Self-hosted network orchestration
Every hop,
under control.
Turn the VPS hosts and proxies you already have into multi-hop routes. Catboat checks each route before it goes live, verifies it afterwards, and counts each subscriber's traffic only once.
- Self-hosted
- No inbound management port
- Open-source agent and engine
- In development
-
Subscriber device
- SS2022 · per-device key
-
vps-a entryeast-asiacatboat-agent ✓metered here, once
- encrypted link · not metered38 ms
-
vps-b relaywest-uscatboat-agent ✓
- SOCKS521 ms
-
socks-us-01 exitTCP verified exit IP verified
-
Internet
How it works
Hosts you control. Nodes you don't.
Plans routes, deploys them and keeps the meter. Your traffic never passes through it.
Runs on each of your VPS hosts and connects out over mTLS, so there's no port to open.
Carries the traffic, and it's open source: built from sing-box's source code and released under GPL-3.0-or-later. Every build Packet Boats signs ships with its full source, and the code is on GitHub.
Any proxy the engine can connect to. Catboat tests it but doesn't manage it.
Subscribers connect with SS2022, VLESS + Reality or Hysteria2. Between nodes, you pick the protocol for each hop, and UDP gets through when every hop supports it.
IPv6 works where your hosts have it. Probes check each host, and you choose which entries and host-to-host links use it. Exits stay on IPv4 for now, so every route blocks IPv6 at the exit and in the built-in client configs, and nothing leaks around the route.
Protocols and capability checks
| Tier | Subscriber entry | Between your hosts | To an external node |
|---|---|---|---|
| GA | SS2022, VLESS + Reality, Hysteria2 | SS2022, VLESS + Reality, Trojan + TLS, Hysteria2 | SOCKS5, HTTP, Shadowsocks |
| Preview | Other inbound protocols | Anything else both ends support | Other outbound protocols |
Links between your hosts are always encrypted. If a hop to an external node is plaintext, you'll see a warning before you publish. Preview protocols stay off until you turn them on.
unknowntreated as unsupportedverifieda probe passeddeclareddeclared by an operator, flagged in the planfalseruled out
Probes run from the host that will actually connect to the node, and you can override any result.
Route Studio
Build it on a canvas. Review it like code.
Drag nodes onto the canvas and they link up into a route. Nothing goes live until you've looked at the diff and applied it as a new revision.
Resources
History
Reverting opens an old revision as a new draft. Apply it and it becomes the next revision, so history is never rewritten.
- 01
Draft
Drag nodes in or fill in the form. Saving a draft never deploys it.
- 02
Validate
Every node and link gets checked, and errors point to exactly where the problem is.
- 03
Review
See the diff, which hosts will reload, and whether the exit IP changes.
- 04
Apply
The exit changes first and the entry last. If someone else applied first, you re-plan on top of theirs.
- 05
Verify
A route only goes live once a probe makes it through the real path. If that fails, it rolls back.
The route definition behind the canvas
The canvas, the form and catboatctl all edit the same route definition. Every revision keeps a copy, and diffs and plans are generated from it. Secrets never go in it.
access: kind: shadowsocks-2022-managed nodeRef: vps-a-ingress hops: - nodeRef: vps-b-relay link: protocol: vless tls: reality - - nodeRef: socks-us-01 + - nodeRef: ss-us-02
Just an example. The format isn't final.
Subscribers
Share routes with people. Give every device its own key.
Every device gets its own key, so revoking one doesn't touch the others.
Subscribers get a portal where they can check their routes, usage and quota, and add or remove devices up to the limit you set.
They can download sing-box or mihomo configs, and each device imports its own subscription URL or QR code.
A subscriber's devices form one device group. You decide when its URLs expire, or let them run forever, and one click rotates every URL in the group.
If a subscription URL leaks or gets shared, the alert names the device. Reissue its URL or revoke it, and the other devices keep working. By default, nothing is blocked automatically.
- this period
- 41.2 / 100 GiB
- resets
- 2026-11-01 00:00 UTC
- routes
- US Westnormal
- device group
dg7qnever expires- devices
- 2 / 3
- ipad-2
…/sub/dg7q/dv3f/••••••Reissue URLRevoke - obs-pc
…/sub/dg7q/k9m2/••••••Reissue URLRevoke
- Get sing-box config
- Get mihomo config
- Rotate device group
- Add device
Metering
Three hops. Metered once.
A subscriber's usage is counted once, where they come in. Traffic on each hop after that is tracked separately, as your cost.
Repeated reports and restarts never count the same bytes twice.
Hard quotas and expiry still apply while the control plane is offline.
Overage is designed to stay within about one second of traffic.
Security
Secure by default. Predictable when things fail.
