Open-source alternatives to Shadowrocket ADBlock Rules Forever

This project provides a collection of structured, binary-encoded routing datasets designed for proxy software to automate network traffic management. By mapping domain names and IP addresses to specific functional categories, it enables proxy clients to make granular, policy-based connection decisions. The repository serves as a centralized source for routing metadata, ensuring that traffic steering logic remains consistent across various networking implementations. The project distinguishes itself through an automated aggregation pipeline that processes community-maintained datasets into a u

BPB-Worker-Panel is a control panel designed for deploying and managing VLESS and Trojan proxies hosted on Cloudflare Workers. It functions as a proxy subscription generator and a manager for secure DNS over HTTPS servers and WireGuard configuration provisioning. The project distinguishes itself through network traffic obfuscation capabilities, utilizing packet fragmentation and SNI spoofing to evade detection. It provides specialized administration for Cloudflare Warp and Warp Pro connections, including the ability to optimize endpoints and export WireGuard configurations. The system covers

This project provides a set of curated configuration rules and domain lists for the Shadowrocket app. It consists of network traffic routing rules, ad-blocking domain lists, DNS configuration profiles, and proxy bypass lists used to filter and direct network traffic. The rules establish policy-based routing logic to determine whether specific traffic is proxied, connected directly, or rejected. This includes specialized lists for proxy bypass management and the blocking of known advertising and tracking domains at the network level. The project covers a broad range of traffic management capa

Emissary is a Kubernetes API gateway that manages incoming external traffic and routes it to internal microservices. It utilizes an Envoy proxy as the underlying data plane to handle high-performance traffic routing and protocol translation, with a control plane that translates Kubernetes custom resources and annotations into proxy configurations. The project provides specialized support for gRPC infrastructure, including HTTP/2 routing and gRPC-Web protocol bridging for browser-based clients. It enables zero-trust security through mutual TLS encryption and delegates identity verification to

Mihomo is a rule-based network proxy and traffic orchestrator designed to manage internet connections by intercepting and routing data packets. It functions as a background service that directs traffic through various proxy nodes based on user-defined policies, allowing for granular control over outbound network paths. The engine distinguishes itself through a sophisticated domain pattern matching system that utilizes wildcard and suffix-based algorithms to categorize web traffic. It supports complex configuration management by allowing users to define reusable data blocks and import external

gost is a multi-protocol proxy tunnel and secure tunneling server designed to route network traffic through encrypted connections. It functions as a traffic obfuscation gateway and a transparent proxy server capable of intercepting TCP and UDP traffic at the IP level. The project also includes a virtual network interface manager for creating TUN and TAP devices to intercept operating system packets. The system distinguishes itself through a chain-based request routing model, allowing traffic to pass through an ordered sequence of proxy nodes. It provides extensive transport-layer encapsulatio

Shadowsocks-Windows is a desktop proxy manager that provides a graphical interface for configuring system-wide network routing. It functions as a local SOCKS5 or HTTP proxy server, intercepting outbound traffic through system-level injection to route requests through secure, encrypted remote tunnels. The application distinguishes itself through a modular architecture that supports plugin-based transport extensibility, allowing users to integrate external binaries for custom traffic obfuscation and specialized cryptographic protocols. It also enables high-availability networking by automatical

Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol manipulation. It functions as a gateway that intercepts, inspects, and modifies network traffic in real-time, supporting HTTP, HTTPS, WebSocket, DNS, and generic TCP or UDP streams. By acting as a trusted certificate authority, the proxy can dynamically generate and sign certificates to decrypt and analyze secure TLS-encrypted connections. The project distinguishes itself through a highly extensible, event-driven architecture that allows users to automate traffic transformation using cust

Zapret is a deep packet inspection bypass tool and packet manipulation framework designed to circumvent network censorship. It operates as a transparent network proxy and TCP traffic obfuscator that modifies packets to deceive network inspection systems. The project distinguishes itself through advanced desynchronization strategies, including the modification of TLS client hello handshakes and the use of fake packet injection. It utilizes a combination of TCP stream segmentation, sequence overlapping, and TTL adjustment to hide prohibited requests from firewalls while ensuring the destination

