Tailscale is a production-grade mesh VPN application that creates secure WireGuard-based networks between devices. The repository implements a complete VPN solution: a daemon (`tailscaled`) that manages networking, a CLI (`tailscale`) for user interaction, a DERP relay server for NAT traversal, a Kubernetes operator, a WebDAV-based file sharing system (Taildrive), an SSH server, a DNS resolver, and a web-based management UI. The architecture is modular with feature flags via build tags, extensive platform support (Linux, Windows, macOS, iOS, Android, FreeBSD, etc.), and a plugin-style hook system for optional components (port mapping, app connectors, TPM attestation, etc.). Key data flows include control plane communication via Noise protocol, peer-to-peer connections with NAT traversal (STUN, PCP, UPnP), DNS configuration through OS-specific managers, and file transfers via Taildrop. External dependencies include WireGuard, gVisor netstack, Kubernetes client-go, and AWS SDK. The codebase demonstrates strong engineering practices: extensive tests (unit, integration, VM-based), immutable view types, code generation for cloning and serialization, and careful concurrency with custom utilities like sharded maps and event buses.
FlClash is a production multi-platform proxy/VPN client that embeds and manages the mihomo (Clash.Meta) Go core. The Dart/Flutter app (Riverpod, Drift, freezed) drives a real core lifecycle: profile/subscription import and validation, proxy group and rule management, TUN/VPN on Android, system proxy on desktop, live connections/requests/DNS views, latency probing, streaming-service availability checks, and WebDAV backup/restore. The Go core exposes a method-dispatch IPC contract (updateConfig, changeProxy, getConnections, watchRoute, probe, serviceCheck, etc.) consumed through an Android cgo bridge and a desktop helper process. This is a full application, not a library or data project — no notebooks, no research pipelines. The architecture is layered: Flutter UI → manager/provider layers → core controller → framed JSON IPC → Go mihomo core. Desktop builds add a Rust privileged helper service (systemd unit / Windows SCM, Unix socket with peer-credential auth) and Rust plugins for global hotkeys, QuickJS evaluation of script-based profile overrides, and a rope-backed code editor (code_forge). Native integration plugins for system tray, window management, system proxy, and WiFi SSID are shipped as separate Dart packages with per-OS implementations in C++/Swift/Kotlin. A custom build-hook system compiles and SHA-256-fingerprints the Go core and Rust helper artifacts with file-locking to make native builds cacheable and idempotent. The codebase is unusually disciplined. Test/ subdirectories include contract tests that parse Go structs from the mihomo submodule to verify DNS-override parity, AST-parsing tests verifying every core method is dispatchable, architectural lint tests (platform layering, dead-file detection, UI tooltip enforcement, Material-icon bans), plus unit and widget tests across every layer. Concurrency is handled deliberately: priority message batching between core and UI, serial task scheduling, claim/cancel semantics for GEO/probe updates, and an Android service state machine with newest-request-wins arbitration. Release tooling generates changelogs from conventional commits and a CI pipeline produces deb/rpm/AppImage/DMG/Inno packages. Caveats: the polyglot stack (Dart, Go, Rust, Kotlin, C++, Swift) and tight coupling to mihomo internals via a git submodule make wholesale extraction impractical, and large amounts of generated code (freezed, riverpod_generator, Drift, flutter_rust_bridge) require coordinated regeneration. Browser-platform and TV branches add conditional complexity, and some UI tests assert precise pixel/animation timings that are brittle. The genuinely reusable value lives in the standalone patterns — IPC framing and batching, the rope data structure, fractional indexing, async utilities, and the fingerprinted build cache — plus the independent plugin packages themselves.
Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
sing-box is a universal proxy platform written in Go, serving as both a client and server for a wide range of proxy protocols including Shadowsocks, VMess, VLESS, Trojan, Hysteria2, TUIC, WireGuard, Tailscale, OpenVPN, OpenConnect, and many more. It features a modular architecture with pluggable inbounds, outbounds, services, and endpoints, all managed through a central routing engine with rule-based traffic steering, DNS resolution, and traffic sniffing. The system is designed for cross-platform deployment, with native support for Linux, macOS, Windows, Android, iOS, and tvOS, and includes a daemon mode with gRPC API for remote management, a Clash-compatible REST API, and mobile library bindings via gomobile. The architecture is built around adapter interfaces and generic registries, allowing easy extension with new protocols and services. The codebase demonstrates high craftsmanship in areas such as multi-engine TLS abstraction (supporting standard Go TLS, uTLS for fingerprinting, Apple's SecureTransport, Windows SChannel, and kernel TLS), parallel happy-eyeballs dialing, binary rule-set serialization, HTTP transport fallback with broken-authority tracking, and platform-specific packet manipulation (WinDivert on Windows, pf on macOS, netfilter on Linux). The project is actively maintained with frequent commits, extensive integration tests, and a comprehensive documentation site. While the codebase is large and contains experimental features, the core abstractions are clean and well-isolated, making many components genuinely reusable in other network-oriented Go projects.
GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship by fragmenting the TLS ClientHello so the SNI never appears whole in a single packet, and by resolving DNS over encrypted channels (DoH/DoT). It is a ground-up TypeScript rewrite of the original GreenTunnel, fixing numerous bugs from v2 (backpressure, timeouts, HTTP framing corruption, DNS cache expiry, system proxy crash safety). The repository is a monorepo containing a core engine library, a CLI tool (`gt`), and an Electron desktop app. The engine implements a full HTTP/HTTPS proxy with TLS fragmentation, HTTP request rewriting (absolute-form to origin-form), a caching DNS resolver with TTL-based expiration and in-flight deduplication, and a system-proxy management layer with snapshot/restore and crash recovery. The desktop app provides a 340px frameless window with a live log panel (virtual list), tray integration, and non-intrusive advocacy prompts. The codebase is exceptionally well-documented (CLAUDE.md serves as the authoritative design document), uses modern Node.js features (parseArgs, styleText, pipeline), and has a strong emphasis on correctness and edge-case handling (e.g., stranded proxy detection, HTTP framing awareness, signal handling for clean shutdown).
HevSocks5Tunnel is a lightweight, high-performance tun2socks proxy written in C. It creates a virtual TUN interface and forwards all TCP/UDP traffic through a SOCKS5 proxy, supporting IPv4/IPv6 dual-stack, UDP-in-UDP and UDP-in-TCP relay modes, optional local ICMP echo replies, and a mapped DNS feature for transparent DNS resolution. The architecture is monolithic but modular: a YAML-based configuration parser, platform-specific tunnel backends (Linux, FreeBSD, macOS, NetBSD, Windows via Wintun), and a session management layer built on top of lwIP and the hev-task-system cooperative multitasking library. It can be used as a standalone CLI tool, a static/shared library, or embedded via JNI on Android. The codebase demonstrates strong C craftsmanship with clean abstractions, efficient I/O patterns (ring buffer with iovec, scatter/gather), and careful platform abstraction.
v2rayNG is a production-grade Android VPN/proxy client that provides a comprehensive interface for managing V2Ray and Xray proxy configurations. It supports multiple proxy protocols (VMess, VLESS, Shadowsocks, Trojan, WireGuard, Hysteria2, SOCKS, HTTP), subscription management with auto-update, routing rules, per-app proxy, and backup/restore via local files or WebDAV. The app runs in three modes: VPN (TUN), proxy-only (local SOCKS/HTTP), and root (iptables transparent proxy). It uses native cores (Xray or v2fly) via JNI and manages complex configuration generation, including DNS segmentation, observatory-based load balancing, and fragment settings. The architecture follows standard Android patterns with Compose UI, ViewModels, and background services in separate processes. The codebase is actively maintained with a large community, though some modules (e.g., CoreConfigManager) are monolithic and could benefit from further decomposition.
