frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
zrok is a production-grade, self-hostable secure resource sharing platform built on OpenZiti overlay networking. It enables users to share web services, files, TCP/UDP tunnels, and VPN connections through firewalls and NAT without requiring inbound connectivity. The system supports both public and private sharing modes, OAuth authentication (GitHub, Google, OIDC), and includes a full REST API (v2), a CLI tool (`zrok2`), a React web console, a background agent daemon with gRPC remote control, and SDKs in Go, Python, and Node.js. Architecturally, zrok follows a controller-agent pattern. The controller is a Go REST server that manages accounts, environments, shares, accesses, frontends, namespaces, organizations, and bandwidth limits. It uses SQLite3 or PostgreSQL for persistence with versioned migrations, and integrates with InfluxDB for usage metrics and RabbitMQ (AMQP) for dynamic proxy mapping updates. The agent runs as a background process on the user's machine, managing child processes for each share/access and exposing a gRPC API for remote management. Frontend proxies (public, dynamic, socks, Caddy) handle incoming traffic with OAuth, basic auth, and interstitial pages. Key entry points include the CLI commands under `cmd/zrok2/` (e.g., `share`, `access`, `enable`, `admin`), the controller REST handlers in `controller/`, the agent gRPC service in `agent/agentGrpc/`, and the SDK packages in `sdk/golang/sdk`, `sdk/python/src/zrok2`, and `sdk/nodejs/sdk`. The system also includes a canary testing framework for continuous health validation and a comprehensive metrics/limits engine for bandwidth enforcement. External dependencies include OpenZiti (overlay network), InfluxDB (metrics), RabbitMQ (messaging), Caddy (optional web server), and various OAuth providers. The project is actively maintained with frequent commits, automated CI/CD, and multi-platform release pipelines (Linux, macOS, Windows, Docker).
VibeTunnel is a production-grade, cross-platform remote terminal access platform. It allows users to connect to terminal sessions from a browser, macOS native app, or iOS app. The Node.js/TypeScript server manages PTY sessions via a custom forked node-pty, supports session recording in asciinema format, and integrates with multiple tunneling services (Tailscale, ngrok, Cloudflare, Pinggy, Pangolin) for remote access. A Rust forwarder handles terminal title sanitisation, and the CLI wrapper (`vt`) enables transparent session creation. Authentication supports PAM, SSH keys, JWT, Tailscale identity, and local bypass. The macOS app (SwiftUI) provides menu bar control, system permission management, Git worktree follow-mode, and Sparkle-based updates. The web frontend (Lit + Tailwind CSS) offers a full terminal UI with quick keys, file browser, and push notifications. The project demonstrates strong engineering with extensive test coverage (unit, integration, Playwright e2e) across all platforms, though multi-platform duplication and vendored native dependencies introduce some maintenance overhead.
inletsctl is a CLI tool for automating the creation and management of inlets tunnel servers on various cloud providers. It provisions VMs with inlets-preinstalled via cloud-init, provides connection strings for clients, and supports deletion and Kubernetes port-forwarding. The application uses a modular Cobra-based architecture with provider-specific implementations abstracted through the cloud-provision package. Key functions include creating HTTPS/TCP tunnel servers, deleting cloud resources, downloading inlets binaries, and forwarding Kubernetes services to local machines.
V2Ray-core is a Go-based network proxy and tunneling platform designed to help users build private networks and bypass censorship. It functions as a modular proxy framework supporting multiple protocols (VMess, VLess, Trojan, SOCKS, HTTP, MTProto, Shadowsocks) and transport layers (TCP, mKCP, WebSocket, HTTP/2, QUIC, Domain Socket, XTLS). The architecture is highly modular: the core runtime manages features (dispatcher, router, DNS, stats, policy, log) as pluggable components, while proxy implementations and transports are registered via a global config-creator registry. Entry points are the main binary (v2ray) and a control utility (v2ctl) for config conversion, signing, and diagnostics. Data flows from inbound handlers through a dispatcher that routes connections by destination, protocol sniffing, and routing rules to outbound handlers, which then dial remote servers over the configured transport. External dependencies include gorilla/websocket, quic-go, miekg/dns, go-proxyprotocol, VSign for binary signing, and xtls/go for extended TLS. The codebase demonstrates strong engineering in its layered abstraction: common/ provides reusable, low-level primitives (buffered I/O with MultiBuffer, retry logic, crypto streams, session context, platform path handling), while features/ defines clean interfaces for routing, DNS, stats, and policy that the app/ layer implements. The transport layer is particularly well-designed, with each protocol isolated behind a common Dial/Listen interface and supporting pluggable packet headers for traffic obfuscation (e.g., faking WeChat video, SRTP, UTP, WireGuard, DTLS). The string matcher (strmatcher) uses a trie for domain matching and supports full, substring, keyword, and regex patterns with index-based grouping. The custom buf package provides a lightweight buffer pool and vectored I/O reader (readv) for performance. The error handling uses a structured errors package with path objects for source location. However, the repository shows signs of stagnation. The README explicitly redirects to v2fly/v2ray-core, indicating this is the legacy v2ray organization's repo. The last commit was in April 2026, but the go.mod targets Go 1.15 (released 2020), and many dependencies are pinned to pre-1.0 versions (quic-go v0.18.1, grpc v1.32.0, protobuf v1.25.0). The CI workflows have conditions like `if: github.repository != 'v2ray/v2ray-core'` suggesting they are disabled for this fork. The codebase contains extensive generated code (errors.generated.go, config.pb.go) and mock files. The XTLS integration references an external fork (xtls/go) rather than the standard crypto/tls. The custom Chacha20 implementation uses code generation for the core block function. While the architecture is sound, the dependency versions and Go version target are significantly behind current ecosystem standards.
Expose is a command-line tunneling tool written in PHP using the Laravel Zero micro-framework and ReactPHP for asynchronous networking. It acts as an ngrok alternative, allowing developers to expose local HTTP servers and TCP ports to the public internet via a remote server. The application includes a CLI client for sharing sites, a local web dashboard (port 4040) for inspecting requests/responses, and a plugin system for analyzing webhook payloads (e.g., GitHub, Stripe, Paddle). The architecture is a monolith structured around a ReactPHP event loop: the client establishes a WebSocket control connection to the Expose server, authenticates, then creates proxy connections that forward incoming HTTP requests from the server to the local application. The local dashboard is served by an embedded HTTP server and uses a Vue 3 frontend with real-time WebSocket updates. The codebase demonstrates strong craftsmanship in areas like the plugin system, magic authentication flow, and custom terminal output handling, though some components are tightly coupled and the dependency on forked ReactPHP packages introduces moderate technical drift.