This repository contains the official IVPN desktop client, a multi-platform VPN application supporting Windows, macOS, and Linux. It is composed of three main components: a privileged Go daemon that manages VPN connections (OpenVPN, WireGuard, V2Ray), firewall (kill switch), DNS (including DNSCrypt-proxy for DoH), split tunneling, and WiFi trusted networks; a Go CLI for command-line control; and an Electron/Vue.js UI for graphical interaction. The daemon and clients communicate over a local TCP JSON protocol with authentication and event push. The codebase demonstrates strong engineering practices: platform abstraction via build tags, a custom ICMP ping library, a reusable logger, a type-safe IPC client library documented for third-party integration, and Windows WFP wrappers for firewall and split tunneling. Build scripts and native projects (Windows kernel driver, macOS helpers) handle cross-platform packaging and signing.
This repository is a web-based management panel for sing-box proxy servers, providing a Gin-based web UI and REST API for configuring inbounds, outbounds, clients, subscriptions, and traffic statistics. It includes custom protocol implementations for many proxy protocols (VMess, VLESS, Trojan, Shadowsocks, Hysteria, TUIC, etc.), session tracking, and subscription generation in multiple formats (plain, JSON, Clash). The architecture is modular with core, service, API, and sub packages, using SQLite for persistence and a cron job system for stats collection and maintenance. The codebase demonstrates strong engineering practices with reusable components like a session registry, graceful QUIC shutdown wrapper, and security middleware. However, it is tightly coupled to sing-box internals, requiring custom manager copies to preserve hot add/remove functionality that upstream dropped, and it has a history of migration-heavy schema evolution. The project is actively maintained with frequent commits, comprehensive testing, and multi-platform deployment support (Linux, Windows, Docker).
Firezone is a zero-trust network access platform providing secure remote access through VPN-like tunnels. The production system consists of a cloud-based management portal (Elixir/Phoenix), data-plane components (Rust gateways and relays), and native clients for macOS/iOS, Android, Windows, and Linux. The portal manages multi-tenant accounts, identity (OIDC, SAML, email OTP, X.509), access policies, device posture, and logs. It exposes a REST API (PortalAPI) for CRUD operations and WebSocket channels for real-time client/gateway connectivity. The Rust core (connlib) handles ICE/STUN/TURN connectivity, WireGuard tunnels, and eBPF-accelerated packet routing. PostgreSQL is used for persistence with logical replication for change data capture, Oban for background job processing, and Redis for caching/presence. External dependencies include identity providers (Entra, Okta, Google Workspace), device management systems (Intune, Defender, SentinelOne, etc.), log sinks (Splunk, Datadog, Elastic, S3), and billing (Stripe). The architecture separates the web admin interface (PortalWeb), REST API (PortalAPI), and internal ops (PortalOps) into distinct endpoints. Data-plane components (gateway, relay) communicate via WebSockets with the API to receive policy updates. Clients connect to relays using ICE/STUN/TURN. The system uses Phoenix PubSub for real-time updates and Postgres logical replication to propagate changes to connected clients and gateways. Key entry points: PortalWeb.Endpoint (admin UI), PortalAPI.Endpoint (REST/WebSocket for clients and gateways), PortalOps.Endpoint (ops dashboard). Rust binaries: firezone-gateway, firezone-relay, firezone-headless-client, firezone-gui-client. Mobile apps: Firezone iOS/macOS (Swift), Firezone Android (Kotlin).
MicroLink v2 is a production-ready Tailscale VPN client for ESP32-S3 devices that establishes secure WireGuard tunnels through Tailscale's control plane. It implements the full Tailscale protocol stack including Noise protocol for control plane encryption, HTTP/2 framing, DISCO peer discovery, STUN for NAT traversal, DERP relay fallback, and WireGuard encryption via wireguard-lwip integration. The architecture uses a multi-task FreeRTOS design with separate tasks for coordination, WireGuard management, DERP transmission, network I/O, and application logic, communicating via message queues and event groups. Key features include WiFi/cellular network failover with health monitoring, zero-copy WireGuard receive option for high-throughput scenarios, NVS-based peer caching with LRU eviction, and an HTTP configuration server for runtime management. The code demonstrates strong protocol fidelity through direct reference to Tailscale's Go source files while adapting to embedded constraints.
