Open-source alternatives to Boringtun

wireproxy is a user-space WireGuard client and network gateway that establishes secure tunnels without requiring root privileges or system-wide interface changes. It functions as a VPN proxy that can expose WireGuard connections as SOCKS5 or HTTP proxies. The project provides specialized routing capabilities, including a TLS SNI proxy that directs encrypted traffic based on Server Name Indication and a gateway for mapping local TCP and UDP ports to remote destinations. It supports multi-peer management to route traffic between several endpoints using defined IP ranges. Additional capabilitie

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

Gluetun is a Docker VPN client gateway that routes network traffic from other containers through secure WireGuard or OpenVPN tunnels. It serves as a network gateway to mask origin IP addresses and provides a firewall kill switch that blocks all outbound traffic unless it is destined for the active VPN server. The project supports multiple commercial VPN providers and can maintain several simultaneous connections using custom configuration files. It includes an integrated proxy server stack hosting SOCKS5, HTTP, and Shadowsocks servers to tunnel TCP and UDP traffic. Security is managed throug

This project is a wireless hotspot management interface for Debian devices. It provides a web-based controller for managing wireless access points, wireless repeaters, VPN gateways, and DNS ad-blocking filters. The system includes a captive portal framework to intercept network traffic via customizable splash pages and a VPN controller that supports WireGuard and OpenVPN with kill-switch functionality. It further differentiates itself with a DNS ad-blocking filter using curated blacklists and the ability to operate in multiple network modes, including bridged access point and wireless repeate

LWJGL is a cross-platform library that provides Java bindings to native APIs for graphics, audio, compute, windowing, and input. It enables Java applications to access low-level hardware-accelerated capabilities such as OpenGL and Vulkan rendering, OpenAL 3D audio, OpenCL GPU compute, and GLFW windowing and input handling. Under the hood, LWJGL dynamically resolves native function pointers at runtime, loads platform-specific shared libraries, and uses generated JNI bindings to bridge Java and native code. It offers explicit memory management through direct buffer access and stack-allocated me

CJDNS is a peer-to-peer VPN and cryptographic network overlay that implements an encrypted IPv6 mesh network. It functions as a distributed hash table router, utilizing a non-hierarchical XOR metric to route traffic across nodes without relying on a central authority or registry. The project distinguishes itself by tying network identity to cryptographic ownership, deriving unique IPv6 addresses from public keys. It ensures secure peer connectivity across NAT boundaries using public-key authentication, end-to-end packet encryption, and a handshake protocol that provides perfect forward secrec

n2n is a peer-to-peer VPN that creates an encrypted mesh network by establishing layer 2 overlay networks. It uses UDP tunneling to connect remote computers into a shared virtual local area network, allowing devices to communicate as if they were on the same physical Ethernet switch. The system utilizes a centralized signaling registry and federated coordination nodes to facilitate peer discovery and node registration. It implements NAT traversal through UDP hole punching and UPnP port mapping, while using supernode relay routing to ensure connectivity when symmetric NATs prevent direct peer-

This project is a privacy-focused VPN manager and WireGuard client application designed to establish encrypted tunnels that mask user IP addresses and activity. It focuses on maintaining anonymity through a system that supports account creation without personal identifying information. The application distinguishes itself with advanced privacy tools, including a multi-hop orchestrator for routing traffic through multiple sequential servers and a network traffic obfuscator that uses Shadowsocks, TCP, and QUIC to bypass deep packet inspection and censorship. It also implements quantum-resistant

ics-openvpn is an OpenVPN client for Android devices used to establish secure virtual private network connections. It functions as a connection manager that creates encrypted tunnels between a mobile device and a remote server to protect internet traffic and provide access to private networks. The application supports enterprise device configuration, allowing central management policies to restrict behavior and define default connection profiles. It includes a profile importer for loading connection settings and security certificates from configuration files received via email or direct downl

This project provides a shell-based automation utility for deploying and managing OpenVPN servers on Linux hosts. It functions as an orchestration tool that handles the installation of networking software, the configuration of system-level routing rules, and the generation of cryptographic credentials required to establish secure, encrypted tunnels for remote network access. The tool distinguishes itself by automating the entire lifecycle of a private network gateway, including the management of peer identities and the distribution of standardized configuration profiles. It simplifies the set

Gluetun is a containerized network utility designed to route traffic from multiple Docker containers through a secure virtual private network tunnel. It functions as a network gateway that encapsulates outgoing internet traffic to provide privacy and security for isolated application services. The project distinguishes itself by utilizing Linux network namespaces to isolate container traffic, ensuring that all outgoing packets are forced through a dedicated tunnel interface. It supports both OpenVPN and WireGuard protocols, managing the connection lifecycle and routing logic as a sidecar cont

This project is a cross-platform mobile animation library and UI thread animation engine designed to create high-performance animations by running JavaScript logic directly on the UI thread. It functions as a multi-threaded JavaScript runtime that allows code to execute across multiple threads to improve concurrency and prevent frame drops. The library focuses on enabling fluid user interface interactions and high-frame-rate transitions that remain stable regardless of the main processing load. It provides a system for offloading animation logic from the main thread to ensure smooth motion an

Toxcore is a peer-to-peer networking library that implements a decentralized communication protocol for secure messaging and media calls without the use of central servers. It provides a core engine for establishing direct encrypted connections between devices using a public-key identity system where unique identifiers serve as both addresses and authentication keys. The project features a decentralized network architecture that utilizes a distributed hash table for peer discovery and Kademlia-based routing to locate participants. To maintain connectivity across restrictive network environmen

