Open-source alternatives to Mullvadvpn App

BPB-Worker-Panel is a control panel designed for deploying and managing VLESS and Trojan proxies hosted on Cloudflare Workers. It functions as a proxy subscription generator and a manager for secure DNS over HTTPS servers and WireGuard configuration provisioning. The project distinguishes itself through network traffic obfuscation capabilities, utilizing packet fragmentation and SNI spoofing to evade detection. It provides specialized administration for Cloudflare Warp and Warp Pro connections, including the ability to optimize endpoints and export WireGuard configurations. The system covers

Hiddify-Manager is a VPN management panel and multi-protocol proxy server designed for internet censorship circumvention. It provides a central system for deploying and administering tunneling protocols to mask internet traffic and origin IP addresses. The project features a user subscription manager for distributing dynamic configuration links and a DNS privacy suite that implements DNS over HTTPS to prevent identity leaks. It integrates a CDN routing gateway to hide server locations and provides a web-based interface for managing multiple obfuscated connection methods. The platform covers

Shadowsocks-android is a secure tunneling application and SOCKS5 proxy client for Android. It routes device network traffic through a Shadowsocks proxy server to encrypt data, mask the user's internet origin, and bypass network restrictions. The client functions as an Android VPN service, creating a virtual network interface to intercept and redirect all outgoing device traffic. It supports the integration of external binary plugins to extend tunnel capabilities with custom transport protocols and traffic obfuscation methods. The project manages network routing through a local SOCKS5 server

Shadowsocks is a secure network tunneling tool designed for censorship circumvention and private internet connectivity. It functions as a proxy system that routes traffic through encrypted tunnels, allowing users to bypass regional network restrictions and protect data from interception across public infrastructures. The project utilizes a lightweight, custom proxy protocol that incorporates stream-based cipher encryption to obfuscate payload content and prevent deep packet inspection. By employing an asynchronous, event-driven networking model, the system manages concurrent connections effic

This project is a containerized IPsec VPN server designed to provide secure remote network access. It functions as an IKEv2 VPN gateway, utilizing the StrongSwan daemon to manage security associations and establish encrypted tunnels between remote clients and a private network. The server acts as a certificate-based VPN manager, handling the generation and distribution of digital certificates and pre-shared keys to authenticate remote users. It includes tools for IKEv2 client management to automate the creation of configuration profiles and security keys for connecting devices. The system co

A Rust port of shadowsocks

SmarGate is a network utility designed as an intranet penetration tool, peer-to-peer network tunnel, and remote device management gateway. It functions as a system for bypassing NAT and firewalls to expose internal services to the public internet, while also providing SOCKS5 and HTTP proxy capabilities and SSL/TLS encrypted tunnels. The project distinguishes itself by implementing hybrid routing that combines direct peer-to-peer TCP links with cloud-based proxy relaying to reduce latency. It features real-time dynamic port mapping that allows network redirections to be updated via a mobile cl

Ockam is an end-to-end encryption framework and distributed identity provider designed to establish secure communication between applications and devices. It provides a secure network overlay that utilizes cryptographic identities and attribute-based access control to implement zero trust network access. The project distinguishes itself through metadata-driven multi-hop routing and a pluggable transport layer, allowing encrypted traffic to move across diverse network topologies without requiring virtual IP overlays. It specifically enables secure tunneling for legacy applications by wrapping

VPNOn is a deep link VPN client and connection manager that enables the establishment of secure network tunnels and the opening of specific web addresses via custom URL schemes. It functions as a configuration importer and a system tray utility for managing secure connections. The project differentiates itself through automated configuration setup, using custom URL schemes to import server credentials and serialized network settings from external sources. It further automates connectivity by triggering a sequence that establishes a network tunnel before launching a browser to a target address

This project is a network security tool providing an application network firewall, a DNS blocklist manager, and a VPN client with multi-hop capabilities. It functions as a traffic controller that allows or blocks internet access for specific applications on a device. The system distinguishes itself through a DNS-over-HTTPS firewall and traffic obfuscation tools that inject random packets to mask communication patterns and bypass regional internet censorship. It utilizes multi-hop routing to hide the origin of network traffic by chaining connections through multiple remote servers. The softwa

MasterDnsVPN is a DNS tunneling VPN and network censorship bypass tool that encapsulates network traffic within DNS queries to circumvent restrictive firewalls. It functions as a secure tunneling protocol and SOCKS5 proxy server, allowing local application traffic to be routed through a secure tunnel to a remote destination. The project distinguishes itself through a DNS resolver load balancer that distributes traffic across multiple resolvers based on latency and packet loss scoring. It further secures and masks traffic using symmetric payload encryption—supporting ChaCha20, AES-GCM, and XOR

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

REALITY is a censorship circumvention tool and network traffic obfuscator designed to bypass internet filters. It functions as a secure tunneling protocol that masks connection patterns and identity by mimicking the TLS handshakes of legitimate target websites. The system removes server-side TLS fingerprints to hide encrypted traffic from network monitoring tools and deep packet inspection. It employs a website mimicking proxy to present valid handshakes and forward traffic to destination servers, masquerading the connection as a legitimate site visit. The project incorporates a quantum-resi

