How I Built a Pure-Dart SSTP & PPP VPN Client From Scratch

Description and use

A pure‑Dart VPN client implementing SSTP and PPP with cross‑platform TUN routing and an Apple Silicon ABI fix.

Problem

Developers want a cross‑platform VPN client written entirely in Dart, avoiding native binaries and enabling low‑level networking in a high‑level language.

Outcome

The sstp_client library demonstrates that a pure‑Dart implementation can handle complex VPN protocols, cross‑platform TUN routing, and low‑level FFI bugs, all while remaining fully unit‑tested offline.

Workflow

• 1. Spin up a dart:io SecureSocket and perform an HTTP SSTP_DUPLEX_POST to establish the tunnel.
• 2. Use SstpFramer to reassemble incoming bytes into SSTP control frames or raw data.
• 3. Run the SSTP state machine (SstpSession) to negotiate PPP: LCP → MSCHAPv2 → IPCP.
• 4. Create a virtual network interface via platform‑specific backends (Linux /dev/net/tun, Windows Wintun, macOS utun).
• 5. Strip or prepend the 4‑byte address family header on macOS.
• 6. Spawn a dedicated Dart Isolate per backend to perform blocking reads from the kernel/driver and send packets back to the main event loop via SendPort.
• 7. Apply the Apple Silicon fix by declaring ioctl with VarArgs for Darwin targets.
• 8. On disconnect, restore original routing tables instantly.

Evidence

The client successfully handles full‑tunnel and split‑tunnel routing over IPv4 with robust cleanups that restore your system's original routes instantly upon disconnect.

Source

The core stack is fully unit‑tested entirely offline using mocked crypto vectors (RFC 2759) and synthetic pipes—no root permissions or live servers required to verify the code integrity.

Source