Secure defaults
- Open-source agent and engineSee exactly what runs on your hosts
- No default passwordThe console only listens on localhost
- Signed engine buildsEach host checks the engine against a signed list
- Encrypted secretsOnly sent to the host that needs them
- Encrypted host linksThere's no way to turn it off
- Default-deny egressPlus DNS and IPv6 leak tests
- No payload captureMetadata logging stays off unless you turn it on
- Tamper-evident audit logAppend-only and hash-chained
Failure behavior
- ✗Control plane offlineRoutes keep running
- ✗Bad config publishedCurrent config kept
- ✗Post-deploy path check failsRolled back
- ✗External exit unavailableDegraded, no unapproved fallback
Failure behavior in detail
- Control plane offline
- Connections keep working, and the agents enforce quotas and expiry on their own. The portal and subscription URLs come back with the control plane.
- Offline past the credential refresh window
- New connections are still allowed by default. You can choose to refuse them after a set number of hours.
- Bad config published
- The engine's config check rejects it on the host, and the current version keeps running.
- Path check fails after deploy
- Catboat rolls back to the last good config and marks the deploy as failed.
- External exit unavailable
- The route is marked Degraded. Traffic never falls back to an exit you didn't approve.
- Agent restarts
- It picks up counting from its last snapshot, so nothing is counted twice.
- Engine crashes
- At most one 10-second poll may go uncounted. It never counts extra.
- License server unreachable
- Nothing stops, because the license is checked locally.
Editions
Same software, free or licensed.
Community is free and comes with 1.0. Pro and Business are planned to go on sale with 1.1, once everything they include has shipped. There's no presale and no free trial; a single month works as one.
For trying Catboat, and for yourself, family and friends.
- 5 hosts, 10 subscribers and 50 devices
- Full route lifecycle, every supported protocol and UDP forwarding
- Every security default, including 2FA
- The last 5 revisions of each route, with rollback
- Built-in roles, 2 operator accounts and a basic audit log
- Admin API for the console and CLI, plus alert webhooks
For power users with more hosts.
Everything in Community, plus:
- 10 hosts, 25 subscribers and 125 devices
- Host packs: 5 more hosts each, up to 30 hosts
- Full route history, and a diff between any two revisions
- Unlimited operator accounts, 13 months of usage history and a year of audit log
- Scheduled speed tests with full history
- Up to 3 API tokens for reads and routine tasks
- Portal branding, automatic actions on leaks and HWID binding
For running routes for other people.
Everything in Pro, plus:
- 30 hosts, 300 subscribers and 1,500 devices
- Scale packs up to 100 hosts, each adding 10 hosts, 100 subscribers and 500 devices
- Unlimited API tokens with full access, plus integration webhooks
- Per-route usage export, usage analytics and reports
- Operator SSO and finer roles, such as read-only support staff
- 3 years of audit log, with export
- Control-plane high availability Add-on · 1.2
Every edition is the same software. The license is checked on your machine and never looks at your credentials or topology.
If a paid license runs out, it keeps working through a grace period and then falls back to Community. Nothing that's running stops: hosts, routes, subscribers, devices and traffic carry on, and you just can't add more beyond Community's limits. Paid features pause until you renew, and history beyond Community's retention is kept for 90 days.
Roadmap
The first release, and what comes after.
- Routes of up to three hops, TCP and UDP, any link protocol
- SS2022, VLESS + Reality and Hysteria2 entries
- Route Studio with revision history
- Probing, verified deploys, health checks, alerts and node-to-node latency
- Metering, quotas and device limits
- Subscriber portal, subscription URLs and routing rules
- Leak and sharing detection
- Audit log and one-click agent upgrades
- Management API for scripts and billing systems
- More entry protocols
- Backup relays and exits
- Scheduled speed tests and encrypted off-site backups
- Pro and Business go on sale
- Traffic Lens
- Control-plane high availability for Business 1.2
Only the first release is settled. 1.1 and 1.2 are planned, and nothing has a date yet.
Out of scope
Software you run, not a service you rent.
- Proxy or VPN serviceWe don't sell traffic or IP addresses.
- HostingEverything runs on servers you control.
- Upstream resale rightsWhether you can resell or share a VPS or proxy you connect is up to its provider's terms.
- Zero downtimeReloads drop open connections. The deployment preview lists the affected hosts first.
Release news
Hear when Community is out.
Catboat isn't out yet. The free Community edition will be published openly with version 1.0. Leave your email and we'll write when it's out, and after that when a new version is released. We send a confirmation first, and every email has a one-click unsubscribe link.
We use your address only for Catboat release news, and unsubscribing deletes it. We count how many news emails are opened and which links are clicked. The form uses Cloudflare Turnstile to keep bots out.
Questions, or want to tell us what you run? Write to contact@packet.boats