This repository implements a Linux desktop GUI for managing WireGuard VPN profiles. It is built using the Tauri v2 framework, combining a Rust backend for system-level operations (connection management, encryption, file I/O) with a Next.js 16 (React 19) frontend for the user interface. The application allows users to create, import, export, connect, and disconnect WireGuard tunnels, and provides optional at-rest encryption for profile data using a user-defined PIN. The architecture follows a clean IPC-based separation of concerns. The frontend communicates with the Rust backend exclusively through typed Tauri commands defined in `lib/effects.ts`. The backend in `src-tauri/src/main.rs` manages application state, executes WireGuard commands via shell scripts (`wg.sh`), and handles encryption via a dedicated security module. The UI is built from a comprehensive library of ~40+ composable, accessible components in `components/ui/`, demonstrating a strong commitment to frontend architecture and design system principles. The most reusable assets are the Rust security module (`security.rs`), which implements PIN-based encryption using Argon2id and XChaCha20-Poly1305 in a self-contained manner, and the typed IPC service layer (`lib/effects.ts`), which cleanly decouples the UI from the backend. The UI component library, while styled for this project, follows an architectural pattern (atomic, composable primitives) that is directly transferable to other React projects. The project is actively maintained with CI/CD, E2E testing, and semantic versioning, though it carries some technical drift in its Nix build configuration (targeting Tauri v1) and deprecated plugin permissions.
This is the Shadowsocks Android client, a secure proxy/VPN application for circumventing internet censorship. It operates as a multi-module Android project with a core library providing the proxy engine, VPN service, and plugin management, plus separate mobile and TV UI modules. The application routes traffic through a remote SOCKS5 proxy, supporting multiple service modes (VPN, proxy, transproxy), per-app routing via ACL (Access Control List) rules, and native binaries (tun2socks, shadowsocks-rust) compiled via NDK or Rust. Key features include QR code import/export, subscription-based server list updates, and a plugin system that allows third-party native executables (e.g., v2ray, kcptun) to be integrated. The architecture follows Android best practices with Room for persistence, Coroutines for async work, and AIDL for inter-process communication between the UI and foreground services. The codebase is well-organized with extensive testing, CI/CD (CircleCI, GitHub Actions), and localization in over a dozen languages, but shows some technical drift with deprecated APIs and complex native build scripts.
Bettbox is a cross-platform network diversion (proxy) tool built on the Clash.Meta proxy engine. It provides a Flutter-based GUI for Windows, macOS, Linux, and Android, backed by a Go core that implements extensive proxy protocols (VMess, VLESS, Shadowsocks, Hysteria, TUIC, etc.), DNS resolution, TUN/VPN, rule-based routing, and traffic obfuscation. The system manages proxy configurations, supports profile import/export, real-time connection monitoring, and a scriptable code editor plugin.
Pritunl is a production-grade, distributed VPN server management system that provides a web-based admin interface for configuring and monitoring OpenVPN and WireGuard instances. The Python backend (Flask with MongoDB) handles authentication, organization/user management, certificate generation, IP pool allocation, bandwidth monitoring, and enterprise features like site-to-site network links and SSO (SAML, OAuth, LDAP). It runs as a daemon with multiple background runners for task queues, event processing, and firewall rule management. The legacy frontend uses Backbone.js with a newer Dart/AngularDart component set in transition. The architecture is monolithic but modular, with well-defined subsystems for settings, caching, transactions, and plugins. External dependencies include MongoDB, Redis, InfluxDB, OpenVPN, WireGuard, and various cloud provider APIs. The codebase demonstrates strong engineering practices with clean abstractions (MongoObject ORM, event system, queue system, plugin system) but shows some technical drift in the frontend stack and vendored libraries.
