Open Source Rust Tunneling Software

tun2proxy is a Rust-based networking tool that routes traffic from a TUN interface through HTTP or SOCKS proxies. It allows system-level traffic to be redirected through a proxy even when individual applications do not support proxy configuration. The project supports Linux, Android, macOS, iOS, and Windows, making it broadly useful across desktop, mobile, and embedded-style environments. It includes HTTP, SOCKS4, SOCKS5, SOCKS4a, and SOCKS5h support, along with authentication options depending on the proxy type. tun2proxy can automatically configure routing in supported environments, or it can be used with manual TUN setup for more controlled deployments. It also includes DNS handling, IPv4 and IPv6 support, SOCKS5 UDP support, and Android-specific session information features for per-app routing scenarios.

Shadowsocks Rust is an open-source, high-performance implementation of the Shadowsocks secure proxy protocol written in Rust, designed to provide fast, encrypted SOCKS5-based tunneling to help users bypass network censorship and protect privacy. Shadowsocks itself is widely used to route internet traffic through an encrypted proxy, allowing secure access to blocked or restricted content while mitigating simple traffic-inspection techniques. By leveraging Rust, this implementation emphasizes memory safety, concurrency, and efficiency, making it suitable for both client and server use on devices ranging from small embedded systems to large servers. The repository includes multiple binaries such as sslocal for local SOCKS5 proxy clients and ssserver for remote proxy servers, giving developers flexible components to build customized proxy setups. It also supports modern asynchronous networking patterns, optional DNS handling, transparent proxy modes, tunneling, and advanced cipher methods.

Wstunnel is a Rust-based tunneling tool that carries arbitrary TCP and UDP traffic over WebSocket or HTTP/2. It is designed to help users reach resources through networks where direct traffic may be blocked, filtered, or difficult to route. Because WebSocket is compatible with regular HTTP infrastructure, wstunnel can work through many reverse proxies, firewalls, and web-oriented network paths. The tool supports client and server modes, static binaries, Docker deployment, reverse tunneling, SOCKS5, HTTP proxying, and multiple transport options. It is useful for developers, administrators, and advanced users who need flexible tunneling for SSH, databases, internal web services, or other authorized network access. Its Rust implementation focuses on portability, performance, and practical deployment without requiring a Node.js runtime.

Narrowlink is a zero-config tunneling and reverse proxy solution that enables secure access to services behind firewalls or NATs without exposing public IPs. Unlike traditional tools like ngrok, Narrowlink is peer-to-peer and privacy-focused, using WireGuard and WebRTC to establish direct encrypted tunnels between peers. It is designed to make exposing local services simple, fast, and secure with no need for port forwarding or cloud relays. Narrowlink is ideal for developers, self-hosters, and remote teams looking for frictionless, encrypted connectivity.

VPNCloud is a peer-to-peer VPN solution that uses UDP tunneling to create secure, distributed virtual networks. Unlike traditional VPNs, VPNCloud creates mesh-like connections between nodes and is particularly useful for remote access, private networks, or IoT environments. It supports both encrypted and plaintext tunnels, dynamic peer discovery, and flexible routing. With minimal configuration, VPNCloud provides a lightweight way to link multiple machines across the internet as if they were on the same LAN.

Next generation tracker and advertisement blocker. Privaxy is a MITM HTTP(s) proxy that sits in between HTTP(s) talking applications, such as a web browser and HTTP servers, such as those serving websites. By establishing a two-way tunnel between both ends, Privaxy is able to block network requests based on URL patterns and to inject scripts as well as styles into HTML documents. Operating at a lower level, Privaxy is both more efficient as well as more streamlined than browser add-on-based blockers. A single instance of Privaxy on a small virtual machine, server or even, on the same computer as the traffic is originating from, can filter thousands of requests per second while requiring a very small amount of memory.

BoringTun is a high-performance, portable implementation of the WireGuard VPN protocol written in Rust, designed so that developers and system integrators can run WireGuard tunnels entirely in user space across a variety of operating systems without kernel modules. It implements the core WireGuard protocol — including key exchange, encryption (ChaCha20-Poly1305), and authenticated transport — while omitting platform-specific tunneling stacks, allowing embedment in custom VPN client applications or userspace networking tools. The repository includes both a library for programmatic use and a command-line executable that can act as a userspace WireGuard interface on supported platforms like Linux and macOS. Because it’s written in Rust, BoringTun benefits from strong safety guarantees, memory safety without garbage collection, and cross-platform support, making it suitable for mobile, desktop, and server environments.

Fuso is a lightweight intranet penetration and port-forwarding tool written in Rust. It is designed to expose internal services through a relay-style setup while remaining small, fast, and efficient. The project supports multiple connections, cascading proxy behavior, transmission encryption, and both TCP and UDP forwarding workflows. It can also work with SOCKS5 scenarios, including UDP forwarding in newer releases. Fuso is useful for developers and system administrators who need controlled access to services behind NAT, firewalls, or private networks. The project is best understood as a compact tunneling utility for learning, testing, and authorized network access rather than a commercial remote-access platform.

tunnelto is a Rust-based local tunneling tool that exposes a locally running web server through a public URL. It is designed for developers who need to test webhooks, demos, APIs, or in-progress applications without deploying them to a public server. The project includes both a hosted service model and self-hosting support, giving teams flexibility depending on their workflow and infrastructure needs. Its async architecture is built on Tokio, which helps it handle network connections efficiently. tunnelto is especially useful during development because it reduces the friction of sharing local work with clients, teammates, or third-party platforms. Its focus is simple: make a private local port reachable from the internet with minimal setup.

Tabularis is a free, open-source desktop database client for PostgreSQL, MySQL/MariaDB, and SQLite. Built with Rust and Tauri v2, it is fast, lightweight, and cross-platform (Windows, macOS, Linux). Features: SQL Notebooks with inline charts and cross-cell variables. AI-powered SQL assistant (OpenAI, Claude, Ollama, and more). Built-in MCP server for AI agent integration. Visual Query Builder with drag-and-drop JOINs. Plugin system to add any database driver. Monaco-based editor with smart autocomplete. High-performance data grid with inline editing. ER Diagram visualization. SSH tunneling. Secure credential storage via OS keychain. Split view, saved queries, SQL dump/import, 10+ themes, customizable shortcuts. Hackable, extensible, and built for everyday SQL work. https://tabularis.dev https://github.com/debba/tabularis

Cake is a compact, powerful toolkit that combines a flexible TCP/UDP proxy, port forwarding system, and connection manager designed for both development and penetration testing scenarios. It enables users to create complex networking flows where traffic can be proxied, relayed, and manipulated between endpoints — useful for debugging networked applications, inspecting protocols, or tunneling traffic through different hops. The tool is designed to work with multiple protocols and supports dynamic rule definitions so that incoming and outgoing connections can be routed, rewritten, or logged according to user-defined policies. Unlike many simple proxies, Cake can act as a full connection broker: it can bind to arbitrary interfaces, handle simultaneous upstream/downstream sessions, and apply traffic rules on the fly. This makes it suitable for troubleshooting tricky network behavior, simulating network conditions, or chaining services in a modular test environment.