Algo VPN is a deployment tool that automates the setup of a personal VPN server on cloud providers or local Ubuntu machines. It uses Ansible to provision a hardened server running strongSwan (IKEv2/IPsec) and WireGuard, with optional DNS encryption via dnscrypt-proxy and privacy enhancements like log rotation and history clearing. The architecture is a set of Ansible playbooks and roles, orchestrated by a shell script entry point (`algo`) that invokes `ansible-playbook`. Cloud provisioning is handled by provider-specific roles (AWS EC2, DigitalOcean, Azure, GCE, etc.), while server configuration roles handle system hardening, PKI certificate generation, VPN service configuration, and client profile generation (mobileconfig, WireGuard .conf, QR codes). The system is designed for security and privacy: it uses strong crypto defaults (ECC secp384r1), minimal logging, and unattended upgrades. External dependencies include Ansible, community.crypto collection, cloud provider SDKs, and the dnscrypt-proxy package. The primary data flow is: user edits `config.cfg` → Ansible playbook runs → cloud VM is created → server is configured with VPN services → client configuration files are generated and stored locally. User management (add/revoke) is handled by a separate playbook. The repository includes extensive unit, integration, and end-to-end tests, with Docker-based integration testing and CI/CD via GitHub Actions.
wgcf is an unofficial, cross-platform command-line tool for Cloudflare WARP. It reverse-engineers the official Android client's undocumented API to register WARP accounts, bind license keys, and emit ready-to-use WireGuard profiles. The codebase is organized as a Cobra-based CLI with distinct subcommands (register, update, generate, status, trace), a Viper-backed TOML config layer, a custom OpenAPI-generated API client for api.cloudflareclient.com, and a dedicated WireGuard profile generator. Its most distinctive piece is a uTLS-based HTTP transport that replicates the exact TLS ClientHello of Cloudflare's Android app, allowing the tool to pass server-side fingerprint checks. The OpenAPI specification is actively maintained and version-pinned to WARP build 5641, with generated Go client code that should be regenerated when the spec changes. This is a pure application repository; the only data-like artifacts are the OpenAPI contract and schema models, which serve the client rather than enable research or analytics.
This is a Home Assistant addon that runs Tailscale inside a supervised container, providing a zero-config VPN for building secure networks. The addon orchestrates multiple processes via s6-overlay: tailscaled, a web UI, nginx for ingress, and dnsmasq for MagicDNS proxying. It handles complex networking including iptables DNAT for forwarding tailnet connections to the host, MSS clamping, subnet route protection to avoid collisions with tailnet routes, and Tailscale Serve/Funnel for exposing Home Assistant with TLS. It also supports Taildrop file sharing and Taildrive directory sharing. The architecture is a single container with tightly integrated services, all configured through Home Assistant's addon options. The codebase is well-structured with robust error handling and health checks, but is tightly coupled to the Home Assistant Supervisor environment via bashio and the hassio-addons base image.
