Gonc

中文说明

Point-to-point secure file transfer and VPN tunneling for desktop and Android.

Gonc helps two devices find each other with a shared passphrase. On the same LAN, peers can quickly discover each other and connect directly over the local network. Across different networks, Gonc uses NAT traversal and hole punching to establish a peer-to-peer direct connection. No account, no cloud upload, no file size gate. Gonc also includes a VPN mode for building an encrypted tunnel between your own devices.

Features

• Send files and folders directly - Share multiple files or whole directories between desktop and Android.
• No accounts - A shared passphrase is enough to connect both sides.
• End-to-end encrypted - Traffic is protected by TLS 1.3. The TLS certificates are automatically derived from the shared passphrase and mutual authentication is mandatory, so no CA certificate is required and man-in-the-middle eavesdropping or tampering is prevented.
• True P2P when connected - A successful transfer uses a real peer-to-peer connection. Gonc does not provide an official relay service by default.
• Reliable receive mode - Browse the remote file list, download everything or selected paths, and resume interrupted downloads with BLAKE3 block repair.
• Android and desktop UI - The same workflow is available on Windows and Android.
• Easy VPN deployment - Run gonc -p2p <passphrase> -linkagent on many device architectures, then connect remotely from the desktop or Android VPN client.
• IPv4 and IPv6 aware - VPN mode supports IPv6 routing checks and DNS leak protection options on Windows.

Download

Download the latest build from GitHub Releases.

Release packages are named like:

On Windows, keep gonc-gui.exe and wintun.dll in the same folder when using VPN features.

How It Works

1. The sender chooses files or folders and starts sharing.
2. Gonc generates or accepts a passphrase.
3. The receiver enters or scans the same passphrase.
4. Both sides exchange encrypted connection information over public MQTT signaling servers.
5. Gonc tries NAT traversal and starts the transfer after a real P2P connection is established.

The signaling server is only used to help both peers meet. It cannot see the passphrase and cannot decrypt the exchanged network information.

If both peers are behind restrictive IPv4 NATs, NAT traversal may fail. In that case, use a SOCKS5 proxy server as a relay path.

NAT Traversal Support

If both peers have IPv6 connectivity, direct P2P connection is usually the easiest case.

For IPv4, NAT traversal behavior depends on the NAT type on each side:

Gonc's expected IPv4 traversal support:

Send Files

Desktop send-content capabilities:

The single Add button opens a four-option picker for File, Folder, Text, and Clipboard. Files and folders can also be added by drag and drop. Each list row has its own remove control, and Clear all empties the whole list. Changes made while a send session is running are synchronized with the receiver, including an empty list after the receiver refreshes.

1. Open Send Files.
2. Add the content to share.
3. Use the generated passphrase, or enter your own strong passphrase.
4. Share the passphrase or QR code with the receiver through a trusted channel.
5. Keep the sender running until the receiver finishes.

Receive Files

1. Open Receive Files.
2. Enter or scan the sender passphrase.
3. Choose the save folder.
4. Connect, browse the remote directory, then download selected files or the current folder.

Resume mode validates local blocks with a BLAKE3 manifest before reusing them. For interrupted downloads, Gonc resumes from the last verified complete block instead of blindly trusting the local file size.

After a received file exists as a readable regular file and its size matches the current remote listing, the receive list marks it as locally available. This is a convenience check, not a content-integrity guarantee. On desktop, the row's locate button reveals the file in Explorer, Finder, or the platform file manager; Gonc does not open received files directly on desktop.

On Android, locally available files can be opened, opened with another app, shared, or inspected from the current receive session. These actions are not saved as download history across app launches. Opening an APK hands it to Android's package installer, which controls unknown-source authorization and installation confirmation; Gonc does not install packages silently.

VPN Tunnel

Gonc can also run a VPN tunnel between devices. Deploying the server is meant to be simple: on a remote device, run:

gonc -p2p <passphrase> -linkagent

Then connect to it from the desktop or Android VPN client.

• VPN Server runs a linkagent endpoint and can expose this device as the traffic exit.
• VPN Client connects to the server and can start a system VPN interface.
• Profiles can be saved and shared by QR code.
• Advanced options include DNS servers, route CIDRs, MTU, route metric, upstream proxy, tunnel-only mode, and extra gonc arguments.

On Windows, VPN client mode may request administrator permission so it can configure routes and DNS protection.

Privacy And Security

• Gonc does not require user accounts.
• File data is transferred only after the TLS 1.3 secure connection is established. Even when a SOCKS5 server is used as a relay path, it only sees TLS-encrypted traffic and cannot read or tamper with file contents.
• The shared passphrase is the connection secret. Anyone who has it can connect and receive your shared files, so use the randomly generated high-strength passphrase each time and do not reuse passphrases that have already been shared.
• Gonc derives the TLS certificates from the passphrase and requires mutual authentication, so no CA certificate is required.
• Gonc uses public third-party STUN servers to discover NAT addresses and public MQTT servers for signaling. Peers meet on MQTT using a passphrase-derived hash, and network addresses are exchanged as AES-GCM encrypted data derived from the passphrase. MQTT servers cannot see the passphrase or decrypt the exchanged addresses.
• File repair uses BLAKE3 block hashes to avoid trusting stale local data.

Public servers used for STUN and signaling:

STUN:
tcp://turn.cloudflare.com:80
udp://turn.cloudflare.com:53
udp://stun.l.google.com:19302
stun.gonc.cc:3478
global.turn.twilio.com:3478
stun.nextcloud.com:443

MQTT:
tcp://broker.hivemq.com:1883
tcp://broker.emqx.io:1883
tcp://test.mosquitto.org:1883
tcp://mqtt.gonc.cc:1883

Troubleshooting

Windows App Does Not Open

Gonc uses Microsoft Edge WebView2 through Wails. If the app does not open, install or repair the Microsoft Edge WebView2 Runtime.

Android VPN Stops In The Background

Android may restrict long-running background work. Allow Gonc to ignore battery optimization or set the app battery mode to unrestricted.

Transfer Cannot Connect

• Make sure both sides use the exact same passphrase.
• If both sides are behind type 4 / Symmetric NAT, configure your own SOCKS5 proxy server with UDP ASSOCIATE support so Gonc can use it as the relay path.

Development

The desktop app is built with Wails and embeds the gonetcat Go engine. The Android app uses a gomobile-generated mobilegonc.aar built from the sibling gonetcat checkout.

Rebuild the Android Go bridge after changing ..\gonetcat:

android\update-mobilegonc-aar.bat

Create release packages:

release.bat

Project Layout

gonc-gui/
  app.go                    Wails backend methods exposed to the frontend
  frontend/                 Desktop React UI
  internal/goncrunner/      Embedded gonc session runner
  internal/httpdownload/    Desktop HTTP receive downloader
  android/                  Android app
  android/update-mobilegonc-aar.bat
                            Rebuild Android mobilegonc.aar from ../gonetcat

License

See LICENSE.