frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
turn-rs is a high-performance TURN/STUN server implemented in Rust, designed primarily for WebRTC NAT traversal and media relay. The codebase consists of a core library (`turn-server`) and a companion SDK crate (`turn-server-sdk`) that provides a gRPC client and hooks API. The server architecture is async I/O driven (Tokio) with optional transport modules for UDP and TCP (including TLS via rustls). Protocol handling is implemented from scratch with a STUN/TURN message codec, a connection-less switch mechanism for relaying packets between sessions, and a memory pool for zero-copy buffering. Management and observability are exposed through an optional gRPC API (sessions, statistics, destroy) and a Prometheus metrics endpoint. Authentication supports static credentials, TURN REST shared-secret, and an external gRPC hook service for dynamic password lookup and event callbacks. The project is well-tested with unit tests, property-based fuzzing (proptest), integration tests using coturn's test client, and benchmarks. It is actively maintained with recent releases and comprehensive documentation.
NATMap is a command-line tool written in C that establishes TCP/UDP port mappings from an ISP NAT public address to a local private address. It uses STUN protocol to discover the mapped public address and maintain NAT bindings through keep-alive sessions. The architecture is built on a cooperative task-based concurrency model (hev-task-system) for efficient non-blocking I/O. It supports two modes: bind mode, where the tool keeps the port alive and notifies the user via a script, and forward mode, where it listens on the mapped port and forwards traffic to an internal target. The codebase is modular, with clear separation of concerns: configuration parsing, socket creation, STUN protocol handling, NAT session keepers (TCP/UDP), port forwarding servers, and script execution. It is highly portable, with cross-compilation support for Linux, Windows, macOS, FreeBSD, and Android across many architectures.
NetBird is a configuration-free peer-to-peer VPN and centralized access control system built on WireGuard. It consists of a cross-platform client daemon (Linux, Windows, macOS, Android, iOS, FreeBSD, WebAssembly), a management server, a signal server for NAT traversal coordination, a relay server for fallback connectivity, and a reverse proxy with an LLM gateway layer. The client daemon manages WireGuard interfaces, DNS, firewall rules, and peer connections via ICE/STUN/TURN, while the management server provides REST/gRPC APIs for account management, network map computation, posture checks, and policy enforcement. The proxy component adds middleware for authentication, LLM request parsing, cost metering, and guardrails, enabling identity-aware access to private resources and AI APIs over the encrypted tunnel. Architecturally, the system is a distributed set of microservices: the client runs as a background daemon with a CLI and a desktop GUI (Wails v3 + React), communicating with the management server via gRPC and REST. Relay and signal servers facilitate NAT traversal, and the proxy can be deployed as a standalone reverse proxy. The management server supports multiple database backends (PostgreSQL, SQLite, MySQL) and caching via Redis. Telemetry and metrics are exported to Prometheus or InfluxDB. The codebase is heavily platform-adapted with build-tagged files, and includes extensive unit, integration, and end-to-end tests. Key entry points include client/main.go (CLI), client/ui/main.go (desktop GUI), management/main.go (management server), relay/main.go (relay server), signal/main.go (signal server), proxy/cmd/proxy/main.go (proxy), and combined/main.go (all-in-one server). Data flows involve client authentication, network map retrieval, WireGuard tunnel setup, peer-to-peer connection establishment via ICE/relay, and optional proxy middleware processing for HTTP/LLM traffic. External dependencies include WireGuard, PostgreSQL/SQLite/MySQL, Redis, MaxMind GeoLite2, pyroscope, gRPC, protobuf, Wails, and various system tools (iptables, nftables, resolvconf).
MicroLink v2 is a production-ready Tailscale VPN client for ESP32-S3 devices that establishes secure WireGuard tunnels through Tailscale's control plane. It implements the full Tailscale protocol stack including Noise protocol for control plane encryption, HTTP/2 framing, DISCO peer discovery, STUN for NAT traversal, DERP relay fallback, and WireGuard encryption via wireguard-lwip integration. The architecture uses a multi-task FreeRTOS design with separate tasks for coordination, WireGuard management, DERP transmission, network I/O, and application logic, communicating via message queues and event groups. Key features include WiFi/cellular network failover with health monitoring, zero-copy WireGuard receive option for high-throughput scenarios, NVS-based peer caching with LRU eviction, and an HTTP configuration server for runtime management. The code demonstrates strong protocol fidelity through direct reference to Tailscale's Go source files while adapting to embedded constraints.
