Zero Layer VPN

Privacy-first Android VPN. No ads, no tracking, no crippled free tier.

Comment

Inspiration

We built ZeroLayer VPN out of genuine admiration for privacy pioneers like Proton VPN, but with a realization that the current VPN market has become prohibitive. Most commercial solutions charge upwards of $\$10$ to $\$15$ per month, bundling massive software suites when millions of everyday users simply want an affordable, developer-friendly, privacy-focused tunnel.

When calculating the unit economics of hosting bare-metal VPN nodes, bandwidth and server infrastructure present a real financial hurdle:

$$\text{Cost}{\text{infrastructure}} = \sum{i=1}^{N} \left( C_{\text{base}} + \beta \times \text{Bandwidth (TB)}_i \right)$$

Rather than turning to intrusive ad networks or selling user telemetry, we chose radical transparency:

  1. An open, permanently free tier powered by publicly disclosed OpenVPN relay configurations.
  2. A high-speed, affordable Pro tier utilizing next-generation WireGuard to cover dedicated server operations.

The Heart Behind the Design

The greatest inspiration for this project was my 23-year-old sister. She is deaf and mute, with immense creative talent that the traditional world often overlooks. We encouraged her to study UI/UX design, and ZeroLayer VPN is her very first production project. Seeing her interfaces come to life and reach real users worldwide was the ultimate driving force, and the experience even helped her land a position at an NGO!

What it does

ZeroLayer VPN establishes an encrypted tunnel between your device and the internet, masking your digital fingerprint and protecting you from public Wi-Fi eavesdropping, ISP tracking, and geo-restrictions.

  • Dual-Engine Connectivity: Choose between battle-tested OpenVPN for widespread firewall penetration and WireGuard for high-speed, low-latency streaming and gaming.
  • Per-App Split Tunneling: Selectively choose which applications route through the encrypted tunnel and which bypass it directly to preserve local network speeds:

$$\text{App Routing: } T_{\text{app}} \in { T_{\text{tunnel}}, T_{\text{bypass}} }$$

  • Sustainable Subscriptions via RevenueCat: Features a built-in 30-day free trial and flexible Monthly and Annual Pro plans, unlocking dedicated WireGuard nodes and advanced routing instantly.

How we built it

  • UI & Client Architecture: Built with Flutter (Dart), utilizing a reactive Provider state management pattern, custom Material 3 widgets, and responsive layouts structured directly from my sister's design specifications.
  • Native Network Engines:
    • WireGuard: Integrated via a custom vendored wireguard_flutter_plus package directly interfacing with com.wireguard.android:tunnel over JNI for near line-speed throughput:

$$\text{Latency}{\text{WireGuard}} \ll \text{Latency}{\text{OpenVPN}}$$

  • OpenVPN: Bound to Android's native VpnService interface to handle .ovpn profiles and automatic handshake retries.
    • In-App Purchases & Monetization: Powered by the RevenueCat SDK (purchases_flutter v9.0). We created a decoupled SubscriptionService that listens to broadcast customer-info streams, reconciles entitlements, displays live Google Play pricing, and manages the 30-day trial lifecycle.
    • Authentication & Identity: Built on Firebase Auth and Firestore with an anonymous-first architecture, seamlessly re-identifying guest tokens to permanent user IDs.

Challenges we ran into

  • Dual-Protocol Coexistence in Android's VpnService: Android strictly permits only a single active VPN tunnel interface at any given instant:

$$V_{\text{OpenVPN}} \cap V_{\text{WireGuard}} = \emptyset$$

Managing smooth transitions between an OpenVPN socket and a native WireGuard kernel/Go backend without orphan sockets, memory leaks, or ANR crashes required building custom teardown hooks and connection reconcilers on app lifecycle events.

  • Anonymous-to-Identified RevenueCat Sync: Ensuring an anonymous user can start a trial or purchase a subscription, and later link that entitlement seamlessly when signing in with Firebase Auth without losing their active entitlement:

$$\text{ID}{\text{anonymous}} \xrightarrow{\text{Purchases.logIn()}} \text{ID}{\text{Firebase}}$$

  • Hospitalization & Physical Limits: Between working a full-time engineering job, managing 4 hours of sleep a night, and rushing to meet the deadline, my health gave out and I was hospitalized mid-development. Coming out of the hospital with the Ship-a-thon deadline right around the corner was daunting, but seeing my sister's design waiting to be launched gave me the resolve to debug the remaining cipher negotiations and finish the build.

Accomplishments that we're proud of

  • Officially Live on Google Play! ZeroLayer VPN is published in production on the Google Play Store.
  • Honoring My Sister's Work: Her designs are now touching the lives of people around the world, proving that disability is never an obstacle to creating beautiful software.
  • Rock-Solid Handshakes: Early beta testers and friends reported immediate WireGuard handshakes, clean reconnects, and no battery drain.
  • Ethical Monetization: Proving that indie developers can build essential privacy utilities that sustain server costs through RevenueCat without having to sell user data:

$$\text{Revenue}{\text{Pro}} \ge \text{Cost}{\text{server}} + \text{Cost}_{\text{bandwidth}}$$

What we learned

  • Mobile systems networking requires rigorous lifecycle handling cross-platform wrappers cannot hide the complexities of platform network sockets and OS-level routing rules.
  • Integrating RevenueCat saved weeks of complex server-side receipt validation, Google Play Real-Time Developer Notifications (RTDN), and billing edge cases.
  • Purpose fuels perseverance: having a heartfelt reason to build changes fatigue into focus.

What's next for Zero Layer VPN

  • BYOC ("Bring Your Own Config"): Allowing power users to import their own custom .ovpn files or WireGuard keys to use ZeroLayer VPN as a clean, battery-efficient client.
  • Global Node Expansion: Deploying RAM-only bare-metal WireGuard nodes across 15+ new countries.
  • Free Tier Split Tunneling: Making per-app split tunneling permanently free for all users.
  • V2 Redesign: Incorporating my sister's latest design iterations inspired by modern minimalist interfaces.

Built With

Share this project:

Updates

Submission history