MStar

An entrepreneur who works with crypto, foreign platforms, or several business accounts eventually hits the same wall: the usual “VPN plus a browser” combination is not enough. The VPN drops at the worst possible moment, work and personal activity share one system, and the platform’s security team sees an unstable digital profile and freezes the account pending review.

MStar 2225 is a preconfigured, isolated work environment I designed and built for exactly that problem. The client gets a ready kit of virtual machines: install a hypervisor, import the images by the guide, and work. Nothing changes on the host computer, because everything happens inside the isolated environment. Below is how it works, which engineering decisions sit behind it, and why it was built this way.

The problem: why “VPN plus a browser” falls short

The standard toolkit looks sensible, but it has three weak points, and I have seen each of them play out in real client situations.

• Human error. You have to remember to switch the VPN on, and you have to notice when it drops. A single request that escapes the tunnel undoes the whole setup. Relying on a person’s attention here is a design flaw, not a discipline problem (I wrote about the real cost of the human factor separately).
• Mixed perimeters. Work tasks, personal mail, social networks, and browser extensions all live in one system. Any leak or infection touches everything at once.
• An unstable profile. Services look at far more than your IP: time zone, system language, font set, browser behaviour. When those drift from session to session, the security system sees an anomaly and responds with a block.

Architecture: two perimeters instead of one

The core decision in MStar is splitting work and networking into two separate virtual machines.

• The work machine (Windows) is where the user does the actual job. A clean system with no extra software and constant parameters: the same time zone, the same locale, the same toolset from session to session.
• The network machine (an OpenWRT router) is the only route to the internet for the work machine. All traffic is encrypted and leaves through a private VPN server.

The point of the split is that the work machine physically has no other route out. If the VPN never came up or has dropped, that machine simply has no internet: it does not “work unprotected,” it does not work at all. This is the familiar kill-switch, except it is implemented by network topology rather than by a checkbox in an app that can be unticked by accident. Forgetting to turn protection on is impossible here, because nothing runs without it.

Engineering decisions, and why they went this way

Isolation instead of cleanup. The virtual machine is separated from the host system entirely. There is no need to scrub your personal computer or police the boundary between work and private life: they are different environments, and whatever happens inside the work one stays there. It is the same compartmentalization principle I apply to mobile devices, where a private phone setup splits the work and everyday perimeters across two separate devices.

A private clean IP, not a shared VPN. The client runs a personal server whose address nobody else uses. Public VPN services hand out addresses that hundreds of people have already used, and some of those users have burned them; platforms know those ranges and treat them with suspicion. A private address looks ordinary and stays stable.

Ordinary Windows, not something exotic. There was a fork in the road: build the work machine on Linux (lighter and simpler) or on Windows. I chose Windows deliberately. First, the environment should look typical: a mainstream OS raises no questions in places where an unusual configuration is itself a red flag. Second, everything the entrepreneur already relies on has to keep working, from the hardware wallet to banking plugins. An elegant solution that breaks the client’s tools is a bad solution.

Protection against misconfiguration. The system is built so that a configuration mistake stops it from starting, rather than letting it run quietly in an unprotected state. An explicit failure beats a silent vulnerability: the user sees the problem immediately instead of learning about it after the fact.

Cross-platform by design. The kit runs both on an ordinary PC and on a Mac with Apple Silicon, for which a Windows 11 ARM image is built. The entrepreneur stays on familiar hardware and buys nothing extra.

No black boxes. Every component is open or widely known, and each choice is documented with its reasoning and a link to the source. All accounts (cloud, services, exchanges) are registered to the client, and only the client knows the passwords. MStar stays the client’s product rather than a subscription that dies without me.

The stack

• VMware Workstation: the hypervisor that runs both machines.
• OpenWRT (with pfSense as an alternative): the network machine handling routing, firewalling, and egress rules.
• WireGuard: the tunnel to the private server, modern and fast, with a small auditable codebase.
• DigitalOcean: the private VPS with a dedicated clean address.
• Unbound and DNS-over-HTTPS: a private resolver, so DNS queries never leave in the clear outside the tunnel.
• Windows 10 / 11 ARM: the work machine for PCs and for Macs on Apple Silicon.
• Antidetect browsers (Incogniton, Dolphin): optional, layered on top of the network perimeter for a stable browser profile.

Hardware wallets are handled separately: the USB device is passed through into the virtual machine, so transactions are signed inside the isolated environment and the keys never leave the physical device.

What the client receives

• Ready images of both machines, preconfigured, with a working network setup and routing rules.
• Step-by-step documentation with a screenshot for every step, from installing the hypervisor to connecting a wallet and fixing common errors.
• Full control: every account and password belongs to the client, and the infrastructure stays with them.
• Support and updates: the product evolves in versions, and accumulated fixes land in the next builds.

How to get started

The order is simple: we discuss the task and match the configuration to your hardware (PC or Mac), you receive the images and access to the documentation, and you deploy the kit by the guide, with my help on a call if needed. Infrastructure costs (the private server, third-party licences) are paid directly to the providers: they are not baked into the price, and there is no markup on them.

My role in the project

Product creator

I created MStar 2225 from scratch: I articulated the real pain of entrepreneurs working with crypto and high-risk accounts, and designed an architecture that addresses it. The product grew out of the practice behind Monolith Plus, my information-security line of work for businesses.

Lead engineer

I built the entire technical stack myself: the virtual-machine configurations, the routing rules on OpenWRT and pfSense, the WireGuard setup, and the automation scripts that make the kit work immediately after deployment. I also wrote the documentation and the troubleshooting guide, based on real client installations.

Honest boundaries: what MStar does not do

I do not promise absolute anonymity. Nobody can deliver it, and anyone who promises it is selling an illusion. MStar solves a specific engineering problem: it isolates the work environment, removes the possibility of traffic escaping the tunnel, and gives you a stable, predictable digital profile instead of a drifting one. That measurably lowers the risk of blocks and compromise, but it does not replace common sense in how you operate.

The product is intended for lawful work: protecting commercial information, privacy, and business continuity. Privacy and control over your own location data are ordinary requirements rather than a way around the rules, and that is the frame MStar was built in.

Frequently Asked Questions

How is MStar different from an ordinary VPN? A VPN is one app on your computer that you can forget to switch on and that can drop without you noticing. MStar is an isolated environment of two machines in which the work machine has no route to the internet other than the encrypted tunnel. No tunnel means no connectivity, so an accidental leak around it is ruled out by the architecture.

Do I need to change anything on my own computer? No. You only install a hypervisor; all the work happens inside the virtual machines and the host system stays untouched.

Does it work on a Mac with Apple Silicon? Yes, a Windows 11 ARM image is built for it. Ordinary PCs use Windows 10 or 11.

What happens if the VPN drops while I am working? The work machine loses internet access. That is deliberate: an explicit failure is better than traffic silently leaking around the tunnel.

Does the infrastructure stay mine? Yes. Every account and the server are registered to you and only you know the passwords. It is a product, not a subscription tied to the vendor.

---

Need a Consultation?

If you need an isolated work environment for a specific task, or you want to work out whether simpler measures would do in your case, book a free 15-minute call. We will go through your situation and I will tell you honestly whether you need MStar at all.