MultiOBXWhat you do online is your business.
Your ISP sees the addresses you reach for. Whoever runs the Wi-Fi sees the same. MultiOBX puts a server of ours between you and the network: traffic leaves the device encrypted, and what goes out to the network is the server's address.
In exchange you move your trust from the ISP to us. Below: what we know about you, what we do not, and what you can check for yourself.
Barrier
The firewall closes everything except the tunnel and our server's address — before a network adapter even exists. A dropped link does not open the network. Off by default; turn it on in the settings.
Tunnel
WireGuard. Everything that is not DNS goes inside it, encrypted. Your ISP sees only the connection to our server — no addresses, no site names.
DNS
Name queries go through a separate layer of rules: only the resolver inside the tunnel and 127.0.0.1 are let out, even if you allowed the local network. Otherwise the router would hand them to your ISP.
The network stays closed until the tunnel is up
Select a layer
Where the traffic goes
Who sees what
Your ISP sees that you connected to our server, and nothing else: no addresses, no site names. The site at the far end sees the server's address, not yours. Names are resolved inside the tunnel, by a separate layer of rules.
Changing networks
The handshake fits into a single exchange of packets: the connection comes up in a fraction of a second and survives a move from Wi-Fi to mobile data — the tunnel carries on from where it was.
Getting started
Get a key
The "Create a key" button issues 24 characters and shows them once. No form to fill in, no e-mail to confirm.
Pay for time
Days go onto the key — by card, SBP or voucher. There is no subscription: when the days run out, the tunnel stops coming up.
Install the app
The key is entered once. Up to 5 devices hang off it; each gets its own address inside the tunnel and its own WireGuard key pair, and the private half never leaves the device.
What the server knows about you
There is no account
Instead of an e-mail and a password — a 24-character key.
We do not store the key
It cannot be recovered from the database record — not by you, not by us. You pay the price: lose the key and the paid days go with it; if a server moves or a hole turns up, we can only write to you personally if you signed in to the Telegram bot with your key.
Stored in the database
- A digest of the key. Not the key itself.
- The public keys of your devices and their addresses inside the tunnel.
- The date your paid time ends, down to the hour.
- Order numbers, if you placed any.
Stored nowhere
- Name, e-mail, phone. There is nowhere to enter them.
- A password. It does not exist.
- Browsing history. The servers keep no connection logs.
- Your computer's name. A device gets a name from a word list.
Through the tunnel you are still you. Sign in to your mail and the site knows you by your login; no address changes that.
If you do not take our word for it
The rules sit in the Windows Filtering Platform and are printed by netsh wfp show filters, and "Diagnostics" in the app shows how many rules are in place, which DNS is in use and when the handshake was.
What that does not undo
Your ISP still sees the timing and the volume of the connection to us. That pattern sometimes gives away what you are doing. The word "anonymous" will not appear here.
The key digest
HMAC-SHA256 of the key, with the secret in a separate file on the server. At sign-in the digest is computed again and compared with the stored one. A stolen database signs nobody in; a lost key cannot be recovered, by us either.
Where this does not work
- Hyper-V and WSL
- Hyper-V virtual machines and WSL have their own network stack, and Windows rules do not reach it. Traffic from there can go around the tunnel.
- The first seconds after boot
- Until the service is up there are no rules. Persistent rules that apply from system boot are something we have not built yet.
- Android and iOS
- Both systems let a share of their own service requests bypass any tunnel: connectivity checks, time, a few services. That is a platform limit, and nobody gets around it.
What it costs
Paid days go onto the key, and no name is attached to them. Nothing is charged automatically: when the days run out the tunnel stops coming up. The one place we can warn you in advance is the Telegram bot, if you signed in to it with your key — we have no other address for you.
Until you sign in with a key, the link opens the sign-in page first.
A key is issued without a form and without an e-mail.
Press the button and see what comes out. How much time to pay for, decide afterwards.