Open-source alternatives to Wireproxy

mcp-context-forge is a Model Context Protocol federation gateway that unifies diverse AI tool servers and APIs into a single consistent interface for discovery and execution. It acts as a centralized proxy that aggregates multiple servers and APIs, allowing AI agents to access and invoke a unified set of tools, prompts, and resources. The project distinguishes itself through a multi-protocol translation bridge that converts communication between standard I/O, SSE, gRPC, and REST to enable interoperability between disparate tool servers. It includes a comprehensive LLM evaluation framework for

3proxy is a multi-protocol proxy server and network access control gateway. It functions as a network traffic forwarder capable of routing TCP and UDP traffic across HTTP, SOCKS, and various email and file protocols. The project provides specialized capabilities for secure traffic inspection, including the decryption and analysis of HTTPS and TLS streams through certificate spoofing and mutual authentication. It further supports client identity anonymization by routing outbound traffic through recursive upstream proxy chains. The software covers a broad range of network management functions,

This project is a comprehensive technical documentation site and reference manual for configuring and deploying WireGuard VPN tunnels and interfaces. It serves as a guide for establishing encrypted network connections between peers using public key authentication to secure data traffic across untrusted networks. The documentation provides specific technical manuals for implementing NAT traversal solutions, including UDP hole punching and the use of bounce servers to connect peers behind restrictive firewalls. It also includes detailed guides on tunnel implementation and protocol references fo

wstunnel is a tool that tunnels arbitrary TCP traffic through WebSocket connections, enabling communication across restrictive firewalls and proxies. It operates as both a client and server, encapsulating TCP data within WebSocket binary frames and multiplexing multiple connections over a single WebSocket link. The tool supports mutual TLS authentication, requiring clients to present signed certificates for verification before establishing a tunnel, and provides shared secret access control and tunnel forwarding restrictions for additional security. The project distinguishes itself by offerin

naiveproxy is a censorship circumvention tool and traffic obfuscation proxy. It functions as an HTTP/2 transport proxy that tunnels SOCKS5 traffic over HTTP/2 to hide network activity and bypass network blocks. The project distinguishes itself by mimicking standard web browser requests to evade deep packet inspection. It employs traffic camouflage techniques such as redirecting unauthorized probing requests to decoy web servers and using randomized packet padding to defeat length-based traffic analysis. The software provides a local SOCKS5 proxy endpoint, credential-based request authenticat

Unblock-Youku is a geo-blocking circumvention tool and proxy server designed to grant access to region-locked video streaming and web services. It functions as a regional content unblocker that masks a user's location to bypass geographic restrictions. The system operates as an SNI proxy server, forwarding HTTPS traffic based on the Server Name Indication without decrypting the payload. It also serves as a transparent proxy gateway and a DNS-based request router that directs network traffic to specific proxy servers by modifying name resolution records for regional domains. Its capabilities

Sish is a reverse SSH proxy and tunneling server designed to expose local services to the internet. It functions as an SSH tunneling proxy that routes HTTP, WebSocket, and TCP traffic from a remote server to a local machine, enabling the creation of public URLs for local applications. The project distinguishes itself through a combination of an SNI proxy for routing encrypted TLS traffic without decryption and a TCP load balancer that distributes incoming requests across multiple backend targets. It also includes a dedicated service console for real-time inspection and debugging of forwarded

Boringtun is a Rust-based library and userspace implementation of the WireGuard protocol. It provides the necessary logic to establish encrypted network tunnels and route secure traffic across different operating systems without requiring kernel-level administrative privileges. The project is designed for embedding VPN logic into other applications. It achieves this through a C-compatible binary interface and cross-platform native bindings, allowing other programming languages to incorporate tunnel operations and peer management into their own software.

This project is a censorship circumvention tool and transparent proxy gateway designed to bypass local network restrictions. It functions as a SOCKS5 proxy server, a DNS tunneling tool, and a network traffic obfuscator to help users access blocked websites. The software implements masking protocols to hide the origin and destination of data to evade restrictive firewalls. It provides capabilities for network traffic obfuscation and secure DNS tunneling to protect network privacy and resolve blocked domains. The system handles wide-scale traffic management by intercepting system network traff

Shadowsocks-iOS is a proxy client for iOS devices that implements the Shadowsocks protocol to tunnel network traffic through a secure, encrypted relay. Its primary purpose is to route device traffic through a proxy server to bypass network censorship and regional restrictions. The project establishes secure proxy tunneling to protect data from local monitoring and hide internet activity. It manages iOS network traffic routing using custom encryption protocols to avoid network interference. The implementation utilizes a system-level network extension framework and a local virtual network inte

ByeByeDPI is a network utility designed to circumvent regional blocking and censorship by evading deep packet inspection. It functions as a traffic tunnel and local SOCKS5 proxy server that modifies network packets to prevent filters from identifying and blocking specific content. The project employs a user-mode network stack to manipulate traffic at the application level. It achieves bypass capabilities through TCP packet fragmentation and the modification of HTTP request header formatting and case sensitivity. The system includes application-level tunneling control to determine which progr

This is a network routing tool written in Go that functions as a layer 4 traffic router. It serves as a TCP network forwarder designed to route incoming traffic from a local port to a remote destination address. The project implements reverse proxy and local port forwarding capabilities to redirect network packets from a specific local interface to a backend server. It manages network traffic routing by binding listeners to local IP addresses and ports, piping raw bytes between clients and remote destinations.

goflyway is an encrypted traffic relay and HTTP TCP tunneling proxy. It encapsulates TCP traffic within HTTP POST or WebSocket requests to bypass restrictive firewalls and network proxies. The system provides a SOCKS5 proxy server that routes traffic via a WebSocket relay and includes a UDP over TCP tunnel to enable transport across networks that block UDP traffic. It also functions as a TCP traffic interceptor for capturing and inspecting data passing through relayed connections. Capabilities cover network tunneling and traffic proxying through various transport protocols, including HTTP PO