WireHole is a Docker Compose project that combines WireGuard, Pi-hole, and Unbound to create a private VPN with ad-blocking and recursive DNS resolution. It is not a software library but an infrastructure deployment template. The stack provides a VPN server, DNS filtering through Pi-hole, and private DNS resolution via Unbound, all running in containers. The project is designed for easy deployment on a Linux server, with a focus on security (e.g., web interfaces bound to localhost, minimal container capabilities, strong password generation). It supports two VPN backends: wg-easy (with a web UI) and linuxserver/wireguard (configuration-file based). The codebase consists of shell scripts for setup, migration, and diagnostics, along with CI/CD pipelines, test suites, and detailed documentation. The project demonstrates high operational maturity with comprehensive tests, pinning of image versions, and a doctor script for troubleshooting. While it is not a reusable software library, its scripts and configuration patterns are well-crafted and could serve as templates for similar Docker Compose deployments.
Podkop is an OpenWrt package for traffic routing using sing-box as the proxy core. It provides a LuCI web interface (TypeScript frontend compiled to JavaScript) with tabs for Settings, Sections (proxy/VPN/block/exclusion), Dashboard (real-time traffic via Clash API WebSocket), and Diagnostic (checks for DNS, sing-box, nftables, FakeIP). The backend consists of shell scripts: /usr/bin/podkop (main entry), /etc/init.d/podkop (procd init), and libraries in /usr/lib/podkop/ (constants.sh, nft.sh, helpers.sh, sing_box_config_manager.sh, etc.). It uses nftables for traffic marking and TPROXY, dnsmasq for DNS hijacking with FakeIP, and downloads community domain/subnet lists from GitHub. It supports proxy protocols: VLESS, Shadowsocks, Trojan, SOCKS, Hysteria2. The architecture is monolithic: the frontend communicates with the backend via shell commands (exec) and WebSocket to the Clash API. The backend manages sing-box configuration, nftables rules, and list updates via cron. Key entry points include install.sh (installation), /usr/bin/podkop (service management), and the LuCI view files. External dependencies include sing-box, jq, curl, nft, coreutils-base64, bind-dig, and the diagnostic endpoints (ip.podkop.fyi, fakeip.podkop.fyi). The system is in beta, with breaking changes possible; users are advised to clear LuCI cache on updates. The codebase demonstrates solid engineering with modular shell libraries, a well-structured TypeScript frontend with unit tests for validators, and CI/CD pipelines. However, it has some drift risks: hardcoded version requirements, compiled JS committed to the repository, and reliance on external services. The frontend includes reusable components such as a reactive store service, WebSocket manager, and composable validators.
PassWall is a LuCI application for OpenWrt routers that provides a unified management interface and runtime orchestration for proxy/VPN clients. In production it runs as a daemon-managed transparent proxy: it generates per-core JSON configurations for xray, sing-box, shadowsocks-rust, SSR, hysteria2, naiveproxy, and other engines; builds iptables/nftables transparent-proxy rules; integrates DNS-level routing through dnsmasq, smartdns, chinadns-ng, or dns2socks; and exposes a full web UI for node management, subscriptions, ACLs, shunt rules, health checks, load balancing via HAProxy, and server-side inbound configuration. The service is configured through UCI (`/etc/config/passwall`), with shell scripts as the main runtime dispatchers and Lua modules as the configuration-generation and LuCI-controller layer.
This repository provides a single Bash script (`wireguard-install.sh`) that serves as an interactive installer and management tool for a WireGuard road warrior VPN server. It supports multiple Linux distributions (Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, Fedora) and handles the full lifecycle: initial server setup with IP/port selection, firewall configuration (firewalld or iptables), client addition and removal, and complete uninstallation. The script also detects containerized environments and falls back to BoringTun (userspace WireGuard) when the kernel module is unavailable, with optional automatic updates via cron. No application framework or tests are present; it is a standalone operational tool intended for direct execution on a target server.
