Ligolo-ng is a tunneling tool that creates VPN-like connections using TUN interfaces and a custom protocol over yamux-multiplexed connections. It consists of a proxy/server component and agent/client components that establish encrypted tunnels to forward TCP/UDP/ICMP traffic without requiring SOCKS proxies. The proxy creates a TUN interface and uses a modified gVisor network stack to intercept and forward packets, while agents make outbound network connections on behalf of the proxy. Features include WebSocket support for firewall bypass, automatic certificate management (Let's Encrypt/self-signed), auto-route functionality, and a web UI/API for management. The architecture cleanly separates concerns into protocol handling, relay mechanisms, network interface management, and stack layers.