This project is a cross-platform mobile camera framework and real-time computer vision library. It provides a high-performance interface for mobile applications to handle hardware control, media capture, and live camera frame processing. The framework includes a dedicated system for running AI models and custom analysis on live camera streams using high-performance worklets. It also functions as a real-time detection and decoding system for QR codes and barcodes. Broad capabilities cover the capture of high-resolution photos and videos with controls for zoom, HDR, and frame rates. The projec

This project is the core management framework for a security appliance, providing the primary infrastructure for firewall management, network intrusion prevention, and high-availability networking. It serves as the centralized system for controlling network security policies, filtering traffic, and administering a security appliance dashboard. The system is distinguished by its high-availability capabilities, which include synchronizing configurations and connection state tables across redundant nodes to enable automatic hardware failover. It also features a modular plugin architecture for ex

This project provides a system for configuring dual-stack connectivity, establishing local proxy ports, and managing policy-based traffic routing. It functions as a utility to add IPv4 and IPv6 network exits to servers and a tool for importing and parsing WireGuard profiles to generate compatible network configurations. The software automates the installation and management of the Cloudflare WARP client across different operating systems. It enables the deployment of secure network tunnels and the creation of local SOCKS5 proxy ports to route specific application traffic without altering glob

Pritunl is an enterprise VPN gateway and server manager used to deploy and configure OpenVPN and WireGuard servers through a centralized web interface. It functions as a VPN access control system and an SSH certificate authority, issuing short-lived signed certificates to manage secure shell access and network entry without manual public key distribution. The platform acts as an SSO integrated VPN controller, synchronizing user access and organization mapping with third-party identity providers via OAuth, OIDC, and SAML. It supports high-availability deployments by using database-backed clust

SmarGate is a network utility designed as an intranet penetration tool, peer-to-peer network tunnel, and remote device management gateway. It functions as a system for bypassing NAT and firewalls to expose internal services to the public internet, while also providing SOCKS5 and HTTP proxy capabilities and SSL/TLS encrypted tunnels. The project distinguishes itself by implementing hybrid routing that combines direct peer-to-peer TCP links with cloud-based proxy relaying to reduce latency. It features real-time dynamic port mapping that allows network redirections to be updated via a mobile cl

mQuickjs is a compact JavaScript engine designed for memory-constrained devices, such as microcontrollers, requiring as little as 10 KB of RAM and 100 KB of ROM. It achieves this through a fixed-buffer memory allocation scheme that avoids system heap usage, a compacting tracing garbage collector that eliminates fragmentation, and a ROM-embedded standard library that reduces both memory footprint and startup time. The engine compiles JavaScript source into portable bytecode that can be stored in persistent memory and executed without reparsing, and it emulates IEEE 754 floating-point arithmetic

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

CefSharp is a .NET binding for the Chromium Embedded Framework that allows developers to embed a full web browser into desktop applications. It provides an embedded browser control for rendering HTML, CSS, and JavaScript content within a native host window. The project features a bidirectional JavaScript bridge interface that enables the execution of scripts and the exposure of native host classes and methods to the browser environment. It also includes a headless browser automation tool for executing web tasks and capturing page screenshots without a graphical user interface. The library co

Oblivion is an encrypted tunneling service and internet privacy tool designed to route network traffic through private encrypted tunnels. It functions as a network privacy gateway that masks user identity and encrypts web traffic to prevent tracking and unauthorized surveillance. The project acts as a secure network proxy that combines end-to-end encryption with latency-optimized routing to increase data throughput and reduce network lag. This infrastructure allows for the masking of a device's public identity by relaying connections through a private network. The system provides capabilitie

This project is a technical resource and guide for bypassing internet censorship and network restrictions. It provides instructional documentation for configuring proxies and tunnels to circumvent IP blocking and access restricted websites and services. The guides cover the deployment of Shadowsocks, L2TP/IPSec, and SSH tunnels on virtual private servers. It focuses on masking server IP addresses by routing traffic through content delivery networks and using WebSockets to maintain connectivity. Additional technical coverage includes the implementation of SOCKS5 and HTTP proxies, the configur

i2pd is a C++ implementation of the I2P anonymous network layer, serving as a peer-to-peer overlay network and I2P network router. It functions as a decentralized communication system that masks IP addresses and encrypts data using a garlic routing protocol. This project provides a lightweight daemon that acts as a self-hosted privacy gateway, connecting local applications to the I2P network for private data transmission without the use of Java. The system covers anonymous peer communication, privacy-preserving networking, and secure client-server interactions. It implements end-to-end encry

This repository is a technical documentation site and a collection of guides and references for implementing networking, security, and cloud infrastructure services. It functions as a static-site generated portal and a headless content platform, separating source files from the presentation layer to enable flexible rendering. The project utilizes markdown-based documentation stored in a version-controlled Git repository. It provides specialized technical content including an AI platform documentation for building agents and managing inference, a cloud infrastructure guide for DNS and CDN conf

flutter-webrtc is a real-time communication SDK and plugin for the Flutter framework. It provides a set of tools for establishing peer-to-peer media connections and low-latency data exchange across mobile, desktop, and web environments. The project enables the creation of applications with live audio and video calling, real-time media streaming, and peer-to-peer data channels for sending encrypted arbitrary data packets without a central server. It supports secure media communication through end-to-end encryption for audio, video, and data streams. The SDK covers broad capabilities including

nodejs-argo is a Node.js network proxy server designed to route network traffic and manage secure communication tunnels across various protocols. It functions as a cloud proxy tunnel that exposes local services to the public internet and includes a subscription manager for generating and distributing connection configuration links to clients. The system integrates a network service monitor to track the operational status and performance of services via external monitoring panels. It also utilizes endpoint-based configuration distribution to provide connection settings and authentication detai