Projects sharing features with Pwnat

kubefwd is a Kubernetes network tunneling and service forwarding utility that maps remote cluster services to local loopback addresses. It synchronizes the local hosts file to resolve Kubernetes service names to local IP addresses, enabling local development environments to use production hostnames. The project implements a Model Context Protocol server, allowing external AI assistants to discover, browse, and control network forwarding through a standardized interface. It also provides a terminal user interface for managing service forwards, monitoring real-time network traffic, and streamin

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

This project is a comprehensive technical documentation site and reference manual for configuring and deploying WireGuard VPN tunnels and interfaces. It serves as a guide for establishing encrypted network connections between peers using public key authentication to secure data traffic across untrusted networks. The documentation provides specific technical manuals for implementing NAT traversal solutions, including UDP hole punching and the use of bounce servers to connect peers behind restrictive firewalls. It also includes detailed guides on tunnel implementation and protocol references fo

STF is a web-based Android device management platform used to organize and control fleets of Android hardware. It functions as a device farm orchestrator and inventory manager, providing a centralized system for monitoring battery health, hardware specifications, and system versions across multiple devices. The platform distinguishes itself through a web-based screen streamer that allows for real-time interaction and application installation via a browser. It includes a remote ADB controller for executing shell commands and establishing port tunnels, as well as a booking system for time-limit

3proxy is a multi-protocol proxy server and network access control gateway. It functions as a network traffic forwarder capable of routing TCP and UDP traffic across HTTP, SOCKS, and various email and file protocols. The project provides specialized capabilities for secure traffic inspection, including the decryption and analysis of HTTPS and TLS streams through certificate spoofing and mutual authentication. It further supports client identity anonymization by routing outbound traffic through recursive upstream proxy chains. The software covers a broad range of network management functions,

CJDNS is a peer-to-peer VPN and cryptographic network overlay that implements an encrypted IPv6 mesh network. It functions as a distributed hash table router, utilizing a non-hierarchical XOR metric to route traffic across nodes without relying on a central authority or registry. The project distinguishes itself by tying network identity to cryptographic ownership, deriving unique IPv6 addresses from public keys. It ensures secure peer connectivity across NAT boundaries using public-key authentication, end-to-end packet encryption, and a handshake protocol that provides perfect forward secrec

Rathole is a reverse proxy tunneling tool designed to expose local services behind firewalls and network address translation to the public internet. It functions as a secure tunneling infrastructure that enables remote access to private network resources without requiring manual router port forwarding configurations. The system utilizes a client-server architecture where a public-facing gateway coordinates with a private-network agent. It distinguishes itself by multiplexing multiple logical service connections through a single persistent TCP stream, which reduces the overhead of maintaining

Iroh is a peer-to-peer networking stack and distributed system designed for secure direct connections, content-addressed storage, and synchronized data sharing. It provides a foundation for decentralized applications by combining a QUIC-based networking layer with primitives for distributed state and data transfer. The project distinguishes itself through a comprehensive suite of decentralized capabilities, including a distributed data store using conflict-free replicated data types for collaborative synchronization and a content-addressed storage system for verifiable, resumable transfers of

SSH.NET is a .NET library that implements the SSH-2 protocol for encrypted remote connections and secure file transfers. It provides a complete SSH-2 protocol stack implementation with a channel multiplexing engine that manages multiple concurrent channels over a single connection, supporting simultaneous shell sessions, remote command execution, SFTP transfers, and port forwarding tunnels. The library includes a pluggable authentication pipeline supporting password, public key, certificate, keyboard-interactive, and multi-factor authentication combinations. The library distinguishes itself t

Filepizza is a web-based peer-to-peer file sharing application that enables direct browser-to-browser data exchange. It utilizes WebRTC to establish connections between devices, allowing files to be sent without uploading data to a central server. The project provides a password-protected file sharing mechanism that secures transmissions via symmetric-key stream encryption. It includes a containerized signaling server that can be self-hosted to coordinate connections between peers and facilitate NAT traversal across restrictive networks and firewalls. The application supports multi-file tran

alt-sendme is an accountless peer-to-peer file transfer tool designed for sending files and folders directly between devices. It operates as a decentralized sharing service that utilizes portable access tickets for identity exchange instead of centralized user accounts. The project distinguishes itself through NAT and firewall traversal capabilities, using UDP hole punching and relay-based fallback routing to establish direct connections between remote devices. It supports multi-device data broadcasting, allowing a single file or folder to be shared with multiple recipients simultaneously thr

Innernet is a WireGuard VPN mesh orchestrator and control plane that automates the deployment of encrypted tunnels between distributed peers. It functions as a virtual private network that coordinates endpoint discovery and distributes network configurations from a centralized server to establish a private overlay network. The system differentiates itself through a structured peer management lifecycle, using single-use invitation files for secure onboarding and cryptographic key exchange. It provides granular network segmentation by organizing peers into named CIDR blocks, allowing administra

GameNetworkingSockets is a UDP networking library providing secure transport, peer discovery, and traffic control systems. It implements a networking layer for reliable and unreliable messaging over UDP, including tools for message fragmentation and reassembly. The project features a peer-to-peer NAT traversal tool for establishing direct host-to-host connections by punching through firewalls and network address translation layers. It secures network traffic through encrypted transport and secure key exchange. The library includes a traffic manager to organize data into prioritized lanes to

wireguard-go is a Go implementation of the WireGuard protocol that operates as a userspace tunneling engine. It functions as a cross-platform network interface designed to establish encrypted tunnels between peers without requiring modifications to the system kernel. By implementing the protocol in userspace, this project provides a consistent network stack that enables secure peer-to-peer communication across different operating systems. It allows for the creation and management of encrypted network interfaces and tunnels to route private traffic over public networks.