EdgeVPN is a decentralized peer-to-peer VPN and overlay networking tool built on libp2p. It provides a VPN tunnel (TUN interface), TCP service tunneling (ngrok-like), HTTP egress proxy, DNS resolution, file transfer, and a distributed ledger for network state coordination. The architecture is a single Go binary with an embedded React SPA dashboard, exposing a REST API (Echo framework) and CLI (urfave/cli v2). The core innovation is a blockchain-style ledger that stores machine, service, DNS, and health records, with optional signed ownership enforcement and liveness-based reaping. The system uses libp2p for peer discovery (DHT, mDNS), pubsub (gossipsub), relays, and circuit v2. It is designed for decentralized networks without central coordination, and is used in production by Kairos (Kubernetes) and LocalAI (P2P distribution). The codebase demonstrates strong engineering with functional options patterns, comprehensive test suites, documentation generation from CLI code, and a design system for the React UI. However, it carries technical debt from experimental features (PeerGuard, DHCP, IPv6), a forked libp2p-pubsub dependency, and documentation drift that requires manual regeneration.
This is an Android application that serves as a GUI client for XTLS/Xray-core, a proxy/VPN tool. The app provides a comprehensive interface for managing proxy profiles, subscription links, and VPN configurations. It supports both standard VPN mode (using tun2socks) and transparent proxy mode (requiring root). The architecture follows MVVM with Room database for persistence, coroutines for async operations, and a native Go library (XrayCore) for core proxy functionality. The codebase is well-structured, using modern Android development practices (Kotlin, Jetpack libraries, Material Design 3). It includes features like QR code scanning, clipboard import, link management with auto-refresh, per-app routing, and a quick settings tile. The app is actively maintained with frequent updates and a CI/CD pipeline for release builds.
This repository provides a transparent proxy package for OpenWrt using Mihomo (a clash-compatible rule-based proxy core) as the backend. It is a full LuCI application that allows users to configure proxy modes (redirect, TPROXY, TUN), manage subscriptions, define access control rules, and monitor logs through a web interface. The system is designed for OpenWrt ≥24.10 with firewall4 (nftables) and kernel ≥5.13. The architecture consists of three OpenWrt packages: `nikki` (main service and scripts), `mihomo-meta` (stable core), and `mihomo-alpha` (alpha variant). The service is managed via procd init script (`nikki.init`), which handles starting/stopping Mihomo, setting up routing rules and nftables tables, and scheduling tasks. Configuration is stored in UCI (OpenWrt's standard configuration system) and processed through a pipeline: UCI options → `mixin.uc` (ucode script) generates a JSON overlay → `yq` merges it with a base profile → final Mihomo config. Traffic interception rules are generated dynamically from a utpl template (`hijack.ut`) that produces nftables rulesets. Key entry points include the LuCI views (`app.js`, `profile.js`, `mixin.js`, `proxy.js`, `editor.js`, `log.js`) for web-based management, the init script for service lifecycle, and shell scripts for installation/upgrade. External dependencies are Mihomo core, `yq` for YAML processing, and standard OpenWrt tools (procd, nftables, ucode). The repository also includes a large hardcoded nftables set of Chinese IP prefixes (`geoip_cn.nft`) for bypassing mainland China traffic.
This monorepo houses the entire Start9 ecosystem, centered on StartOS—a self-hosted Linux distribution for personal servers. The repository encompasses multiple products: StartOS (server OS with container orchestration, backup, networking, and marketplace), StartWRT (router firmware based on OpenWrt), StartTunnel (WireGuard-based tunnel service), StartCLI (command-line tool), StartRegistry (package registry), and StartSDK (TypeScript SDK for building service packages). The architecture is a hybrid of Rust backend services (using async Tokio, axum, and a custom RPC toolkit) and Angular frontends (using Taiga UI and a reactive PatchDB state store). Key orchestration is handled by the container runtime (Node.js with LXC) and a custom diff-based database (PatchDB) for real-time UI synchronization. The system manages service lifecycle, ACME certificates, DNS, port forwarding, VPNs, encrypted backups, and firmware updates. External dependencies include Linux kernel features (LXC, btrfs, eCryptFS, FUSE, nftables), WireGuard, and standard Rust/Angular libraries. The codebase is actively maintained with frequent version migrations and CI/CD pipelines, but carries some duplication across products and technical debt from rapid evolution.