This repository is a technical documentation site and a collection of guides and references for implementing networking, security, and cloud infrastructure services. It functions as a static-site generated portal and a headless content platform, separating source files from the presentation layer to enable flexible rendering. The project utilizes markdown-based documentation stored in a version-controlled Git repository. It provides specialized technical content including an AI platform documentation for building agents and managing inference, a cloud infrastructure guide for DNS and CDN conf

shadowsocks-libev is an event-driven network daemon that provides an encrypted SOCKS5 proxy. It functions as a lightweight proxy server using a non-blocking event loop to route TCP and UDP traffic through encrypted tunnels to bypass network restrictions. The project implements a transparent proxy gateway capable of intercepting outbound packets at the network layer, allowing system traffic to be redirected through the encrypted tunnel without per-application configuration. It also includes a daemon process manager to control multiple proxy server instances as child processes via local communi

Gnirehtet is a reverse tethering tool that allows Android devices to share a computer's internet connection over USB. It functions as a network relay for TCP and UDP IPv4 traffic using the Android Debug Bridge protocol. The system provides connectivity for Android devices without requiring root access by utilizing a local virtual network interface to intercept traffic. It includes a manager capable of controlling and resetting relay sessions for multiple connected devices from a single server. The tool supports batch connection activation and the management of individual device tunnels. It e

This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

Linkerd is a Kubernetes service mesh that manages network traffic between microservices. It functions as a transparent networking proxy, layer 7 traffic manager, and mutual TLS security layer, providing observability and reliability for service-to-service communication without requiring changes to application code. The project distinguishes itself through a sidecar-proxy architecture that intercepts TCP and application-level traffic to provide automatic mutual TLS encryption and identity verification. It enables cross-cluster service networking to link multiple clusters and implements cloud-n

Zoraxy is a network administration tool centered on HTTP reverse proxy management. It provides a centralized graphical interface for routing web traffic from public domains to internal backend services, utilizing a Go-based proxy to intercept and forward requests. The project extends beyond standard web routing by offering a browser-based SSH interface for remote server administration and command execution. It also supports transport-layer TCP and WebSocket forwarding to manage non-HTTP traffic between external clients and internal ports. Broad capabilities include automated TLS certificate

The Gateway API is a standardized set of resources for routing HTTP, gRPC, and TCP traffic into and within Kubernetes clusters. It serves as a framework for defining load balancer listeners and routing rules for both Layer 4 and Layer 7 protocols, acting as a specification for ingress and service mesh traffic interfaces. The project utilizes a role-oriented configuration that separates infrastructure provisioning from routing logic. It implements a class-based provider selection system to match requested infrastructure to specific controller implementations and employs a conformance-driven sp

Websocat is a specialized set of command-line tools for WebSocket communication, acting as a client, server, and stream processor. It provides a terminal-based interface for connecting to WebSocket servers, hosting secure WebSocket servers, and bridging data between WebSockets and other network transports. The project distinguishes itself by functioning as a bidirectional network relay, allowing the routing of data between WebSocket streams, TCP sockets, UNIX sockets, and standard system input and output. It includes specialized implementations for SOCKS5 and HTTP proxying, as well as a strea

nps is an intranet penetration proxy server that exposes internal network services to the public internet via secure TCP and UDP tunnels. It functions as a traffic forwarder and reverse proxy, enabling external access to local services, remote desktops, and internal APIs. The project is distinguished by a centralized web-based administration interface used to configure tunnels, manage user accounts, and monitor real-time bandwidth metrics. It supports domain-based request routing and provides a mechanism to secure public services using HTTPS encryption through digital certificates. The syste

WinSCP is a remote file manager and SFTP and FTP client that provides a graphical interface for browsing, editing, and organizing files on remote servers and cloud storage. It serves as a multi-protocol tool supporting SFTP, FTP, FTPS, SCP, S3, and WebDAV, and functions as an S3 object storage browser for managing files and buckets. The application distinguishes itself through its automation capabilities, allowing for scripted file transfers and remote command execution via a command-line interface or a .NET assembly. It also features directory synchronization to match local and remote folder

CJDNS is a peer-to-peer VPN and cryptographic network overlay that implements an encrypted IPv6 mesh network. It functions as a distributed hash table router, utilizing a non-hierarchical XOR metric to route traffic across nodes without relying on a central authority or registry. The project distinguishes itself by tying network identity to cryptographic ownership, deriving unique IPv6 addresses from public keys. It ensures secure peer connectivity across NAT boundaries using public-key authentication, end-to-end packet encryption, and a handshake protocol that provides perfect forward secrec

FXMinerProxy is a Stratum mining proxy and hardware management tool that intercepts and routes traffic between cryptocurrency hardware and mining pools. It functions as a middleware system for managing mining farms, allowing for the encryption of miner traffic and the redirection of mining rewards to custom wallets. The project features a specialized fee collection system that deducts development and operator fees using tiered scaling and conversion rate calculations. It also includes a remote administration suite for pushing configuration updates, executing shell commands on connected client

Trojan is a censorship circumvention tool and TLS proxy server designed to bypass network restrictions by imitating legitimate web services. It functions as a TLS traffic obfuscator that masks proxy activity by mimicking the handshake and data flow of standard HTTPS requests. The system disguises network traffic as common web browsing to avoid deep packet inspection. It achieves this by wrapping TCP and UDP data within TLS encryption and forwarding unauthenticated or unauthorized requests to a legitimate destination website to hide the proxy's purpose. The project provides a tunnel that conv