frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
NatTypeTester is a cross-platform NAT type testing tool that implements STUN protocols (RFC 3489 and RFC 5780) to determine network characteristics. The application provides desktop (Avalonia), Android, and command-line interfaces for testing NAT type, mapping behavior, filtering behavior, and public endpoint detection. It follows a clean layered architecture with MVVM pattern, dependency injection, and separation of concerns. The core STUN protocol implementation is packaged as a reusable NuGet library (Stun.Net) that supports UDP, TCP, TLS, and DTLS transports with SOCKS5 proxy capabilities.
EdgeVPN is a decentralized peer-to-peer VPN and overlay networking tool built on libp2p. It provides a VPN tunnel (TUN interface), TCP service tunneling (ngrok-like), HTTP egress proxy, DNS resolution, file transfer, and a distributed ledger for network state coordination. The architecture is a single Go binary with an embedded React SPA dashboard, exposing a REST API (Echo framework) and CLI (urfave/cli v2). The core innovation is a blockchain-style ledger that stores machine, service, DNS, and health records, with optional signed ownership enforcement and liveness-based reaping. The system uses libp2p for peer discovery (DHT, mDNS), pubsub (gossipsub), relays, and circuit v2. It is designed for decentralized networks without central coordination, and is used in production by Kairos (Kubernetes) and LocalAI (P2P distribution). The codebase demonstrates strong engineering with functional options patterns, comprehensive test suites, documentation generation from CLI code, and a design system for the React UI. However, it carries technical debt from experimental features (PeerGuard, DHCP, IPv6), a forked libp2p-pubsub dependency, and documentation drift that requires manual regeneration.
Fuso is a Rust-based intranet penetration and port forwarding tool that enables exposing local services behind NAT to the public internet via a relay server. It implements a client-server architecture with support for TCP forwarding, SOCKS5 proxy (including UDP association), KCP protocol for reliable UDP transport, LZ4 compression, and RSA+AES encryption. The system is built on a custom async runtime abstraction (supporting tokio and smol), with a modular design using provider and builder patterns. The server (fus) manages client connections and public listeners, while the client (fuc) registers port mappings and forwards traffic. Additional features include bridge mode for cascading proxies, heartbeat health checks, observer hooks for external notifications, and a configuration API. The codebase demonstrates strong Rust async patterns, protocol implementation skills, and a clean separation between core abstractions and runtime specifics.
Dublin Traceroute is a NAT-aware multipath traceroute tool that extends the Paris-traceroute technique to enumerate ECMP load-balanced paths and detect NATs. It forges UDP packets with custom payloads to control the UDP checksum, which is used as a per-flow identifier and embedded in the IP ID field for NAT correlation. The system listens for ICMP Time Exceeded and Destination Unreachable responses, matches them to sent probes using IP ID (IPv4) or payload length (IPv6), and computes a NAT ID from checksum differences. Output is provided in JSON or DOT format for visualization. The repository contains two independent implementations: a primary C++ library/CLI using libtins and jsoncpp, and an experimental Go implementation with IPv6 support and additional tooling (routest for integration testing). The Go implementation demonstrates cleaner separation of concerns with reusable network protocol modules (ICMP, UDP, IPv6) and a layered protocol abstraction.