This project is a service mesh platform designed to manage, secure, and observe service-to-service communication within Kubernetes clusters. It functions as a control plane that orchestrates transparent sidecar proxies, which intercept and manage network traffic to provide reliable connectivity for microservices. By automating the injection of these proxies, the platform ensures that infrastructure-level policies are applied consistently across all workloads without requiring manual configuration changes. The platform distinguishes itself through its focus on zero-trust security and cross-clu

This project provides predefined configuration profiles and rule sets for ad filtering, geographic traffic steering, and proxy routing. It specifically offers curated rule sets and configuration lists for Shadowrocket to filter advertising domains and manage network traffic on iOS devices. The project specializes in converting industry-standard ad-blocking filter lists into a proprietary rule format compatible with proxy client configurations. These rule sets facilitate the separation of domestic and foreign network requests to optimize connection paths and bypass regional restrictions. The

ShadowsocksX-NG is a macOS application that functions as a Shadowsocks proxy client to establish encrypted tunnels for bypassing network censorship. It operates as an encrypted tunnel manager that allows for the configuration of secure ciphers and the import of proxy server profiles. The client includes a proxy converter that transforms SOCKS5 traffic into HTTP proxy traffic to provide compatibility for applications that do not support SOCKS. It also integrates a traffic steering system using Proxy Auto-Configuration files to automatically determine which network requests bypass the proxy. T

yacd is a browser-based dashboard for managing and configuring Clash proxy servers. It provides a graphical web interface that allows users to view and edit proxy settings, switching between network nodes and adjusting routing rules without manually editing configuration files. The application acts as a client to the Clash backend REST API, enabling real-time operations such as proxy group administration, traffic routing configuration, and connection parameter tuning. Its single-page application shell handles all state management on the client side, with form validation catching input errors

clashN is a cross-platform proxy manager and graphical user interface client for the Clash proxy core. It serves as a visual wrapper that enables the configuration of network tunnels and the routing of internet traffic to bypass network restrictions on desktop operating systems. The application functions by decoupling the management interface from the network engine, using a local API to dispatch configuration updates and control the proxy core. It includes a subscription converter that translates external provider profiles into standardized configuration schemas compatible with the underlyin

meta-rules-dat is a collection of binary-encoded network datasets used to identify and categorize traffic for routing on resource-constrained devices. It provides a structured domain categorization list and a geographic IP routing dataset to map network traffic to specific countries or service providers. The project utilizes trie-based lookup data and compact binary serialization to enable high-performance prefix matching and fast domain-to-category resolution. To minimize memory and storage overhead, it employs stripped-down GeoIP mapping that removes non-essential metadata. The datasets co

Glider is a multi-protocol forward proxy, transparent proxy gateway, and network service provider. It functions as a DNS and DHCP server, a Linux IP set manager, and a network traffic load balancer. The project distinguishes itself through a protocol-translation bridge that translates traffic between different proxy schemes and a chain-based routing system that sequences multiple remote proxy servers. It supports transparent traffic interception at the system level and utilizes build-time protocol stripping to minimize the binary size of the executable. The system covers a broad range of net

This project is a Go-based HTTP proxy server designed as a censorship circumvention tool. It functions as an upstream proxy manager and SOCKS5 tunneling gateway that routes network traffic between clients and destination servers to bypass network restrictions. The system differentiates itself through automated proxy routing, which detects unreachable websites and automatically switches traffic between direct access and a pool of parent proxies. It includes a PAC file generator to produce proxy auto-config files for browsers and integrates SSH tunneling to establish secure remote sockets. Bro

ClashMac is a macOS network proxy manager and graphical user interface client for the Clash core. It serves as a system tool for controlling network traffic routing, managing proxy nodes, and organizing network subscriptions. The project distinguishes itself through an interactive network traffic visualizer that renders real-time data flows and multi-hop proxy connection paths on a global map. It also includes a command line network controller that provides machine-readable data for custom scripting and network automation. The software covers broad capability areas including rule-based traff

