Run Radmin VPN on Linux via Wine. Join VPN networks, see peers, play games — all without a Windows VM.

I did not build this because it was easier than a VM. I built it because I thought it was easier than a VM.

AI-assisted code. Built collaboratively between a human and Claude (Anthropic). The driver, hooks, and bridge were written with extensive AI-assisted reverse engineering of Radmin VPN's undocumented driver protocol using Ghidra. This works, but comes with no guarantees. Not affiliated with Famatech. Radmin VPN is proprietary — download it yourself from radmin-vpn.com. Use at your own risk.

How it works

Radmin VPN's Windows service talks to an NDIS miniport driver for its virtual network adapter. Wine doesn't support NDIS, so we replace the driver with our own implementation that bridges to a Linux TAP device. A hook DLL handles Wine compatibility issues (adapter naming, registry permissions). The result is a fully functional Radmin VPN client running natively under Wine.

Linux app ← TAP (radminvpn0) ← tap_bridge ← FIFO ← rvpnnetmp.sys (Wine driver) ← RvControlSvc.exe

Quick start (AppImage, recommended)

Grab RadminVPN-Linux-x86_64.AppImage from the latest release. Nothing to install — Wine is bundled.

Release candidates (e.g. v1.0.0-rc1) are published as GitHub pre-releases. The latest link above always points to the newest stable build, so pre-releases won't appear there — grab those from the full releases list.

chmod +x RadminVPN-Linux-x86_64.AppImage
./RadminVPN-Linux-x86_64.AppImage

On first launch it will prompt for the Radmin VPN installer (download Radmin_VPN_*.exe from radmin-vpn.com first). A terminal opens with progress, and one sudo password prompt is needed for TAP setup.

Persistent state (wineprefix, MAC, logs) lives in ~/.local/share/radmin-vpn-linux/.

Prerequisites (source build / non-AppImage)

• Wine >= 11.0 (tested on Wine 11.5 Arch Linux and on Wine 11.6 Ubuntu 24.04)
• mingw-w64 cross-compilers (i686-w64-mingw32-gcc, x86_64-w64-mingw32-gcc) — for building from source
• iconv (glibc) — for service log parsing
• sudo access — for TAP device creation and routing
• TUN/TAP kernel support — usually built-in, check with modprobe tun
• Radmin VPN installer — download from radmin-vpn.com. Must be a 2.0.x build (developed against 2.0.4899.9). Radmin VPN 1.4 is not supported — it registers and opens the adapter but never finishes connecting under the Wine shim, leaving the GUI stuck at "Connecting...".

Arch Linux

sudo pacman -S wine mingw-w64-gcc

Ubuntu/Debian

sudo apt install wine64 wine32 gcc-mingw-w64

Source quick start

git clone https://github.com/baptisterajaut/radmin-vpn-linux.git
cd radmin-vpn-linux

# Option A: download pre-built binaries from GitHub Releases
mkdir -p build
TAG=$(curl -sI https://github.com/baptisterajaut/radmin-vpn-linux/releases/latest | grep -i location | grep -oP 'v[\d.]+')
curl -sL "https://github.com/baptisterajaut/radmin-vpn-linux/releases/download/${TAG}/radmin-vpn-linux-${TAG}.tar.gz" \
  | tar xz -C build/

# Option B: build from source
make

# Download Radmin VPN installer from https://www.radmin-vpn.com/
./run.sh --installer ~/Downloads/Radmin_VPN_*.exe

On subsequent runs, just:

Command-line flags

Both --filter-ui and --fix-chat are opt-in. The filter UI needs the rvpn_filter_ui binary (built by make); the chat fix needs patch_qwindows_font.py and a Python 3 interpreter.

Headless / server modes

Two extra launchers run Radmin VPN without a local desktop — for a VPS or datacenter host. Both install and configure exactly like run.sh (same wineprefix, same --installer first-run flow, same TAP bridge); they only differ in how the GUI is reached.

run_datacenter.sh — GUI over the browser

Runs the real Radmin GUI on a virtual display (Xvfb) and serves it through VNC + noVNC, so you can configure your networks from a browser and then leave it running.

sudo apt install -y xvfb x11vnc websockify novnc   # or: make install-datacenter-deps
./run_datacenter.sh --installer ~/Downloads/Radmin_VPN_*.exe

By default noVNC binds to 127.0.0.1, so it's only reachable through an SSH tunnel:

ssh -L 6080:localhost:6080 your-vps    # then open http://localhost:6080/vnc.html

To expose it publicly, pass --web-bind 0.0.0.0 together with --vnc-password — otherwise anyone who reaches the web port lands on an unauthenticated, root-capable desktop. The script prints a loud warning if you bind publicly without a password.

run_vps.sh — service only, fixed GUID

Starts the service headless with a hardcoded TAP GUID (no Wine WMI required) and no GUI at all. If a custom network enumerator (rv_net_enum.exe, not shipped in this repo) is present one directory up, it is launched; otherwise the service just runs until you Ctrl+C. Only --installer is accepted.

