Awesome GitHub RepositoriesEncrypted Tunneling

v2rayNG is an Android proxy client designed to route device network traffic through encrypted tunnels. It functions as a network routing engine that intercepts outgoing requests and applies custom traffic rules to manage connectivity and enhance user privacy. The application distinguishes itself by integrating a high-performance network proxy core, which enables complex protocol translation and traffic management directly on mobile devices. It utilizes local loopback and Unix-socket tunneling to redirect device-wide requests, maintaining persistent connectivity through native background servi

ShadowsocksX-NG is a macOS application that functions as a Shadowsocks proxy client to establish encrypted tunnels for bypassing network censorship. It operates as an encrypted tunnel manager that allows for the configuration of secure ciphers and the import of proxy server profiles. The client includes a proxy converter that transforms SOCKS5 traffic into HTTP proxy traffic to provide compatibility for applications that do not support SOCKS. It also integrates a traffic steering system using Proxy Auto-Configuration files to automatically determine which network requests bypass the proxy. T

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

Magic-wormhole is a peer-to-peer file transfer tool used to send files, directories, and text strings between computers. It functions as a secure data relay that establishes ephemeral encrypted network tunnels for ad hoc data exchange without requiring permanent accounts or shared folders. The system utilizes a password-authenticated key exchange to establish a shared secret from a short, human-readable code. This single-use secret handshake ensures the connection is invalidated after a successful pair to prevent replay attacks, while a rendezvous server helps peers exchange connection detail

x-ui is a web-based management panel for Xray proxy protocols. It serves as a visual control center for configuring network transport settings, managing routing rules, and administering multiple user accounts. The project distinguishes itself through automated SSL certificate acquisition via DNS APIs to secure both the administrative interface and proxy tunnels. It also includes a Telegram notification bot that delivers scheduled traffic summaries, login alerts, and account expiration warnings. The system provides a comprehensive set of tools for traffic management, including real-time monit

gost is a multi-protocol proxy tunnel and secure tunneling server designed to route network traffic through encrypted connections. It functions as a traffic obfuscation gateway and a transparent proxy server capable of intercepting TCP and UDP traffic at the IP level. The project also includes a virtual network interface manager for creating TUN and TAP devices to intercept operating system packets. The system distinguishes itself through a chain-based request routing model, allowing traffic to pass through an ordered sequence of proxy nodes. It provides extensive transport-layer encapsulatio

Nebula is a scalable, decentralized overlay networking tool designed to create secure, encrypted peer-to-peer connections between distributed hosts. By utilizing a certificate-based identity authority, it enables the construction of private communication fabrics across disparate physical infrastructures, such as multiple cloud providers or on-premises data centers, without requiring central authentication servers. The project distinguishes itself through a zero-trust architecture that enforces granular, policy-driven firewall filtering based on certificate-derived group memberships. It facili

shadowsocks-libev is an event-driven network daemon that provides an encrypted SOCKS5 proxy. It functions as a lightweight proxy server using a non-blocking event loop to route TCP and UDP traffic through encrypted tunnels to bypass network restrictions. The project implements a transparent proxy gateway capable of intercepting outbound packets at the network layer, allowing system traffic to be redirected through the encrypted tunnel without per-application configuration. It also includes a daemon process manager to control multiple proxy server instances as child processes via local communi

Lantern is a network utility designed to provide access to restricted internet content by tunneling traffic through encrypted connections. It functions as a censorship circumvention tool that enables private web browsing and ensures reliable connectivity in environments where standard network access is blocked or monitored. The application employs a decentralized infrastructure that routes data through a network of distributed proxy nodes. To maintain connectivity in the face of interference, it utilizes dynamic proxy discovery and adaptive fallback mechanisms that automatically switch betwee

OpenSpeedy is a network acceleration utility designed to optimize data transmission between applications and remote servers. It functions as a congestion control middleware and traffic processing engine, operating within the kernel space to minimize latency and reduce CPU overhead during packet delivery. The project distinguishes itself through its ability to aggregate multiple network interfaces into a single logical stream, enhancing bandwidth and link reliability. It employs custom transport protocols that bypass head-of-line blocking and utilizes forward error correction to reconstruct lo