V2rayU is a native macOS network proxy tool and multi-protocol proxy manager. It functions as a V2Ray proxy client that enables users to route network traffic through secure tunnels to bypass network restrictions on Mac. The application features a TUN mode VPN client that uses a virtual network adapter to forward all system traffic through a secure tunnel. It supports configuring and switching between V2Ray, Shadowsocks, and Socks5 proxy servers via manual entry or external subscriptions. The tool provides capabilities for network traffic routing, proxy load balancing, and server configurati

GUI.for.SingBox is a desktop graphical interface client for managing the sing-box network proxy core. It functions as a network proxy manager and subscription manager, allowing users to configure routing rules, organize proxy profiles, and synchronize remote proxy server lists from external subscription providers. The application distinguishes itself through an event-driven plugin architecture and a script-based configuration middleware, enabling users to extend core functionality and programmatically modify configuration values. It also features a system for cross-platform settings synchroni

Subconverter is a network utility designed to translate, merge, and filter proxy subscription configurations. It functions as a service that converts proxy links between various client-specific formats, ensuring compatibility across different applications and platforms. By providing a unified interface for managing diverse connection sources, the tool enables consistent network policy application and streamlined configuration management. The project distinguishes itself through an HTTP-based transformation interface that processes subscription data dynamically. It utilizes an in-memory pipeli

ngrok is a secure TCP tunneling proxy and API ingress controller that exposes local services to the public internet. It establishes a persistent connection between a local agent and a cloud-based gateway to route traffic to local ports without requiring firewall or router configuration changes. The project provides a global gateway for routing API traffic, which includes built-in support for rate limiting and authentication policy enforcement. It also functions as an IoT device gateway, enabling remote command execution and access control for embedded hardware via a cloud-to-device bridge. A

This project is a censorship circumvention utility designed to maintain connectivity to restricted online services by evading deep packet inspection. It functions as a network traffic redirection service that manipulates packet headers at the transport layer to bypass regional network filters and censorship systems. The tool distinguishes itself by providing granular control over traffic management, allowing users to define specific lists of domains and IP addresses for targeted interception. By applying custom bypass strategies only to these designated hosts, the utility ensures that the rem

This project provides a containerized DNS sinkhole and network-wide traffic filtering solution. It functions as a central network resolver that intercepts domain queries, allowing users to block advertisements, trackers, and malicious domains by returning null responses to connected devices. The platform distinguishes itself through its integrated DHCP server and comprehensive management capabilities, which allow for automated IP address allocation and granular control over network traffic. It supports complex filtering through regular expression matching, hierarchical rule prioritization, an

This project is an automated reverse proxy and load balancer designed for containerized environments. It functions by monitoring container lifecycle events through the container runtime API, allowing it to dynamically generate and update web server configurations in real time as services start, stop, or change their network status. The system distinguishes itself through its ability to orchestrate proxy processes without dropping active connections, ensuring continuous availability during configuration updates. It utilizes a template-based engine to map container metadata to routing logic, en

Dev-sidecar is a local HTTP proxy tool designed to optimize development environments by intercepting and modifying network traffic. It functions as a man-in-the-middle service that routes outgoing requests through custom endpoints, enabling developers to accelerate access to remote services, manage package registry connections, and bypass regional connectivity restrictions. The tool distinguishes itself through its ability to perform dynamic DNS resolution overrides and certificate-based traffic inspection, allowing for granular control over network paths and secure data analysis. It employs

Pangolin is a zero-trust remote access platform designed to provide secure, identity-aware connectivity to private network resources. It functions as a cloud-native network controller that orchestrates encrypted tunnels, traffic routing, and access policies across distributed environments. By leveraging WireGuard for secure data transport, the platform enables authenticated access to internal web applications, terminal sessions, and remote desktops without exposing services to the public internet. The platform distinguishes itself through a declarative infrastructure model that synchronizes n