Open-source alternatives to Lantern

This project is a privacy-focused VPN manager and WireGuard client application designed to establish encrypted tunnels that mask user IP addresses and activity. It focuses on maintaining anonymity through a system that supports account creation without personal identifying information. The application distinguishes itself with advanced privacy tools, including a multi-hop orchestrator for routing traffic through multiple sequential servers and a network traffic obfuscator that uses Shadowsocks, TCP, and QUIC to bypass deep packet inspection and censorship. It also implements quantum-resistant

ShadowsocksX-NG is a macOS application that functions as a Shadowsocks proxy client to establish encrypted tunnels for bypassing network censorship. It operates as an encrypted tunnel manager that allows for the configuration of secure ciphers and the import of proxy server profiles. The client includes a proxy converter that transforms SOCKS5 traffic into HTTP proxy traffic to provide compatibility for applications that do not support SOCKS. It also integrates a traffic steering system using Proxy Auto-Configuration files to automatically determine which network requests bypass the proxy. T

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

Streisand is an orchestration system for deploying multi-protocol tunneling services and traffic obfuscation tools designed to circumvent regional network restrictions. It functions as a deployment utility and manager for various VPN and proxy services on remote cloud servers. The system distinguishes itself through a network obfuscation toolkit that wraps traffic in layers to evade deep packet inspection and bandwidth throttling. It automates the setup of multiple protocols, including WireGuard, OpenVPN, Shadowsocks, OpenConnect, OpenSSH, and Tor bridges. The project also includes utilities

Cloak is a set of censorship circumvention tools designed for secure proxy tunneling and internet traffic obfuscation. It focuses on bypassing restrictive firewalls and state surveillance by disguising proxy connections as standard web browsing. The project utilizes HTTP fingerprint masquerading to imitate common browser signatures and routes traffic through content delivery networks to mask the identity of the origin server. To further hide the server's purpose, it includes a mechanism to redirect unauthenticated connection requests to a third-party website. The system implements transport

MasterDnsVPN is a DNS tunneling VPN and network censorship bypass tool that encapsulates network traffic within DNS queries to circumvent restrictive firewalls. It functions as a secure tunneling protocol and SOCKS5 proxy server, allowing local application traffic to be routed through a secure tunnel to a remote destination. The project distinguishes itself through a DNS resolver load balancer that distributes traffic across multiple resolvers based on latency and packet loss scoring. It further secures and masks traffic using symmetric payload encryption—supporting ChaCha20, AES-GCM, and XOR

Amnezia Client is a cross-platform VPN client application and server orchestrator designed to manage secure tunnels and automate the deployment of containerized VPN services on remote self-hosted servers. It functions as a multi-protocol VPN manager that supports various tunneling standards to ensure connectivity across restrictive network environments. The project distinguishes itself through network traffic obfuscation, which disguises VPN traffic as common web protocols or DNS requests to bypass deep packet inspection and censorship. It further enables the automation of remote server admin

Zapret is a deep packet inspection bypass tool and packet manipulation framework designed to circumvent network censorship. It operates as a transparent network proxy and TCP traffic obfuscator that modifies packets to deceive network inspection systems. The project distinguishes itself through advanced desynchronization strategies, including the modification of TLS client hello handshakes and the use of fake packet injection. It utilizes a combination of TCP stream segmentation, sequence overlapping, and TTL adjustment to hide prohibited requests from firewalls while ensuring the destination

ShadowsocksR-Windows is a proxy client for Windows designed to route network traffic through ShadowsocksR proxy servers. It functions as a network proxy that establishes secure tunnels to bypass internet censorship and regional restrictions. The application manages system-wide network routing and provides SOCKS5 proxy client capabilities to hide origin IP addresses. It redirects local traffic through a remote server to maintain internet privacy and circumvent network-level blocks. The project incorporates traffic interception and encapsulation through a user-mode network wrapper and TAP-base

v2ray-core is a network proxy framework and custom proxy engine designed for censorship circumvention. It functions as a traffic routing platform that directs network data between inbound and outbound connections to access blocked content and services. The system employs a modular architecture using pluggable protocol handlers and a chain-based connection pipeline to transform and forward network traffic. It provides secure tunneling infrastructure to establish encrypted connections and uses a rule-based routing system to direct data between protocols and destinations. The framework includes

This project is a censorship circumvention tool and transparent proxy gateway designed to bypass local network restrictions. It functions as a SOCKS5 proxy server, a DNS tunneling tool, and a network traffic obfuscator to help users access blocked websites. The software implements masking protocols to hide the origin and destination of data to evade restrictive firewalls. It provides capabilities for network traffic obfuscation and secure DNS tunneling to protect network privacy and resolve blocked domains. The system handles wide-scale traffic management by intercepting system network traff

Open vSwitch is a software-defined network switch and high-performance data plane engine. It functions as a virtual layer 2 switch and network orchestrator, implementing the OpenFlow protocol to decouple the control plane from the data plane for programmable network forwarding. The project distinguishes itself through a userspace-kernel datapath split and the use of poll-mode drivers for kernel-bypass acceleration. It provides a network tunneling gateway to extend virtual networks across physical hosts and utilizes a transactional, schema-based configuration database with state replication fo

This project is a V2Ray configuration repository that provides a collection of pre-configured server settings and connection strings. It serves as a curated set of remote proxy addresses and security metadata used to establish encrypted network tunnels for routing internet traffic. The project focuses on the distribution of Base64-encoded configuration strings, which allow for the retrieval and deployment of server settings to establish secure connections. It includes tools for latency benchmarking, measuring response times and pinging configuration links to filter and rank the most performan

This project is a technical resource and guide for bypassing internet censorship and network restrictions. It provides instructional documentation for configuring proxies and tunnels to circumvent IP blocking and access restricted websites and services. The guides cover the deployment of Shadowsocks, L2TP/IPSec, and SSH tunnels on virtual private servers. It focuses on masking server IP addresses by routing traffic through content delivery networks and using WebSockets to maintain connectivity. Additional technical coverage includes the implementation of SOCKS5 and HTTP proxies, the configur

Nekoray is a cross-platform desktop application designed to manage secure network tunnels and proxy configurations. It functions as a graphical interface that routes system traffic through encrypted remote connections to facilitate private browsing and access to geo-restricted content. The application integrates established networking cores to handle complex traffic routing and protocol implementation. By utilizing a local proxy server architecture, it intercepts system traffic and directs it through user-defined rules, allowing for granular control over how data is filtered and transmitted.

