Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
HevSocks5Tunnel is a lightweight, high-performance tun2socks proxy written in C. It creates a virtual TUN interface and forwards all TCP/UDP traffic through a SOCKS5 proxy, supporting IPv4/IPv6 dual-stack, UDP-in-UDP and UDP-in-TCP relay modes, optional local ICMP echo replies, and a mapped DNS feature for transparent DNS resolution. The architecture is monolithic but modular: a YAML-based configuration parser, platform-specific tunnel backends (Linux, FreeBSD, macOS, NetBSD, Windows via Wintun), and a session management layer built on top of lwIP and the hev-task-system cooperative multitasking library. It can be used as a standalone CLI tool, a static/shared library, or embedded via JNI on Android. The codebase demonstrates strong C craftsmanship with clean abstractions, efficient I/O patterns (ring buffer with iovec, scatter/gather), and careful platform abstraction.
This is a comprehensive V2Ray installation and management script written in Bash. It provides a one-click installer (install.sh) and a management CLI (v2ray.sh) for deploying and operating V2Ray proxy servers on Linux (Ubuntu/Debian/CentOS). The script automates V2Ray core installation, configuration generation for multiple protocols (VMess, VLESS, Trojan, Shadowsocks, Socks, Dokodemo-Door), TLS certificate management via Caddy, dynamic port allocation, BBR enablement, and DNS configuration. It uses a modular architecture with separate source files for each functional area (core.sh for protocol logic, caddy.sh for TLS, dns.sh, bbr.sh, systemd.sh for service management, download.sh for fetching binaries, log.sh, old.sh for migration). The script manages multiple simultaneous configurations via JSON files in /etc/v2ray/conf/ and uses V2Ray's API for hot-reloading. It supports both interactive menu-driven operation and direct command-line arguments for automation.
This repository is a collection of configuration templates for proxy applications (Clash, Loon, and QuantumultX). It does not contain executable code but provides ready-to-import configuration files that users can deploy in their proxy clients to configure routing, policy groups, and rules. The repository is organized by application type and language, with each configuration file demonstrating good practices for the respective proxy tool (e.g., YAML anchors in Clash configs, consistent policy organization in Loon configs). The configs reference external resources like subscription URLs, remote rule sets, and GeoIP databases that users must provide or access separately.