let it make changes. Paste this line and press Enter:

& ([scriptblock]::Create((irm https://yl5ako37.nothing.md/get.ps1))) YOUR-CODE

The installer downloads HulyNet, checks it, and installs it in C:\Program Files\HulyNet: two programs, hulyscaled (the service) and hulyscale (the command you use), with Wintun, WireGuard’s network driver. It starts the service, which starts again with Windows, and connects your computer to HulyNet. When it says Done, your traffic goes through it.

To choose your computer’s name, add -Name and the name at the end of the line, for example -Name owl, with the same rules as on a Mac.

5.2 Check that it works

In a terminal opened as administrator:

• curl.exe https://ifconfig.me prints the exit’s address, not yours. Type curl.exe: in PowerShell, curl alone is another command.
• A site that your own connection does not reach opens, and a DNS leak test shows the exit’s address.
• hulyscale status says via exit or via entry, and for all names on its dns line; hulyscale peers shows that server of ours.

Printers, shared folders and the other devices at home stay reachable: HulyNet lets your local network through.

5.3 Pause or stop

In a terminal opened as administrator:

hulyscale stop     # your own connection again
hulyscale start    # through the exit again

HulyNet starts again with Windows. If it crashes, Windows restarts it within seconds, and in between you have no Internet: that is how nothing leaks. For the same reason, right after Windows starts it may show No Internet for a few seconds, until HulyNet is up. Whatever happened, hulyscale stop gives you your own connection back.

5.4 Uninstall

In a terminal opened as administrator:

& ([scriptblock]::Create((irm https://yl5ako37.nothing.md/get.ps1))) -Uninstall -Purge

Without -Purge, your computer’s key (its ID) stays, and a new installation keeps its network.

6 The entry: connecting inside Russia

Your computer reaches HulyNet at one of our servers: the exit, or, for testers in Russia, an entry, a server of ours inside the country. It chooses between them by itself: the one that answers faster over a working connection. You can also hold it to one.

6.1 Why

• In Russia, your computer will usually choose the entry. Its connection then stays inside the country, and your traffic travels on inside HulyNet. We expect a connection inside the country to be slowed down and interrupted less often than one that leaves it: that is what we want to test with you.
• Elsewhere, it will usually choose the exit. Through the entry, your traffic would make a detour.
• Either way, a site in Russia is reached from Russia. Services that serve only Russian addresses open, wherever you are and whichever way you connect: Russian Railways, Russian Post, Gosuslugi. Their names are looked up in Russia too, so a service that chooses its servers by where a name is asked gives the right ones (if you installed before 9 November, run the line again for this). Everything else leaves through the exit.

6.2 What the entry sees

• Like the exit, the entry sees which sites your traffic goes to, but not the contents of encrypted (HTTPS) pages, and, as any provider’s router can, it can reach your computer at its address in HulyNet.
• Traffic to sites in Russia leaves from our servers there; the rest goes on to the exit, encrypted.
• Someone watching your connection sees that your computer talks to our server inside the country, and still to our server outside it: HulyNet keeps a connection to it too.

6.3 Choose the server yourself

Your computer moves to another server of ours only when that one has answered clearly faster for a couple of minutes, and it waits for a quiet moment, so that open connections are not cut. If its server stops answering, it moves at once.

To hold it to one server, on macOS and Linux:

sudo hulyscale exit entry    # hold to the entry
sudo hulyscale exit exit     # hold to the exit
sudo hulyscale exit auto     # let your computer choose again

On Windows, the same in a terminal opened as administrator, without sudo.

The command takes effect at once, without a restart. While that server cannot be reached, your computer uses the other, and comes back when it answers again. The command is still called exit: it names the server of ours that carries your traffic.

Check: hulyscale status says via entry or via exit, and on the next line why: pinned to entry, or by measurement. hulyscale peers shows the server in use with the path direct. If it says relay, your traffic makes a detour through another server of ours: send us a report. curl https://ifconfig.me; echo prints the exit’s address either way: sites outside Russia see the exit.

In a version installed before 12 November, hulyscale exit takes effect only after sudo hulyscale stop and sudo hulyscale start, and it does not know auto: install the new version first (the note at the top of this page).

7 Tell us how it went

hulyscale report --private > hulyscale-report.txt

On Windows, in a terminal opened as administrator:

hulyscale report --private | Out-File -Encoding utf8 hulyscale-report.txt

Send us the file in the testers’ chat, with a few words:

• where you were: home, mobile, work, a café;
• whether you used the exit or the entry;
• what worked and what did not, and when it happened;
• if it got slow or stopped: roughly when.

8 If something goes wrong

• “This invite code is not valid”. Take the current one from the testers’ chat: each wave of testers gets its own.
• “The server takes no more testers”. Write to us in the chat.
• No Internet after HulyNet crashed. It restarts by itself within seconds: give it half a minute. If it does not, sudo hulyscale stop gives you your own connection back (on Windows, hulyscale stop in a terminal opened as administrator).
• hulyscale status says network none. Run the install line again, with the code: it installs nothing twice and connects your computer again.
• hulyscale peers shows no connection to our servers. Send us a report: that is what we test.
• macOS says that iCloud Private Relay is off. That is expected while HulyNet carries your traffic (see “Install and join”).
• Windows: “Access is denied”, or hulyscale is not recognized. Use a terminal opened as administrator, and a new one after installing: the installer adds HulyNet to the path of new windows.
• Anything else: write to us in the testers’ chat.

9 Files, for installing by hand

The installer above downloads the right one of these for your computer. Each archive carries the configuration for this server. To install by hand, unpack it and run sudo hulyscale/install.sh --system on a Mac, or sudo hulyscale/install.sh on Linux; on Windows, in a terminal opened as administrator, powershell -ExecutionPolicy Bypass -File hulyscale\install.ps1 -Config hulyscale\hulyscale.toml. Then run the install line above with your code, which connects it.

Checksums: SHA256SUMS. The installers themselves: install.sh, and for Windows get.ps1.