This project is a wireless hotspot management interface for Debian devices. It provides a web-based controller for managing wireless access points, wireless repeaters, VPN gateways, and DNS ad-blocking filters. The system includes a captive portal framework to intercept network traffic via customizable splash pages and a VPN controller that supports WireGuard and OpenVPN with kill-switch functionality. It further differentiates itself with a DNS ad-blocking filter using curated blacklists and the ability to operate in multiple network modes, including bridged access point and wireless repeate

fhs-install-v2ray is a shell script that automates the deployment of V2Ray, a network proxy tool, on Linux servers. It downloads precompiled binaries and geographic data from a release server, places them into standard Linux filesystem directories, and registers V2Ray as a persistent background service managed by systemd. The script is designed to be idempotent, meaning repeated runs do not overwrite custom configurations, and uninstallation removes all installed files and services completely. The tool distinguishes itself by enforcing a Filesystem Hierarchy Standard (FHS) layout, mapping bin

This project is a censorship circumvention tool and transparent proxy gateway designed to bypass local network restrictions. It functions as a SOCKS5 proxy server, a DNS tunneling tool, and a network traffic obfuscator to help users access blocked websites. The software implements masking protocols to hide the origin and destination of data to evade restrictive firewalls. It provides capabilities for network traffic obfuscation and secure DNS tunneling to protect network privacy and resolve blocked domains. The system handles wide-scale traffic management by intercepting system network traff

NekoBoxForAndroid is a network utility for Android that functions as a system-wide VPN tunneling client. It leverages the Sing-Box engine to capture and redirect device traffic through a virtual network interface, providing a centralized platform for managing proxy connections and network routing. The application distinguishes itself through its advanced configuration management, allowing users to define granular traffic rules based on domains, IP addresses, or specific applications. It supports complex network requirements by enabling multi-hop proxy chaining, custom DNS resolution strategie

GoodbyeDPI is a censorship circumvention utility designed to bypass deep packet inspection and restrictive network filtering. It functions as a background engine that intercepts and modifies network traffic at the kernel level, allowing users to maintain connectivity in environments where specific protocols or web content are blocked. The tool employs active manipulation techniques to confuse inspection hardware, including TCP stream fragmentation, HTTP header obfuscation, and the injection of out-of-order packets. By altering packet structures and dropping specific redirection patterns, it m

Webmin is a web-based administration interface for Unix systems. It provides a centralized console for managing the full range of server administration tasks — users and groups, software packages, storage, network configuration, system services, and security — all through a browser. Its modular architecture allows separate modules to handle databases (MySQL, MariaDB, PostgreSQL), web servers (Apache), DNS (BIND), email (Sendmail, Dovecot), file sharing (Samba, NFS), and more, with a unified access control system that restricts what each administrator can see and do. What sets Webmin apart is

The AWS Cloud Development Kit is an infrastructure-as-code framework that enables developers to define and provision cloud resources using familiar programming languages. By utilizing construct-based synthesis, it translates high-level, object-oriented code into declarative templates, allowing for the automated management of complex cloud environments through a centralized, code-driven control plane. The framework distinguishes itself through its ability to model infrastructure as a dependency-aware resource graph, ensuring that components are provisioned and updated in the correct order. It

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

wireguard-go is a Go implementation of the WireGuard protocol that operates as a userspace tunneling engine. It functions as a cross-platform network interface designed to establish encrypted tunnels between peers without requiring modifications to the system kernel. By implementing the protocol in userspace, this project provides a consistent network stack that enables secure peer-to-peer communication across different operating systems. It allows for the creation and management of encrypted network interfaces and tunnels to route private traffic over public networks.

ShadowsocksR is a Python-based implementation of a SOCKS5 proxy server designed to tunnel network traffic through encrypted connections. It functions as an encrypted network tunnel that obfuscates internet traffic to circumvent network restrictions and firewalls. The project includes security hardening features to protect the proxy server from unauthorized access, specifically by blocking IP addresses that attempt brute force credential attacks. The server manages bidirectional TCP and UDP traffic and can be executed as a background system daemon to maintain persistent connectivity. It suppo

udp2raw is a network tunneling tool designed to bypass firewalls and obfuscate UDP traffic. It wraps UDP packets in alternative headers and utilizes raw socket networking to move data through networks that otherwise block or throttle UDP traffic. The project distinguishes itself by simulating TCP connections, mimicking the three-way handshake and sequence numbering to trick firewalls into treating UDP streams as TCP traffic. It further stabilizes these connections through heartbeat-driven port rotation, which automatically switches ports to recover sessions after detected failures. The tool

Pingtunnel is a network utility that implements ICMP tunneling by encapsulating TCP and UDP traffic within ICMP echo packets. It functions as an encrypted network tunnel and a SOCKS5 proxy server, allowing network traffic to be routed through a secure channel to bypass restrictive firewalls and network filters. The tool secures transmitted data using symmetric encryption to prevent interception of the tunneled payload. It uses a SOCKS5 proxy interface to accept standard network requests and redirect them into the ICMP tunnel. The system includes adaptive network polling to balance latency an

This project provides an open-source VPN client that creates an unrestricted tunnel to bypass internet censorship without fees, registration, speed caps, or data limits. It offers free, unlimited VPN tunneling with no sign‑up required, enabling access to blocked websites and unrestricted browsing. The application uses the WireGuard protocol for encrypted traffic routing, backed by kernel‑level packet forwarding to minimize overhead. It includes automatic server discovery that selects the most responsive server based on real‑time latency, a connection keepalive mechanism to detect and restore

dnscrypt-proxy is an anonymizing DNS proxy and encrypted DNS resolver. It acts as a local DNS forwarder that secures internet lookups by wrapping standard DNS queries in encrypted tunnels using the DNSCrypt and DNS-over-HTTPS protocols to prevent eavesdropping and tampering. The project provides network privacy protection by routing DNS requests through anonymized relays to obfuscate the client's original IP address. It further distinguishes itself through traffic management capabilities, such as mapping specific domains to designated resolvers and distributing queries across multiple servers