NetBird is a configuration-free peer-to-peer VPN and centralized access control system built on WireGuard. It consists of a cross-platform client daemon (Linux, Windows, macOS, Android, iOS, FreeBSD, WebAssembly), a management server, a signal server for NAT traversal coordination, a relay server for fallback connectivity, and a reverse proxy with an LLM gateway layer. The client daemon manages WireGuard interfaces, DNS, firewall rules, and peer connections via ICE/STUN/TURN, while the management server provides REST/gRPC APIs for account management, network map computation, posture checks, and policy enforcement. The proxy component adds middleware for authentication, LLM request parsing, cost metering, and guardrails, enabling identity-aware access to private resources and AI APIs over the encrypted tunnel. Architecturally, the system is a distributed set of microservices: the client runs as a background daemon with a CLI and a desktop GUI (Wails v3 + React), communicating with the management server via gRPC and REST. Relay and signal servers facilitate NAT traversal, and the proxy can be deployed as a standalone reverse proxy. The management server supports multiple database backends (PostgreSQL, SQLite, MySQL) and caching via Redis. Telemetry and metrics are exported to Prometheus or InfluxDB. The codebase is heavily platform-adapted with build-tagged files, and includes extensive unit, integration, and end-to-end tests. Key entry points include client/main.go (CLI), client/ui/main.go (desktop GUI), management/main.go (management server), relay/main.go (relay server), signal/main.go (signal server), proxy/cmd/proxy/main.go (proxy), and combined/main.go (all-in-one server). Data flows involve client authentication, network map retrieval, WireGuard tunnel setup, peer-to-peer connection establishment via ICE/relay, and optional proxy middleware processing for HTTP/LLM traffic. External dependencies include WireGuard, PostgreSQL/SQLite/MySQL, Redis, MaxMind GeoLite2, pyroscope, gRPC, protobuf, Wails, and various system tools (iptables, nftables, resolvconf).
Pomerium is an identity-aware access proxy that provides zero-trust security for internal web applications and services. It acts as a reverse proxy that authenticates users via OIDC/OAuth2 providers, authorizes access based on policy rules (Pomerium Policy Language evaluated via OPA/Rego), and proxies HTTP, gRPC, WebSocket, and SSH traffic. The system is built as a multi-service architecture with gRPC-based inter-service communication, using Envoy as the underlying proxy engine. Key components include an authentication service, authorization service with policy evaluator, a distributed databroker for session/config storage (with Raft consensus), and a control plane that generates Envoy configuration dynamically. It supports multiple identity providers (Google, Okta, Azure, Auth0, etc.), mTLS client certificates, WebAuthn, and SSH tunneling with a TUI client. The codebase also includes a Model Context Protocol (MCP) implementation for AI tool access control, and a 'Zero' cloud-managed mode for enterprise deployments. External dependencies include Envoy, PostgreSQL, Pebble (RocksDB), and cloud blob storage (S3, GCS, Azure Blob). Architecturally, Pomerium follows a modular design with clear separation of concerns: configuration management (layered sources, validation, envoy config builders), policy engine (parser, generator, criteria matchers), storage abstraction (in-memory, file, postgres, blob with caching and querier patterns), telemetry (OpenTelemetry, Prometheus, health checks), and utility packages (cryptography, HTTP, gRPC, protobuf, retry, fanout). The system is highly configurable with runtime flags and supports hot-reload via config diffing. The codebase demonstrates strong engineering practices with extensive unit, integration, and end-to-end tests (Playwright-based acceptance suites). Data flows: Incoming requests are intercepted by Envoy, which forwards them to the Pomerium proxy service. The proxy authenticates the user via the authenticate service (OIDC/OAuth2 flows), then authorizes via the authorize service (policy evaluation with OPA/Rego). Session and user data are stored in the databroker (distributed key-value store with Raft replication). Configuration is managed centrally and distributed to all services via gRPC streams. Telemetry data (traces, metrics, logs) is exported via OpenTelemetry and Prometheus.