This project is a collection of technical resources, blueprints, and guides for building resilient and stealthy red team infrastructure. It provides a comprehensive framework for designing offensive security environments that resist detection and remain operational throughout security engagements. The repository distinguishes itself through detailed playbooks for adversary simulation and hardening manuals. It covers advanced obfuscation techniques such as domain fronting, the use of platform-as-a-service redirectors, and the leveraging of third-party content sites to inherit domain reputation

BPB-Worker-Panel is a control panel designed for deploying and managing VLESS and Trojan proxies hosted on Cloudflare Workers. It functions as a proxy subscription generator and a manager for secure DNS over HTTPS servers and WireGuard configuration provisioning. The project distinguishes itself through network traffic obfuscation capabilities, utilizing packet fragmentation and SNI spoofing to evade detection. It provides specialized administration for Cloudflare Warp and Warp Pro connections, including the ability to optimize endpoints and export WireGuard configurations. The system covers

Hiddify is a cross-platform proxy client designed to manage secure network connections and traffic routing across desktop and mobile operating systems. It functions as a unified proxy manager, providing a centralized interface to configure and control various network proxy protocols for encrypted and private internet access. The application distinguishes itself by integrating local loopback interception, which configures the operating system network stack to route traffic through a local port for granular filtering. It also serves as a self-hosted infrastructure tool, enabling users to automa

Shadowsocks-Windows is a desktop proxy manager that provides a graphical interface for configuring system-wide network routing. It functions as a local SOCKS5 or HTTP proxy server, intercepting outbound traffic through system-level injection to route requests through secure, encrypted remote tunnels. The application distinguishes itself through a modular architecture that supports plugin-based transport extensibility, allowing users to integrate external binaries for custom traffic obfuscation and specialized cryptographic protocols. It also enables high-availability networking by automatical

This project is a community-curated directory of open-source software designed for deployment in private server environments and home labs. It serves as a comprehensive resource for discovering independent, self-hosted alternatives to mainstream cloud services, enabling users to maintain full data ownership and control over their digital infrastructure. The directory is structured through a hierarchical taxonomy that organizes a vast collection of applications into logical categories, ranging from media management and data analytics to private communication and team productivity tools. It dis

This project is a censorship circumvention utility designed to maintain connectivity to restricted online services by evading deep packet inspection. It functions as a network traffic redirection service that manipulates packet headers at the transport layer to bypass regional network filters and censorship systems. The tool distinguishes itself by providing granular control over traffic management, allowing users to define specific lists of domains and IP addresses for targeted interception. By applying custom bypass strategies only to these designated hosts, the utility ensures that the rem

Oblivion Desktop is a proxy client desktop application and network privacy tool designed to manage encrypted network tunnels and routing rules. It serves as a proxy protocol manager that encrypts outgoing traffic and rotates IP addresses to hide user identity and location, primarily to bypass internet censorship and regional restrictions. The application provides a graphical interface for configuring multiple tunneling protocols, TUN interfaces, and PAC files to secure device network traffic. It includes capabilities for internet censorship circumvention and privacy proxy management, allowing

Unblock-Youku is a geo-blocking circumvention tool and proxy server designed to grant access to region-locked video streaming and web services. It functions as a regional content unblocker that masks a user's location to bypass geographic restrictions. The system operates as an SNI proxy server, forwarding HTTPS traffic based on the Server Name Indication without decrypting the payload. It also serves as a transparent proxy gateway and a DNS-based request router that directs network traffic to specific proxy servers by modifying name resolution records for regional domains. Its capabilities

XX-Net is a cross-platform desktop application that functions as a local proxy server and network traffic router. It intercepts outgoing network requests from a local machine and redirects them through encrypted tunnels to a distributed mesh of cloud-based nodes, facilitating secure and reliable access to external resources. The software distinguishes itself by providing a centralized management interface for coordinating complex proxy infrastructure. It employs rule-based traffic routing, allowing users to define custom logic based on destination addresses and protocols to determine the opti

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

ShadowsocksR Proxy Client is a Windows network proxy manager designed to create encrypted tunnels to remote servers to bypass network restrictions. It functions as a Socks5 proxy client that routes system traffic through secure protocols for anonymity and censorship circumvention. The project provides a desktop interface for Windows network proxy administration, allowing users to store, organize, and switch between multiple remote server configurations. It specifically automates traffic routing via a proxy auto-config client, using PAC files to determine which web traffic enters the encrypted

Gost is a Go-based network tunnel and multi-protocol proxy server. It functions as a gateway for routing TCP and UDP traffic, creating secure network tunnels between remote endpoints, and acting as a DNS proxy server to resolve domain name queries. The project is distinguished by its ability to implement multi-hop proxy chaining, which links multiple network nodes in a sequence to route traffic through specific paths. It also provides transparent proxying by integrating with virtual network interfaces to intercept system-level traffic without requiring manual client configuration. The system