Documentation

About

Lane is a native connectivity client. Each operating system has its own app. Lane does not use Electron or Flutter.

Settings has two choices. Unser Server (lokal) starts the Lane server on this computer and uses 127.0.0.1. Unser Server (extern) dials a hostname and port. The default host is us-central1-lane-client.cloudfunctions.net. A saved external address of 127.0.0.1 is rewritten to that name. Settings may show the current IPv4 beside the name; the connection uses the hostname. That choice does not start a server on this computer.

Server banner

On Linux, macOS, or Windows the terminal server prints two addresses. Type the external line into the phone when the phone is away from that network. Type the LAN line when the phone is on the same Wi-Fi. An IPv6 address is printed with brackets.

The desktop app on the same machine uses 127.0.0.1 and that port. Add --once to print the banner and exit after the port check. Leave it off to keep serving.

UDP 443

The default MASQUE port is UDP 443. A machine that cannot bind that port can set listen_port in server.toml. DNS views listen on dns_port, that port plus one, and that port plus two: none, malware, and malware plus adult content. If UDP on the MASQUE port is not reachable from the internet, the banner says so. The router must forward that UDP port before the external address will work.

Servers

Local is the MASQUE and DNS program on this computer. On Linux and macOS that program is the terminal binary. On Windows, Verbinden starts it, and the launcher can boot a small Linux guest that prints the address to type on the phone. The desktop app uses 127.0.0.1.

External is a hostname and port. Connect does not start a server on this computer. The default host is us-central1-lane-client.cloudfunctions.net, and Lane dials that name rather than a stored IP. You can replace it with the hostname of a Lane server you already run. DNS-over-HTTPS is https://us-central1-lane-client.cloudfunctions.net/doh with family set to none, malware, or malware_and_adult.

Family filter

The row is labeled "Familienfilter". Each choice selects a view on our DNS server.

• None — unfiltered DNS.
• Block malware — a malware blocklist.
• Block malware and adult content — malware and adult-content blocklists.

Windows launcher

The launcher prints the same two addresses, then boots a Linux guest with QEMU on the Windows Hypervisor Platform when %LOCALAPPDATA%\Lane\guest.qcow2 and runtime/bin/qemu-system-x86_64w.exe are present. Linux and macOS keep the native terminal binary. A Windows user who does not want a guest can still run that binary.

Program guard

Lane Buddy watches every program start and stop and keeps the ones you denied from running. A rule matches a path, a file name, a Windows package family, a macOS app bundle, or a file hash. On Windows a name rule is written to Image File Execution Options, so the start is refused before a process exists, and a kernel trace closes any other denied program the moment it starts. On Linux, fanotify denies the exec with root. On macOS the process list is read ten times a second and a denied program is killed within about 100 ms, until the Endpoint Security extension replaces that.

After 48 hours of watching you can confirm the allow list: from then on only programs that ran during the watch may start. Everything shows on the dashboard at http://127.0.0.1:8754: Dashboard, Monitor, Protocol, Rules, and Settings, over today, 2 days, 7 days, 30 days, or all time.

Community feed

With the feed on, Lane Buddy pulls rules other installs reported every five minutes and keeps them beside yours; your own rules always win. A report carries the rule, the platform, and a hash of a random install id. A rule reaches everyone once three installs reported it or once it is approved by hand. The feed is off until you turn it on.

MASQUE

The first tunnel mode is Traffic and DNS (UDP). Device traffic goes through MASQUE, which is HTTP/3 CONNECT-IP, and DNS travels as UDP inside that tunnel.

The protocol is RFC 9484, CONNECT-IP.