OPNsense core is the central management and control plane for the OPNsense open-source firewall distribution. It implements a complete MVC web application (PHP) that provides a graphical user interface and RESTful API for configuring firewall rules, VPNs (IPsec, OpenVPN, WireGuard), DNS/DHCP services, traffic shaping, intrusion detection, captive portal, system settings, and monitoring. The backend relies on a custom daemon (`configd`) that executes actions via Unix socket, running Python and shell scripts for system-level operations (e.g., pfctl, ipfw, swanctl, wg). Configuration is stored in XML files and managed through an extensive model layer with field types, validators, and migrations. The system is deeply integrated with FreeBSD and uses FreeBSD-specific tools and kernel subsystems (pf, carp, netgraph). The architecture is a monolithic PHP MVC framework (originally based on Phalcon, now with a custom dispatcher) with a clear separation: controllers handle HTTP requests, models manage XML-based configuration, and views are Volt templates. The API controllers extend `ApiMutableModelControllerBase` and provide standard CRUD operations plus service actions (start, stop, reconfigure). System scripts are organized under `src/opnsense/scripts/` and are invoked by configd or system hooks. Dashboard widgets (JavaScript) fetch real-time data via API endpoints or event streams. External dependencies include FreeBSD base system tools, PHP (with Phalcon or custom replacement), Python 3, and libraries like ujson, requests. Key entry points are the web UI (`/index.php`), the API (`/api.php`), and the configd daemon (`configd.py`). Data flows primarily from user input through controllers to model validation, then to configd actions that generate configuration files (templates) or execute system commands. The system is actively maintained with frequent commits, extensive unit tests for both PHP and Python components, and a well-structured migration framework for upgrading configurations.
This repository provides a collection of shell scripts to automate the setup and management of an IPsec VPN server on Linux. It supports multiple VPN protocols (IPsec/L2TP, IPsec/XAuth, IKEv2) and a wide range of Linux distributions including Ubuntu, Debian, CentOS, Rocky Linux, AlmaLinux, Oracle Linux, and Alpine Linux. The main entry point is `vpnsetup.sh`, which detects the OS and runs the appropriate installer. The project also includes helper scripts for user management, IKEv2 certificate handling, upgrades, and uninstallation. Additionally, it offers an Azure ARM template for cloud deployment. The code is well-structured with OS-specific installers, common bash utility functions, and extensive documentation in multiple languages. It is a mature, widely-used DevOps tool for system administrators.
Outline Apps is a production-grade, open-source VPN ecosystem consisting of two primary applications: a cross-platform VPN client and a server manager. The client, built for Windows, macOS, Linux, Android, iOS, and the web, connects users to Shadowsocks-based proxy servers by creating a system TUN/TAP interface and relaying packets through a Go-based tun2socks core. It exposes a unified TypeScript UI across Electron, Cordova, Capacitor, and browser shells, with native VPN lifecycle management implemented in Go, Java/Kotlin, Swift/Objective-C, and C#. The server manager is an Electron/desktop and web application that provisions and administers Outline servers on DigitalOcean, Google Cloud, AWS Lightsail, and arbitrary Linux machines, including access-key management, bandwidth metrics, data limits, and OAuth-based cloud onboarding. The architecture is a monorepo that separates a Go networking core, TypeScript web UI layers, platform-specific native bridges, and an infrastructure library of shared utilities. The codebase demonstrates careful engineering in several areas: a composable YAML configuration registry for transport strategies (Shadowsocks, WebSocket, TCP/UDP, multi-hop), a generic IP routing table for split tunneling, structured cross-language error types, and a consistent method-channel abstraction for JavaScript-to-native IPC. Strong test coverage exists across Go packages, TypeScript modules, and native platform code, supported by an extensive CI matrix. However, the repository carries significant technical debt from an incomplete migration from Polymer to Lit, the coexistence of legacy Cordova and newer Capacitor mobile stacks, and numerous platform-specific build scripts. This is squarely an application repository, not a data or research project. The only data-related aspects are telemetry and anonymized usage metrics sent to Sentry and server-administrator-controlled collectors, which are operational concerns rather than research pipelines. Maintenance activity is current, with frequent commits, active issue triage, and a large contributor base, but the broad platform surface and legacy framework overlap make ongoing modernization costly.
