Support EasyTier endpoint via official easytier-go host

Feature request

Would you consider adding an EasyTier endpoint backed by the official Go embedding library, EasyTier/easytier-go?

Why revisit this now

This was previously requested in #4184 and closed as not planned on June 20, 2026.

There is a material change since then: the official EasyTier/easytier-go repository was created on July 26, 2026. It embeds easytier-core in a pure-Go process through wazero/WASM rather than cgo, which seems to make integration into sing-box substantially more practical than before.

The current public API exposes, among other things:

• typed EasyTier instance configuration;
• network name/secret, virtual IPv4, peers and listeners;
• IPv4/IPv6 STUN servers;
• P2P policy and hole-punching methods;
• SendPacket / ReceivePacket;
• Dial, Listen, and ListenPacket using standard Go interfaces;
• peer and route inspection.

It also includes a cross-platform TUN example that joins an existing EasyTier network and forwards raw IPv4 packets through the embedded core.

Use case

The main motivation is to let sing-box be the single VPN/TUN process while also participating as a real EasyTier peer.

For example:

sing-box
  ├─ normal Internet traffic -> existing sing-box routing/outbounds
  └─ EasyTier private routes -> EasyTier endpoint
                                -> EasyTier Core
                                -> P2P / NAT traversal / relay

This is particularly useful on Android/iOS, where running a separate EasyTier VPN alongside a sing-box-based VPN is awkward or impossible because only one system VPN tunnel can normally be active at a time.

This would be closer to the existing integrated Tailscale endpoint model than to routing through an external WireGuard/EasyTier gateway: sing-box itself would participate in the EasyTier mesh and could use EasyTier's own P2P/hole-punching logic.

Possible direction

Conceptually, an endpoint could look roughly like:

{
  "type": "easytier",
  "tag": "easytier",
  "network_name": "office",
  "network_secret": "...",
  "ipv4": "10.144.0.10/24",
  "peers": [
    "udp://example.com:11010"
  ]
}

The exact schema and implementation would of course be up to sing-box. The interesting part is that easytier-go now provides both raw packet APIs and standard Go network interfaces, so it may fit the endpoint abstraction without reimplementing the EasyTier protocol.

Caveats

easytier-go is still young, so there are reasonable concerns around WASM/wazero overhead, binary size, mobile behavior, UDP edge cases, and whether hole punching has full parity with native EasyTier on every platform. I am not assuming those are already solved.

The question is mainly whether this new official embedding layer changes the feasibility enough for an EasyTier endpoint to be considered now.

References:

• Previous request: #4184
• EasyTier Go host: https://github.com/EasyTier/easytier-go
• EasyTier: https://github.com/EasyTier/EasyTier

Start by reviewing the referenced easytier-go API and sing-box’s existing integrated Tailscale endpoint model, then assess the stated mobile, WASM/wazero, and packet-interface caveats. Done would mean an agreed endpoint scope and schema, with implementation and validation criteria established for the relevant platforms.