Open-source internet freedom tool
Share secure internet with the people you care about
One command sets up a proxy server that is hard to tell apart from ordinary HTTPS, with the firewall, TLS, and routing configured for you. Share access with a link or QR code.
What your friends receive — see the demo
Two commands to a working proxy
You need a Debian or Ubuntu VPS (a $5/month one is enough) and a terminal on your computer. Meridian sets up the rest.
curl -sSf https://getmeridian.org/install.sh | bashmeridian deployThe wizard asks for your server IP and handles the rest. Or pass flags directly — see the CLI reference.
What happens behind the scenes
Build your command
Pick options and copy the full command. Covers deploy, relays, checks, SNI scans, diagnostics, and teardown.
Deploy Reality, XHTTP, and Hysteria2 on one server. Sets up Docker, the Remnawave panel, nginx, the firewall, and TLS.
meridian scan to find a same-network target.meridian deploy
meridian deploy — the interactive wizard guides you through everything.How it avoids detection
OpenVPN and WireGuard have recognizable traffic signatures. A VLESS+Reality connection is hard to tell apart from ordinary HTTPS to a real website.
Deep Packet Inspection (DPI)
DPI analyzes traffic patterns to identify proxy protocols. OpenVPN and WireGuard have handshakes that are easy to recognize and block.
VLESS+Reality runs inside a standard TLS 1.3 connection on port 443, so DPI sees what looks like ordinary HTTPS to the camouflage site. Every server also offers XHTTP and Hysteria2, so a block on one method leaves the others working.
Active probing
Censors connect to suspicious servers and try to fingerprint them. If a server responds differently than the website it claims to be, it gets blocked.
Reality borrows the TLS identity of a real website: by default a site hosted near your server, or www.google.com. A probe without your key is passed through to that site and sees its genuine certificate. Only clients with your key get the proxy tunnel.
TLS fingerprinting
Every TLS client sends a unique "Client Hello" fingerprint. Censors flag connections where the fingerprint doesn't match the claimed application.
Client apps use uTLS to send the same Client Hello as Chrome. Meridian also publishes a Firefox copy of each Reality and XHTTP entry, so if censors flag one fingerprint, the other keeps working.
Scan and go
After deploying, you get a connection page with QR codes. Send it to whoever needs it — they tap once and connect.
Connection pages list these apps first and link others for each platform. See the demo.
Under the hood
Standalone mode (no domain)
nginx owns TCP port 443 and routes connections by TLS SNI with its stream module. Reality connections go to Xray. Everything else reaches nginx's http module, which serves the connection pages, subscriptions, and XHTTP over HTTPS with a short-lived Let's Encrypt certificate for the server's IP (issued by acme.sh). Hysteria2 listens on UDP 443 with salamander obfuscation.
The Remnawave admin panel is reverse-proxied by nginx on a secret path — accessible via HTTPS, no SSH tunnel needed.
Domain mode (CDN fallback)
With --domain, nginx gets a Let's Encrypt certificate for your domain and routes that SNI to the domain's paths. XHTTP moves to the domain andVLESS+WSS is added. With Cloudflare proxying the domain, both travel through the CDN and keep working if your server's IP is blocked. The panel and connection pages stay on the IP certificate.
Relay mode (domestic entry point)
A Realm TCP forwarder on a server inside your country passes connections to your exit abroad. Relays carry Reality only; XHTTP, WSS, and Hysteria2 still connect to the exit directly. Encryption runs end to end between the app and the exit, so the relay never sees plaintext.
Add one with meridian relay add RELAY_IP --exit EXIT. Subscriptions and connection pages pick up the relay entries automatically.
Ready to get started?
Install Meridian, deploy to your server, and share access with the people who need it. A deploy usually takes 3 to 10 minutes.