Clash Verge Rev is a cross-platform desktop proxy management GUI built with Tauri 2 (Rust backend) and React 19 (TypeScript frontend). It serves as the control interface for the mihomo (Clash Meta) proxy core, enabling users to manage proxy subscriptions, switch proxy groups, toggle system proxy and TUN mode, view real-time traffic and connection details, and configure advanced settings like DNS overrides, script enhancements, and backup to WebDAV. The architecture is modular: a Rust backend handles core lifecycle, config management (using a unique 'Draft' transactional pattern), system integration (tray, hotkeys, auto-launch), and IPC with a privileged service on Windows. The frontend uses MUI, SWR, and virtual lists for a responsive UI with drag-and-drop profile/group editing, a built-in Monaco editor for YAML/JS configs, and real-time WebSocket-based data visualization. The repository also includes a Rust workspace with several crates (media unlock checker, i18n, logging, signal handling, rate limiter, system info plugin) that could be extracted and reused in other Tauri applications.
ArgoX is a comprehensive bash-based deployment and management tool for setting up Xray proxy servers with Cloudflare Argo tunnels on VPS. It supports 12 proxy protocols (VLESS, Hysteria2, Shadowsocks, etc.) and provides interactive and non-interactive installation, automated configuration generation, firewall management, subscription output for multiple clients (Clash, V2rayN, Sing-box, etc.), and hot-reload via Xray gRPC API. The script handles complex tasks like deriving X25519 keys, managing Cloudflare tunnels via API, selecting optimal CDN proxies, and implementing Hysteria2 Realm for NAT traversal. It is actively maintained with frequent updates and extensive error handling.
Trayscale is an unofficial GTK4/Libadwaita desktop GUI for the Tailscale VPN daemon, targeting Linux (no official Linux GUI exists). It provides a system tray status icon, a full Libadwaita window for managing peers, exit nodes, Mullvad exit nodes, Taildrop file transfers, profiles, and connection state. The architecture is a single Go binary using gotk4 bindings to GTK4 and Libadwaita. It communicates with the local tailscaled via Tailscale's local API and IPN bus watcher for real-time status updates. The codebase demonstrates solid Go engineering: clean separation of concerns (tsutil client layer, UI layer, tray, datatypes), use of modern Go features (generics, iterators, slices, maps), and comprehensive tests for the core polling and search logic. While not a reusable library, several internal packages (peersearch, autosave, listmodels) are well-isolated and could be extracted.
Xray-core is a production-grade network proxy framework written in Go. It implements a wide range of proxy protocols (VMess, VLESS, Shadowsocks, Trojan, Hysteria, WireGuard, SOCKS, HTTP) and transport layers (TCP, WebSocket, gRPC, KCP, SplitHTTP, HTTPUpgrade, QUIC) with advanced obfuscation techniques (Noise, Sudoku, XMC, Realm) for censorship circumvention. The architecture is modular, with pluggable inbound/outbound handlers, a rule-based router with domain/IP/port/protocol matching, a DNS subsystem supporting multiple upstreams (DoH, DoQ, TCP, UDP, FakeDNS), and an observatory for health-based load balancing. Configuration is via JSON/protobuf, and runtime management is exposed through gRPC APIs. The codebase is extensive, well-tested (unit and integration scenarios), and leverages Go's concurrency primitives heavily for performance. However, it includes experimental transports and deprecated features (e.g., legacy Shadowsocks, xtls security), indicating ongoing evolution and some technical drift in the ecosystem.
This is a full-stack web application for managing a WireGuard VPN server, implemented with Nuxt 4 (Vue 3 frontend) and Nitro (backend) with a SQLite database via Drizzle ORM. It provides a web-based admin UI for configuring the WireGuard interface (MTU, port, device, CIDR, routing table), managing clients (create, enable/disable, set expiry, per-client firewall rules, custom DNS/MTU), viewing traffic charts, and monitoring client status. The application supports multi-user authentication with password login, TOTP two-factor authentication, and OAuth providers (Google, GitHub, generic OIDC). It also includes an experimental AmneziaWG obfuscation mode, Prometheus and JSON metrics endpoints, a CLI for administrative tasks (password reset, client listing, QR code generation), and integration with iptables/nftables for per-client firewall rules. The system is packaged as a Docker image and relies on the host kernel's WireGuard module and iptables tooling.