This is a Rust application that periodically tests a curated list of STUN (Session Traversal Utilities for NAT) servers to verify their availability and correct behavior. The system sends STUN Binding Requests over UDP and TCP to each candidate server, compares the returned mapped address against a reference server's result to detect NAT-induced mapping changes, and optionally checks for the OTHER-ADDRESS attribute to identify servers that support NAT behavior testing (RFC 5780). Healthy servers are written to several text files (hostnames, IPv4 addresses, IPv6 addresses) with and without the NAT-testing capability filter. The output lists are shuffled hourly to distribute load across servers. The architecture is a single binary built with Tokio async runtime, modularized into server loading, STUN query logic, output formatting, and a GeoIP caching layer. It is not a library; it is a self-contained service intended to run as a GitHub Actions cron job. The code is clean, idiomatic Rust with proper error handling and logging.
Fuso is a Rust-based intranet penetration and port forwarding tool that enables exposing local services behind NAT to the public internet via a relay server. It implements a client-server architecture with support for TCP forwarding, SOCKS5 proxy (including UDP association), KCP protocol for reliable UDP transport, LZ4 compression, and RSA+AES encryption. The system is built on a custom async runtime abstraction (supporting tokio and smol), with a modular design using provider and builder patterns. The server (fus) manages client connections and public listeners, while the client (fuc) registers port mappings and forwards traffic. Additional features include bridge mode for cascading proxies, heartbeat health checks, observer hooks for external notifications, and a configuration API. The codebase demonstrates strong Rust async patterns, protocol implementation skills, and a clean separation between core abstractions and runtime specifics.
Aspia is a comprehensive, cross-platform remote desktop and system administration suite. The codebase is decomposed into four primary components: a **host** (the machine being controlled), a **client** (the controlling machine), a **router** (session brokering and NAT traversal), and a **relay** (traffic forwarding). It supports Windows, Linux, macOS, and Android, with platform-specific implementations for screen capture (DXGI, X11, Wayland/PipeWire, KMS/DRM, Android MediaProjection), audio (WASAPI, PulseAudio, Oboe), input injection, and clipboard integration. The system uses encrypted communication with SRP authentication, X25519 key exchange, and AEAD ciphers (AES-256-GCM, ChaCha20-Poly1305) with key ratcheting. Beyond desktop sharing, it provides file transfer, text chat, remote terminal, task manager, system information collection, and video recording. The client features both a Qt-based desktop GUI and a custom Android UI built with native widgets. The router manages host discovery, two-factor authentication (TOTP), and relay session keys, while the relay handles peer-to-peer forwarding. The codebase is built with CMake, uses protobuf for messaging, and relies on libraries like asio, OpenSSL, libvpx, libyuv, and zstd.
The Global Socket Toolkit (gsocket) is a secure networking utility suite that enables TCP connections across NATs and firewalls without requiring any inbound ports. It achieves this by relaying traffic through a free cloud-based relay network (GSRN) and encrypting the session end-to-end using SRP (RFC 5054) with AES-256 and a 4096-bit prime. The project provides a core library (`libgsocket`) that abstracts the relay protocol, and several command-line tools: `gs-netcat` (a netcat-like tool for data transfer, reverse shells, port forwarding, and SOCKS proxies), `gs-sftp` (SFTP through the relay), `gs-mount` (sshfs mounting), and `blitz` (bulk file transfer). It also includes a `LD_PRELOAD`-based interposition library (`gsocket_dso`) that can transparently redirect existing network applications through the relay. The architecture is client-server with a relay network; the client establishes a connection to the relay using a shared secret token, and the server connects to the same token, allowing the relay to bridge the two. The codebase is written in C and Bash, with autotools build system, extensive cross-platform support (Linux, macOS, FreeBSD, OpenBSD, Solaris, Cygwin, OpenWRT), and CI/CD pipelines for publishing static binaries. It is a dual-use tool: it can be used for legitimate remote administration, secure file transfer, and privacy, but also includes documented patterns for hidden reverse shells and persistence, which introduces security and maintenance risks.
shootback is a reverse TCP tunnel application that enables access to services behind NAT or firewall. It consists of a master server (publicly accessible) and a slaver client (running in the private network). The master listens for slaver connections and client connections, using available slavers to forward client traffic to target services. The architecture uses non-blocking I/O with a socket bridge for efficient data transfer, and a custom control protocol for handshakes and heartbeats. Key components include master.py (main server), slaver.py (client), and common_func.py (shared utilities like SocketBridge and CtrlPkg). The code relies solely on Python's standard library, supporting versions 2.7 and 3.4+. Despite a recent timestamp in metadata, the codebase shows signs of stagnation (e.g., outdated Python version support, lack of recent activity beyond initial development).