Hiddify-Manager is a comprehensive anti-censorship proxy/VPN management system designed for multi-user environments. It orchestrates a suite of proxy cores (Xray, Sing-Box, HAProxy, Nginx, WireGuard, etc.) via systemd services, a Flask-based web panel, and a CLI tool. The system supports over 20 protocols (VLESS, VMess, Trojan, Shadowsocks, Reality, Telegram proxies, DNS tunnels) and is optimized for regions with heavy internet censorship (Iran, China, Russia). It provides automated installation, configuration generation via Jinja2 templates, multi-node support, Docker deployment, and cloud-init/Terraform scripts for cloud provisioning. The codebase is actively maintained with frequent updates, but contains deprecated services and a large shell script surface that introduces maintenance complexity.
Slipstream is a high-performance covert channel that tunnels TCP traffic over DNS queries and responses using the QUIC protocol. The client runs inside a restricted network, accepting TCP connections and forwarding data via DNS to the server, which acts as an authoritative DNS server for a configured domain and forwards data to a target TCP service. The architecture leverages picoquic for QUIC implementation with custom packet loops to handle UDP (DNS) and TCP sockets, incorporating innovations like QUIC multipath for aggregating bandwidth from multiple resolvers, a server-side congestion control disable to maximize response opportunities, and a spoofed source address technique to prevent QUIC path migration based on fluctuating DNS resolver addresses. The codebase demonstrates careful engineering in integrating picoquic with DNS transport, featuring efficient base32 encoding with dotification for DNS label splitting and utility functions for connection ID handling and socket address manipulation. Notable reusable components include the dotification/undotification functions for DNS label encoding and a set of picoquic utility functions. The project is actively maintained with modern build tools (Meson/Ninja), regular releases, and clear documentation, indicating ongoing development and low technical debt relative to its ecosystem.
This repository provides a comprehensive Docker Compose configuration for building a self-hosted NAS (Network Attached Storage) system. It orchestrates over 20 services including media management (Sonarr, Radarr, Lidarr, Bazarr, Prowlarr, qBittorrent, Jellyfin, Jellyseer), a WireGuard VPN (PIA), reverse proxy (Traefik with Let's Encrypt), a homepage dashboard (Homepage), automatic updates (Watchtower), and optional services like AdGuard Home, Home Assistant, Immich, Vaultwarden, Paperless, and more. The architecture is a multi-container Docker stack with a shared network, designed to run on any Docker-capable Linux box. The primary data flow involves downloading media via qBittorrent through a VPN, managing it with *arr applications, and serving it via Jellyfin. The repository includes automation scripts for initial configuration (update-config.sh) and port forwarding updates (pia-shared/portupdate-qbittorrent.sh). It is not a software application with custom code but rather a well-documented, opinionated deployment template. The codebase is primarily configuration files (docker-compose.yml, environment files, nginx configs) with a few bash and JavaScript scripts. The quality is good for its purpose: it is organized, documented, and widely used, but it lacks reusable software components that could be extracted into a new project with minimal modification.
This repository provides a complete solution for integrating AmneziaWG (a WireGuard fork with traffic obfuscation) with MikroTik RouterOS. It includes multi-architecture Dockerfiles (amd64, arm, arm64) that build minimal Alpine-based containers running the AmneziaWG client, along with OpenRC init scripts to manage the VPN tunnel and configure NAT/MSS clamping via nftables or iptables. The repository also contains pre-built container images and a detailed step-by-step guide (in Russian) covering two deployment options: running the container directly inside RouterOS (for devices that support containers) or using a separate Linux machine as a VPN gateway. The actual code is limited to Dockerfiles and shell scripts; the bulk of the repository is documentation and build artifacts. It is not a standalone application but a deployment pattern and configuration toolkit for network engineers.