Ricochet is a decentralized, peer-to-peer anonymous chat client and messaging protocol. It enables the exchange of encrypted text messages and files without relying on central servers, using Tor hidden services to mask the network addresses and identities of all participants. The project eliminates communication metadata by removing central coordinating authorities, preventing the discovery of contact lists or timing patterns. It utilizes a peer-to-peer connection model where every client acts as both a server and a client, employing public key signatures and cryptographically signed invitati

Rathole is a high-performance reverse proxy and NAT traversal tool written in Rust. It functions as a secure tunneling server and client architecture designed to expose local services to the internet by forwarding traffic from a public IP to a private device behind a firewall. The system establishes encrypted tunnels between a public server and a private host to ensure private communication. It utilizes token-based authentication to validate identities between the server and client for each individual service. The project provides TCP and UDP port forwarding and manages private tunnels to fa

RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged user without holding root access on the host. It creates unprivileged user and mount namespaces to simulate fake root execution environments, allowing users to execute container workloads and manage resource groups safely. The project provides capabilities for rootless port forwarding and unprivileged network namespace isolation, routing container network traffic through user-mode packet translation without requiring privileged kernel setup. It includes multiple backend netwo

This is a network routing tool written in Go that functions as a layer 4 traffic router. It serves as a TCP network forwarder designed to route incoming traffic from a local port to a remote destination address. The project implements reverse proxy and local port forwarding capabilities to redirect network packets from a specific local interface to a backend server. It manages network traffic routing by binding listeners to local IP addresses and ports, piping raw bytes between clients and remote destinations.

libp2p is a modular peer-to-peer networking stack designed for building decentralized applications. It provides the core infrastructure necessary for nodes to discover and connect with other participants across a network without relying on central servers. The project distinguishes itself through a flexible transport layer that abstracts multiple protocols, including TCP, QUIC, WebSockets, and WebTransport, into a single interface. It features specialized tools for NAT and firewall traversal, such as hole punching and relay nodes, to establish direct connections between peers and web browsers

zrok is a zero trust networking service that provides a secure overlay mesh to expose local services and files through firewalls and NAT without the need for manual port forwarding. It functions as a zero trust network manager, orchestrating identities, policies, and routers to establish secure connectivity between applications and users. The project distinguishes itself through the use of identity-based routing and hardened HTTP frontends that integrate with external identity providers. These capabilities allow for the creation of identity-aware proxies and secure reverse proxies that authen

sshcode is a tool for deploying remote IDEs that installs and runs a VS Code editor on a remote server over SSH for browser-based access. It functions as an SSH remote IDE deployer and tunneling proxy, routing the remote editor instance to a local browser port via secure shell encrypted tunnels. The system synchronizes local editor settings and extensions to a remote server to ensure consistent development environments. This includes backing up and transferring user configurations between local machines and remote filesystems. The project manages the full lifecycle of remote development, inc

WVP-GB28181-Pro is a video surveillance platform built around the GB28181 standard, functioning as a streaming media server that manages GB28181-compliant cameras and NVRs. It also serves as a JT/T 808 vehicle gateway, bridging JT/T 808 and JT/T 1078 vehicle devices into the surveillance network, and acts as a multi-protocol video aggregator that unifies GB28181, JT/T 808, JT/T 1078, and ONVIF protocols under a single management interface. The platform supports NAT traversal for connecting devices across different network segments and ingests video from GB28181, ONVIF, and RTSP sources, output

This project is a peer-to-peer networking tool and communication client designed for exchanging messages and sharing screen control between computers without a central server. It functions as a decentralized system for exchanging data and control signals directly between nodes. The application uses WebRTC for peer-to-peer messaging and remote desktop administration. It incorporates STUN-based NAT traversal and rendezvous servers to establish direct connections between peers hidden behind restrictive firewalls or routers. The software provides capabilities for remote desktop control, includin

i2pd is a C++ implementation of the I2P anonymous network layer, serving as a peer-to-peer overlay network and I2P network router. It functions as a decentralized communication system that masks IP addresses and encrypts data using a garlic routing protocol. This project provides a lightweight daemon that acts as a self-hosted privacy gateway, connecting local applications to the I2P network for private data transmission without the use of Java. The system covers anonymous peer communication, privacy-preserving networking, and secure client-server interactions. It implements end-to-end encry

Boringtun is a Rust-based library and userspace implementation of the WireGuard protocol. It provides the necessary logic to establish encrypted network tunnels and route secure traffic across different operating systems without requiring kernel-level administrative privileges. The project is designed for embedding VPN logic into other applications. It achieves this through a C-compatible binary interface and cross-platform native bindings, allowing other programming languages to incorporate tunnel operations and peer management into their own software.

rustdesk-server is a self-hosted remote desktop server infrastructure designed to manage ID signaling and relay traffic for remote connections between peers. It provides the necessary backend environment to coordinate remote access sessions through rendezvous-based signaling and relay-based traffic forwarding. The system distinguishes itself with a remote access management console for organizing devices and enforcing security policies, as well as an identity integrator for OIDC-based federation and LDAP directory synchronization. It utilizes geolocation-aware routing to distribute traffic acr

Argosbx is an automated deployment script and multi-protocol proxy manager designed to expose local services to the internet using Cloudflare Argo tunnels. It functions as a tool for installing and configuring network tunneling kernels, including Sing-box and Xray, to create secure proxies and bypass network restrictions without the need for open firewall ports. The project distinguishes itself by providing a proxy subscription generator that creates formatted and password-protected URLs for syncing configurations across client devices. It also manages diverse tunneling protocols, such as VLE