./run_vps.sh --installer ~/Downloads/Radmin_VPN_*.exe

Building from source

Requires mingw-w64 cross-compilers. Pre-built binaries are available from Releases (built by CI on each tagged version) if you don't want to install mingw.

make          # build everything to build/
make clean    # remove build artifacts

Produces:

• build/rvpnnetmp.sys — Wine kernel driver (64-bit PE)
• build/adapter_hook.dll — Hook DLL (32-bit PE)
• build/rvpn_launcher.exe — DLL injector (32-bit PE)
• build/netsh.exe — netsh replacement (32-bit PE, installed to SysWOW64)
• build/netsh64.exe — netsh replacement (64-bit PE, installed to System32)
• build/drvinst.exe — no-op stub replacing Radmin's real NDIS driver installer (issue #12)
• build/tap_bridge — native Linux TAP bridge
• build/rvpn_dnsfix.so — native LD_PRELOAD shim, preloaded into the service only
• build/rvpn_filter_ui — optional GTK4 packet-filter UI (--filter-ui)

Building the AppImage

make
./packaging/build-appimage.sh       # → packaging/dist/RadminVPN-Linux-x86_64.AppImage

Downloads the Kron4ek Wine-Staging amd64-wow64 build (~100 MB) and appimagetool on first run, caches both in packaging/dist/. Requires curl and ImageMagick (convert).

What run.sh does

1. First run: installs Radmin VPN via Wine (/VERYSILENT), removes the real NDIS driver (incompatible with Wine), registers our custom driver
2. Every run: creates a TAP device, starts the TAP-to-FIFO bridge, configures Wine registry (adapter GUID, driver service), launches the Radmin VPN service and GUI
3. On exit (Ctrl+C or close GUI): kills Wine, removes TAP device, cleans up

The wineprefix is stored in ./wineprefix/ (source run) or ~/.local/share/radmin-vpn-linux/wineprefix/ (AppImage). A persistent MAC address is generated on first run and saved in the wineprefix.

Architecture

Troubleshooting

GUI stuck on "Waiting for adapter": the driver isn't loading. Check that /tmp/radmin_driver.log exists and has content. If empty, the driver service registration may be missing — delete the wineprefix and re-run.

Registered but never "ready": the service reaches Registered as #… and stops there. Two known causes, both reported by the diagnostics block printed on timeout. (a) A transparent proxy or tunnel with its own routing policy (sing-box, clash/mihomo, v2ray…) intercepting the outbound connection — such stacks answer the TCP handshake locally, so the socket reads ESTABLISHED while nothing is relayed. Exclude 26.0.0.0/8 from its routes, and *.radminte.com too if you can reach those directly. (b) A resolver that black-holes reverse lookups of private addresses (a docker0 at 172.17.0.1 is the usual trigger). rvpn_dnsfix.so handles this, but it is a 64-bit shim: a system Wine built as old-wow64 ignores it. Workaround there — add a line for the address to /etc/hosts, or use contrib/run-in-netns.sh (which gets the service to "ready" but keeps the VPN inside a namespace: host applications cannot reach 26.0.0.0/8, read the warning in its header).

Service dies immediately: check /tmp/radmin_service.log for Wine errors. Common cause: old wineprefix from a different Wine version. Delete ./wineprefix/ and re-run.

0% packet loss with one peer, high loss with many: this was the original bug — fixed by MAC-based frame routing in the driver. Make sure you're using the latest build.

First ping is slow (~1s): the latest version caches MAC addresses for every IP packet the driver sees. If the target IP has sent at least one packet while the driver was running, the MAC is already cached and there's zero ARP delay. Only completely silent peers (those that have never sent a packet) require the initial ARP resolution, which adds ~1 second.

LAN games don't see other peers / "auto-discovery" broken: most LAN games discover each other with broadcast probes (UDP to 255.255.255.255) or multicast (224.0.0.0/4). On Windows the Radmin TAP driver advertises itself as the preferred interface for those flows; on Linux you have to tell the kernel explicitly. run.sh now installs two extra routes when the VPN comes up:

ip route append 255.255.255.255/32 dev radminvpn0 metric 0
ip route append 224.0.0.0/4        dev radminvpn0 metric 0

Side effect: mDNS / Bonjour / SSDP on your physical LAN (Chromecast, AirPrint, Sonos, smart TVs, ...) will go through the VPN while it's up. If you need local-LAN discovery and Radmin in parallel, run with --no-broadcast-routes:

./run.sh --no-broadcast-routes

The routes are scoped to the TAP device, so they're auto-removed when run.sh tears the device down on exit.

Known limitations

• Only one instance can run at a time (shared FIFOs in /tmp/)
• The 26.0.0.0/8 on-link route affects the entire system while running (cleaned up on exit)
• Default broadcast (255.255.255.255/32) and multicast (224.0.0.0/4) routes are steered to the VPN — disable with --no-broadcast-routes if you need local-LAN mDNS / SSDP in parallel
• Older Wine versions (< 11.0) may have different overlapped I/O behavior that breaks the driver

Notes

Wine bug workaround. The RegSetKeySecurity hook works around a known Wine limitation where services don't receive the SYSTEM SID (S-1-5-18). This may be fixed upstream in a future Wine release.

Credits

Reverse engineering and the Wine shim: @baptisterajaut.

• @ayozetr — tracked the "registers but never ready" hang down to a reverse-DNS lookup of a private address black-holed by the host resolver, proved it with a bare-libc repro after four wrong theories had been discarded (mine included), and wrote the original of src/rvpn_dnsfix.c and contrib/run-in-netns.sh.
• @gringoestrangeiro — Linux stability work: packet filters, ARP cache, crash recovery, headless and datacenter modes.
• @yuxiaole-bili — found that Wine's SCM auto-starts a second, unhooked service instance that fights the injected one for the adapter.
• @D1spell-tech, @Milkiway13 and everyone who pasted a full diagnostics block — two independent hosts is what makes a bug findable.

License

GPL-3.0. See LICENSE.

In spirit, this code is public domain — do whatever you want with it. The GPL is here as a legal safety net: it explicitly protects reverse engineering for interoperability, which is what this project does. Belt and suspenders.

Radmin VPN is proprietary software by Famatech Corp. This project provides interoperability tools only — no Famatech code is included or distributed.