No, and that is the point. Devices join a Wi-Fi network. Everything — routing, data limits, the proxy tunnel — happens on the board. Nothing is installed on the client, ever, and there is nothing to configure. That includes devices you cannot install anything on: TVs, consoles, printers, cameras.
10–20 Mbit/s routing plainly, 3–12 Mbit/s through the tunnel, depending on the chip. See the table.
Enough for browsing, messaging and HD video on a couple of devices. Not enough for a household of streamers. A microcontroller is doing the encryption.
Around 8–10 can associate. How many can be active at once is a different question, and depends on PSRAM: roughly 1–3 without it, 3–5 with it. The Wi-Fi limit is rarely what you hit first.
An ESP32-S3 with 8 MB PSRAM (N16R8). About $8. Full comparison.
Only on the ESP32-C5, which is the one chip in the family with a 5 GHz radio. Everything else is 2.4 GHz only — a hardware fact, not a firmware limitation.
Working: VLESS and Trojan, over TLS or WebSocket.
Parsed but not connectable yet: Shadowsocks and VMess. Their links import and show in the list marked "not supported yet". Trying to use one fails cleanly rather than quietly sending your traffic out unencrypted.
Not supported: REALITY and XTLS. They need a custom TLS handshake that is a research project on this hardware, and it would be dishonest to list them as coming soon.
Yes — that is one of the more useful things here. Each account has its own routing policy: tunnel, direct, or blocked. The TV goes direct, the laptop goes through the tunnel, the guest is capped at 2 GB, all at the same time on the same hotspot. No phone VPN app can do that.
By default, traffic stops. That is the kill switch, and it is on because a leak you do not notice is worse than an outage you do. You can turn it off in Proxy if you would rather fall back to a direct connection.
Yes, if they try hard enough, and it is better that you know how.
Accounting works because devices use the DNS server this router hands them. A device that is deliberately configured to use a different resolver — typing in 8.8.8.8, or turning on DNS-over-HTTPS — gets real addresses and reaches the internet through plain NAT, without passing through the part of the router that counts bytes.
That is not something anyone does by accident, and a guest joining your hotspot will be measured correctly. But if you are metering people who have a reason to want more than their share, treat the numbers as a measure of ordinary use, not as a boundary that holds against someone working around it.
The mitigation that works today: give them an account with its routing policy set to proxy, and leave the kill switch on. A client that skips DNS then ends up connecting to a raw IP address, and those are refused rather than quietly routed.
Filtering that traffic properly is on the roadmap.
Yes. Every byte crosses the router's relay and is counted there — it is not sampled or estimated.
Two honest caveats. Counters are written to flash periodically rather than continuously, so a power cut can lose the last few tens of megabytes; that is deliberate, to avoid wearing out the flash. And a device whose account has no MAC address set cannot be matched, so nothing is billed to it.
Applications that connect to a raw IP address without a DNS lookup are refused rather than routed around the tunnel. That is the safe failure: routing them around would leak exactly the traffic you asked to tunnel. Set that device to direct if you want it to work.
No. Settings, accounts and counters live in a separate flash area that updates never write to. Use --erase when you actually want a clean board.
Reflash with --erase. There is no recovery password and no back door.
Not in this release. The classic ESP32 has the hardware for it — a built-in Ethernet MAC, which no other chip in the family has — and support is on the roadmap.
Yes. Leave the tunnel off and it is a Wi-Fi router with per-user data limits. That is a complete, useful product on its own.
The firmware is published as binaries under the MIT license. The source lives in a private repository at DibaChain.
They are captures of the actual panel — the same HTML the firmware serves, rendered in a real browser against the real API. Not mockups.