Rathole is a high-performance reverse proxy and NAT traversal tool written in Rust. It functions as a secure tunneling server and client architecture designed to expose local services to the internet by forwarding traffic from a public IP to a private device behind a firewall. The system establishes encrypted tunnels between a public server and a private host to ensure private communication. It utilizes token-based authentication to validate identities between the server and client for each individual service. The project provides TCP and UDP port forwarding and manages private tunnels to fa

dnscrypt-proxy is an anonymizing DNS proxy and encrypted DNS resolver. It acts as a local DNS forwarder that secures internet lookups by wrapping standard DNS queries in encrypted tunnels using the DNSCrypt and DNS-over-HTTPS protocols to prevent eavesdropping and tampering. The project provides network privacy protection by routing DNS requests through anonymized relays to obfuscate the client's original IP address. It further distinguishes itself through traffic management capabilities, such as mapping specific domains to designated resolvers and distributing queries across multiple servers

Tengine is an enhanced Nginx web server distribution designed for high-traffic environments. It functions as a high-performance reverse proxy, dynamic load balancer, and HTTP/3 proxy server, integrating an embedded Lua scripting engine to allow for custom business logic and dynamic request processing. The project distinguishes itself through a focus on modern transport protocols and efficiency, featuring native support for QUIC and HTTP/3 to reduce connection latency. It implements userspace UDP forwarding to bypass the kernel for higher throughput and provides the ability to dynamically upda

OpenVPN is a cross-platform networking solution that establishes secure virtual private network connections by wrapping data traffic within encrypted tunnels. It functions as a server-side application that authenticates remote endpoints and routes encrypted traffic to provide access to private network resources across untrusted public networks. The software utilizes standard cryptographic protocols to perform mutual authentication and key exchange over a dedicated control channel. It verifies the identity of remote systems through certificate-based authentication, ensuring that only trusted e

A Rust port of shadowsocks

Sovereign is a self-hosted cloud orchestrator and infrastructure-as-code toolkit designed to establish personal data sovereignty. It provides a suite of automation scripts to deploy a private cloud infrastructure consisting of open-source services for data storage, communication, and web hosting on private hardware. The project focuses on the independent management of digital assets through the deployment of private email servers, git hosting, and file synchronization systems. It distinguishes itself by automating the full stack of server administration, from initial Linux server automation t

Paramiko is a pure-Python implementation of the SSH2 protocol, providing a library for making secure network connections and executing remote commands. It serves as a programmatic interface for establishing encrypted communication tunnels and managing remote sessions. The project includes a full SSH server framework, allowing applications to host a secure shell server and define server-side access configurations directly within Python. It also provides a dedicated SFTP client library for secure file transfers and remote filesystem management. The library covers remote infrastructure automati

Xray_onekey is an automated Linux network proxy deployer and installation script. It is designed to install and configure Xray proxy servers on Debian or Ubuntu systems to create secure, encrypted network tunnels. The tool specifically implements VLESS XTLS proxy servers, utilizing a stateless transmission protocol and a specialized encryption layer to secure and obfuscate internet traffic. It incorporates an Nginx reverse proxy setup to mask proxy traffic, making incoming requests appear as standard web server activity. The deployment process is handled via bash scripts that automate the in

هذا المشروع عبارة عن واجهة إدارة مركزية ومنسق لنشر بروتوكولات تجاوز الرقابة والوكلاء المتخفين. يعمل كأداة لتجاوز رقابة الشبكة تقوم بتوجيه حركة المرور عبر بروتوكولات اتصال مشفرة لتجنب جدران حماية الإنترنت والحظر الإقليمي. يتميز النظام من خلال مدير VPN متعدد البروتوكولات ومنسق خادم وكيل مؤتمت يتعامل مع تحديثات البرامج ونسخ النظام الاحتياطية. يستخدم شبكات توصيل المحتوى لإخفاء هويات خادم الأصل وينفذ نظام DNS مشفر عبر HTTPS لمنع تسمم DNS وحماية خصوصية المستخدم. يغطي المشروع مجموعة واسعة من القدرات الإدارية، بما في ذلك التحكم المركزي في وصول المستخدمين مع حصص حركة المرور والوقت، وتوجيه حركة المرور الذكي بناءً على الوجهة، وبوابة الخدمة الذاتية للمستخدمين لمراقبة استهلاك البيانات. يمكن إجراء إدارة النظام من خلال لوحة إدارة مخصصة أو واجهة روبوت دردشة خارجية.

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing