DEV Community: Roman Madaev

I Made AURA: A Windows 10 L2TP/IPsec VPN Client Written From Scratch in Python

Roman Madaev — Mon, 26 Oct 2026 12:51:06 +0000

For work I needed to connect to a private network over L2TP/IPsec. The VPN client built into Windows 10 refused to connect at all, and it gave me nothing to debug with: no log of the key exchange, no hint about which step failed. I went looking for another program that could do the job and found nothing suitable

This became the reason for creating AURA — a VPN client that speaks the whole protocol itself, so when something goes wrong you can see exactly where

🔐 What is it?

AURA is a Windows 10 L2TP/IPsec VPN client with its own IKEv1, ESP, L2TP and PPP stack, written in pure Python with PyQt5. The traffic goes through a Wintun virtual adapter, the driver from the WireGuard project. Nothing of Windows' built-in VPN client is used: no RAS connection, no rasdial, no Windows VPN service. The program needs administrator rights at launch, because the adapter, routes and DNS are system changes, and asks for them once through UAC

🖥️ Screenshots

⚙️ How does it work?

You enter a server, a username, a password and, when the server wants one, a pre-shared key, then press CONNECT. AURA offers the server 18 IKE proposals (AES/3DES, SHA-256/SHA-1, DH 14/5/2) and uses whichever it picks, opens one L2TP tunnel and session, authenticates with MS-CHAPv2, CHAP or PAP, whatever the server asks for, and gets its address and DNS over IPCP. The status bar and the log panel walk through every stage

The most interesting part was a bug I could not see. After a successful key exchange the server's replies were reaching the network card, but my socket received nothing. Windows hands ESP packets that arrive on UDP port 4500 to its own IPsec driver, and a user-mode socket bound to that port sees only the IKE messages. The fix was to send from an ephemeral local port: the server answers whatever port it observes

Because the program changes routes and DNS, every change is recorded before it is made, and the next launch removes whatever a crash left behind. Your credentials stay on your machine: a password and a pre-shared key are written to disk only when you tick Remember, as a DPAPI blob that opens for your Windows account alone, and they never reach the log

✨ Key Features:

🔐 Own IKEv1/IPsec Stack
Main and quick mode with a pre-shared key, NAT traversal and dead peer detection. Offers 18 proposals (AES/3DES, SHA-256/SHA-1, DH 14/5/2) and uses whichever the server picks
🧵 L2TP + PPP
One tunnel and session with keepalive, then MS-CHAPv2 / CHAP / PAP (whatever the server asks for), IPCP for the address and DNS, and MPPE where a server demands it
🛡️ Wintun Virtual Adapter
Traffic goes through a real Wintun adapter named AURA. Route all sends everything through the tunnel, or list your own networks in extraRoutes
🗂️ Connection Profiles
Several saved servers in a combo box. Password and pre-shared key are kept only on request, protected with DPAPI
🧹 Crash Recovery Sweep
Every route, DNS entry and the adapter are recorded before they change, and the next launch removes whatever a crash left behind

🗺️ Roadmap:

In-place IPsec Rekey — Renew the security association before it expires. Today the session ends when the server drops it
IKEv2 — A second protocol next to IKEv1
Certificates — Authentication beyond the pre-shared key
IPv6 — Addresses and routes inside the tunnel
Tray Icon — Live in the notification area
Automatic Reconnect — Come back after a lost link
Kill Switch — No traffic outside the tunnel while it is meant to be up
L2TP Tunnel Secret — Servers that authenticate the tunnel itself with a shared secret are refused today

🔗 Repository Link

https://github.com/m-o-z-z-i-x/AURA

I Made REGENT: An MCP Server for Configuring OpenWrt Routers Through an AI

Roman Madaev — Tue, 28 Jul 2026 22:09:03 +0000

A while ago my own OpenWrt router simply stopped passing traffic, and everything in the web interface looked perfectly fine. It took me a whole afternoon to find the cause: four separate misconfigurations, each enough to stop traffic on its own, none of them visible on the page where I had set them up

This became the reason for creating REGENT — a server that lets an AI read the entire router at once, tell you what is actually broken, and fix it in plain language, without ever touching the command line yourself

What is it?

REGENT is an MCP server that hands an AI controlled root access to an OpenWrt router. You describe what the network should do in ordinary words, and it works out which uci and ubus commands that takes, in which order, and which service has to reload before the change means anything. It handles ordinary OpenWrt configuration across network, Wi-Fi, firewall, packages and services, and goes deepest on the routed client mode scenario, where the router joins an upstream Wi-Fi network and shares that connection onward with the VPN and ad-blocking the upstream cannot provide

How does it work?

REGENT speaks the Model Context Protocol over stdin and stdout, so the AI client spawns it directly and no network ports are ever opened. It holds a single reused SSH session to the router and turns natural-language intent into ordered uci, ubus and opkg calls. Rather than dumping the raw configuration, its topology tool reads the whole router in one pass and names the specific misconfigurations that leave a router looking healthy while nothing works

Every change is guarded on two fronts. A three-level access gate keeps reading always available, while writes need an explicit gate and destructive actions need a separate confirmation on each call. And before any risky change, the configuration is snapshotted and a deferred restore is armed on the router itself — if connectivity is confirmed afterwards the restore is cancelled, and if it is not, the router puts itself back on its own

Example diagnosis:

UPLINK   wwan via phy1-sta0, 192.168.1.4/24, gateway 192.168.1.1
SERVES   lan  192.168.1.1/24   DHCP OFF
AP       HomeNet  2.4 GHz  →  wwan2

WARNINGS 4
  ! lan is on the same subnet as the uplink — the gateway resolves to
    this router itself and nothing routes out
  ! access point HomeNet is attached to 'wwan2', which is not up
  ! dhcp is not serving lan — clients must be configured by hand
  ! the uplink sits in zone lan, which does not masquerade

Key Features:

Natural-Language Configuration
Say what the network should do, and REGENT works out the exact uci and ubus commands, their order, and the service reload each one needs
Diagnosis, Not a Dump
Its topology tool reads the whole configuration in one call and reports what is broken and why it stops traffic, instead of a listing to interpret by hand
Whole Recipes
Composite intents like "share the uplink with clients" run as one ordered change across several config files, so the AI never has to reassemble the steps itself
Watchdog Rollback
Before a risky change the router is snapshotted and a restore is armed on the device itself, so a change that severs your own connection is undone automatically
Three Levels of Access
Reading always works, changing needs the write gate open, and rebooting, flashing or resetting need the gate plus a separate confirmation on each call
Secrets Stay In
Wi-Fi passwords, VPN keys and subscription links are stripped before anything reaches the model, the command log, or the system log

Roadmap:

apk Support — package handling on OpenWrt 24.10 and newer, where opkg became apk
Wider Device Coverage — verification beyond the single TP-Link Archer C59 confirmed so far
Guest Network — a separate isolated Wi-Fi brought up in one intent

Repository Link

https://github.com/m-o-z-z-i-x/REGENT

I Made NR34P3R: Fast Multi-Threaded Port Scanner for Detecting Open Ports & Services

Roman Madaev — Sun, 22 Jun 2025 01:52:34 +0000

A few months ago I found myself in need of a lightweight port scanner that could deliver actionable insights quickly without bloating system resources or drowning me in irrelevant data. Existing tools felt either too bulky or too barebones, so I decided to build something new — NR34P3R , a fast, multi-threaded port scanner with an intuitive terminal interface and smart service detection

What is it?

NR34P3R is a modern port scanner designed to help security professionals and sysadmins detect open ports and identify associated services with precision. It supports multi-threaded scanning for maximum efficiency, automatically resolves over 3000 service names, and presents results in a clean, color-coded format using Rich tables

Demo

How does it work?

NR34P3R uses a modular scanning engine that leverages Python's socket library and advanced concurrency. You define a target host and specify a port range — single ports, custom ranges (80-443), or full-range scans (1-65535). The scanner then sends asynchronous requests and collects responses, resolving service names and descriptions from its built-in database

When a port is found open, NR34P3R automatically fetches service metadata including protocol, description, and known vulnerabilities (if available), giving you immediate context for further investigation

Key Features:

Ultra-Fast Multi-threaded Scanning
Supports up to 100 concurrent threads for lightning-fast scans across large port ranges
Rich Service Database
Automatically identifies over 3000 services with detailed descriptions powered by WikiLess integration
Colorful Terminal UI
Interactive output with live progress bars, syntax highlighting, and adaptive formatting via Colorama and Rich
Structured Results
Displays findings in organized tables showing port number, service name, status, and description
Flexible Scanning Options
Supports single ports, custom ranges, or full-range scans from 1 to 65535

Roadmap:

ASN Lookup — Identify network ownership for scanned hosts
JSON Reporting — Export scan results for documentation and analysis
Ping Sweep — Check host availability before scanning
Port Test Tool — Verify specific port configurations and firewall rules

Repository Link

https://github.com/m-o-z-z-i-x/NR34P3R

I Made CR4SH3R: Tool for Automating Vulnerability Detection in WordPress Plugins

Roman Madaev — Sun, 22 Jun 2025 01:38:36 +0000

A couple of months ago, I came across a WordPress site that needed a quick security check for obvious vulnerabilities. It all started with routine work: standard checks, searching for known CVEs, and inspecting popular plugins. But what I found made me think more seriously — critical Arbitrary File Download vulnerabilities in several plugins that allowed access to wp-config.php with just a few requests

This became the reason for creating CR4SH3R — a simple yet powerful tool designed to automate the detection of such vulnerabilities within the WordPress ecosystem

What is it?

CR4SH3R is a GUI utility designed to scan websites for Arbitrary File Download vulnerabilities in WordPress plugins. Its main purpose is to detect paths through which the wp-config.php file can be downloaded, and automatically extract sensitive information from it — such as database login credentials and other important parameters

Screenshots

How does it work?

The scanner uses a pre-prepared list of potentially vulnerable URL paths and sends HTTP requests to the target domain. If the server returns the contents of the wp-config.php file, the program parses it and displays only the relevant data. There’s also an option to save results in .xlsx format

Example payload:
/wp-content/plugins/vulnerable-plugin/download.php?file=../../../../wp-config.php

Key Features:

Multi-threaded Scanning
Fast scanning using concurrent request processing. Supports up to 10 simultaneous checks
Automatic Data Extraction from wp-config.php
If the file is found, CR4SH3R automatically extracts values like:
DB_NAME
DB_USER
DB_PASSWORD
DB_HOST
table_prefix
Excel (.xlsx) Report Generation
All findings are saved in a structured and easy-to-share format
Simple GUI Interface
Built using PyQt5 for user-friendly interaction

Roadmap:

Auto-updater — built-in version checker
Config Presets — save and load frequently used scan settings
Session History — track previous scans with timestamps and results
Encrypted .env File — prevent plaintext exposure when bundled into binaries

Repository Link

https://github.com/m-o-z-z-i-x/CR4SH3R