frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
This repository is a full-featured web control panel for managing Xray-core proxy servers, known as 3x-ui. It provides a complete management interface for creating and configuring proxy inbounds (VLESS, VMess, Trojan, Shadowsocks, WireGuard, AmneziaWG, TUIC, Hysteria, MTProto, etc.), managing client accounts with traffic quotas and expiry, operating multi-node distributed setups, and generating subscription links (v2ray, Clash, JSON). The backend is written in Go using the Gin web framework and GORM for database access (SQLite or PostgreSQL), while the frontend is a React/TypeScript SPA with Ant Design and TanStack Query. The system includes sidecar supervision for Xray-core, MTProto (mtg), and TUIC binaries, a Telegram bot, Discord integration, email notifications, and an API token system. It features extensive automated testing (unit, integration, scale, mutation tests) and a documentation site built with Next.js and fumadocs.
HevSocks5Tunnel is a lightweight, high-performance tun2socks proxy written in C. It creates a virtual TUN interface and forwards all TCP/UDP traffic through a SOCKS5 proxy, supporting IPv4/IPv6 dual-stack, UDP-in-UDP and UDP-in-TCP relay modes, optional local ICMP echo replies, and a mapped DNS feature for transparent DNS resolution. The architecture is monolithic but modular: a YAML-based configuration parser, platform-specific tunnel backends (Linux, FreeBSD, macOS, NetBSD, Windows via Wintun), and a session management layer built on top of lwIP and the hev-task-system cooperative multitasking library. It can be used as a standalone CLI tool, a static/shared library, or embedded via JNI on Android. The codebase demonstrates strong C craftsmanship with clean abstractions, efficient I/O patterns (ring buffer with iovec, scatter/gather), and careful platform abstraction.
ArgoX is a comprehensive bash-based deployment and management tool for setting up Xray proxy servers with Cloudflare Argo tunnels on VPS. It supports 12 proxy protocols (VLESS, Hysteria2, Shadowsocks, etc.) and provides interactive and non-interactive installation, automated configuration generation, firewall management, subscription output for multiple clients (Clash, V2rayN, Sing-box, etc.), and hot-reload via Xray gRPC API. The script handles complex tasks like deriving X25519 keys, managing Cloudflare tunnels via API, selecting optimal CDN proxies, and implementing Hysteria2 Realm for NAT traversal. It is actively maintained with frequent updates and extensive error handling.
Xray-core is a production-grade network proxy framework written in Go. It implements a wide range of proxy protocols (VMess, VLESS, Shadowsocks, Trojan, Hysteria, WireGuard, SOCKS, HTTP) and transport layers (TCP, WebSocket, gRPC, KCP, SplitHTTP, HTTPUpgrade, QUIC) with advanced obfuscation techniques (Noise, Sudoku, XMC, Realm) for censorship circumvention. The architecture is modular, with pluggable inbound/outbound handlers, a rule-based router with domain/IP/port/protocol matching, a DNS subsystem supporting multiple upstreams (DoH, DoQ, TCP, UDP, FakeDNS), and an observatory for health-based load balancing. Configuration is via JSON/protobuf, and runtime management is exposed through gRPC APIs. The codebase is extensive, well-tested (unit and integration scenarios), and leverages Go's concurrency primitives heavily for performance. However, it includes experimental transports and deprecated features (e.g., legacy Shadowsocks, xtls security), indicating ongoing evolution and some technical drift in the ecosystem.
sish is a production-grade, self-hosted SSH reverse tunneling server written in Go. It acts as a multiplexer that accepts SSH connections and forwards HTTP(S), WebSocket, TCP, and TLS (SNI) traffic to local services. Unlike ngrok or serveo, sish requires no custom client—users connect with standard SSH remote port forwarding. The server listens on SSH (default 2222), HTTP (80), and HTTPS (443) ports, and uses unix sockets for internal routing. It supports load balancing, TCP aliases, custom domains via DNS verification, on-demand Let's Encrypt certificates, and a real-time web console for inspecting forwarded requests. The architecture is monolithic but highly concurrent, leveraging goroutines and syncmap for state management. The codebase is well-structured with clear separation of concerns: SSH multiplexing (sshmuxer), HTTP handling (httpmuxer), and shared utilities (utils). It includes integration tests for authentication key requests and connection cleanup. The project is actively maintained with regular releases, CI/CD pipelines, and comprehensive documentation.
EdgeVPN is a decentralized peer-to-peer VPN and overlay networking tool built on libp2p. It provides a VPN tunnel (TUN interface), TCP service tunneling (ngrok-like), HTTP egress proxy, DNS resolution, file transfer, and a distributed ledger for network state coordination. The architecture is a single Go binary with an embedded React SPA dashboard, exposing a REST API (Echo framework) and CLI (urfave/cli v2). The core innovation is a blockchain-style ledger that stores machine, service, DNS, and health records, with optional signed ownership enforcement and liveness-based reaping. The system uses libp2p for peer discovery (DHT, mDNS), pubsub (gossipsub), relays, and circuit v2. It is designed for decentralized networks without central coordination, and is used in production by Kairos (Kubernetes) and LocalAI (P2P distribution). The codebase demonstrates strong engineering with functional options patterns, comprehensive test suites, documentation generation from CLI code, and a design system for the React UI. However, it carries technical debt from experimental features (PeerGuard, DHCP, IPv6), a forked libp2p-pubsub dependency, and documentation drift that requires manual regeneration.
