ranet3 is presented by its maker as a high performance, policy routed IPsec mesh SD-WAN. It was shared on Show HN in 2026, where it received 40 upvotes on Hacker News.
The vendor lists the stack as userspace ESP (RFC 4303) in tunnel mode over UDP, IKEv2 (RFC 7296) with hybrid ML-KEM (FIPS 203) key exchange, an embedded Babel speaker with RTT metrics and source-specific routes, and SRv6 steering by source and destination prefix. Peers only need standard IKEv2, ESP, Babel and SRv6.
Babel measures the round trip of every link and routes through a relay whenever the direct link is slower, while policies on source and destination prefixes send traffic through chosen waypoints and out at chosen exits.
The vendor reports benchmarks of 1.2 to 1.5 times wireguard-go throughput and 1.91 to 4.96 ms RTT p99 under saturation, claiming higher throughput than kernel WireGuard, wireguard-go and kernel IPsec in all of its own 10 GbE tests. The code is source available and becomes Apache-2.0 after two years, per the vendor.