This monorepo houses the entire Start9 ecosystem, centered on StartOS—a self-hosted Linux distribution for personal servers. The repository encompasses multiple products: StartOS (server OS with container orchestration, backup, networking, and marketplace), StartWRT (router firmware based on OpenWrt), StartTunnel (WireGuard-based tunnel service), StartCLI (command-line tool), StartRegistry (package registry), and StartSDK (TypeScript SDK for building service packages). The architecture is a hybrid of Rust backend services (using async Tokio, axum, and a custom RPC toolkit) and Angular frontends (using Taiga UI and a reactive PatchDB state store). Key orchestration is handled by the container runtime (Node.js with LXC) and a custom diff-based database (PatchDB) for real-time UI synchronization. The system manages service lifecycle, ACME certificates, DNS, port forwarding, VPNs, encrypted backups, and firmware updates. External dependencies include Linux kernel features (LXC, btrfs, eCryptFS, FUSE, nftables), WireGuard, and standard Rust/Angular libraries. The codebase is actively maintained with frequent version migrations and CI/CD pipelines, but carries some duplication across products and technical debt from rapid evolution.
Fuso is a Rust-based intranet penetration and port forwarding tool that enables exposing local services behind NAT to the public internet via a relay server. It implements a client-server architecture with support for TCP forwarding, SOCKS5 proxy (including UDP association), KCP protocol for reliable UDP transport, LZ4 compression, and RSA+AES encryption. The system is built on a custom async runtime abstraction (supporting tokio and smol), with a modular design using provider and builder patterns. The server (fus) manages client connections and public listeners, while the client (fuc) registers port mappings and forwards traffic. Additional features include bridge mode for cascading proxies, heartbeat health checks, observer hooks for external notifications, and a configuration API. The codebase demonstrates strong Rust async patterns, protocol implementation skills, and a clean separation between core abstractions and runtime specifics.
Slipstream is a high-performance covert channel that tunnels TCP traffic over DNS queries and responses using the QUIC protocol. The client runs inside a restricted network, accepting TCP connections and forwarding data via DNS to the server, which acts as an authoritative DNS server for a configured domain and forwards data to a target TCP service. The architecture leverages picoquic for QUIC implementation with custom packet loops to handle UDP (DNS) and TCP sockets, incorporating innovations like QUIC multipath for aggregating bandwidth from multiple resolvers, a server-side congestion control disable to maximize response opportunities, and a spoofed source address technique to prevent QUIC path migration based on fluctuating DNS resolver addresses. The codebase demonstrates careful engineering in integrating picoquic with DNS transport, featuring efficient base32 encoding with dotification for DNS label splitting and utility functions for connection ID handling and socket address manipulation. Notable reusable components include the dotification/undotification functions for DNS label encoding and a set of picoquic utility functions. The project is actively maintained with modern build tools (Meson/Ninja), regular releases, and clear documentation, indicating ongoing development and low technical debt relative to its ecosystem.
shootback is a reverse TCP tunnel application that enables access to services behind NAT or firewall. It consists of a master server (publicly accessible) and a slaver client (running in the private network). The master listens for slaver connections and client connections, using available slavers to forward client traffic to target services. The architecture uses non-blocking I/O with a socket bridge for efficient data transfer, and a custom control protocol for handshakes and heartbeats. Key components include master.py (main server), slaver.py (client), and common_func.py (shared utilities like SocketBridge and CtrlPkg). The code relies solely on Python's standard library, supporting versions 2.7 and 3.4+. Despite a recent timestamp in metadata, the codebase shows signs of stagnation (e.g., outdated Python version support, lack of recent activity beyond initial development).
This repository provides a collection of shell scripts and application wrappers for deploying the sing-box proxy server across various environments, including VPS (Linux with systemd or OpenRC), Serv00/CT8 free hosting, and 'toy' hosting platforms (Node.js, Python, Go, PHP). The core functionality is driven by bash scripts (sing-box.sh, sb_serv00.sh, sb4.sh, sb_00.sh) that automate the installation of sing-box, cloudflared (Argo tunnel), and optionally Nezha monitoring agent. The scripts generate configuration files for multiple proxy protocols (VLESS Reality, VMess WebSocket, Hysteria2, Tuic) and set up subscription links served via nginx. The Node.js, Python, Go, and PHP sub-projects are minimal HTTP servers that download a binary from a remote URL and execute it with environment variables, primarily intended for resource-limited hosting platforms. The codebase is functional and popular (5000+ stars) but suffers from high duplication, hardcoded external binary URLs, base64-encoded script injection, and lack of modularity, making it difficult to maintain or reuse components outside the project's specific infrastructure.