Open Source Rust Tunneling Software

Shadowsocks Rust is an open-source, high-performance implementation of the Shadowsocks secure proxy protocol written in Rust, designed to provide fast, encrypted SOCKS5-based tunneling to help users bypass network censorship and protect privacy. Shadowsocks itself is widely used to route internet traffic through an encrypted proxy, allowing secure access to blocked or restricted content while mitigating simple traffic-inspection techniques. By leveraging Rust, this implementation emphasizes memory safety, concurrency, and efficiency, making it suitable for both client and server use on devices ranging from small embedded systems to large servers. The repository includes multiple binaries such as sslocal for local SOCKS5 proxy clients and ssserver for remote proxy servers, giving developers flexible components to build customized proxy setups. It also supports modern asynchronous networking patterns, optional DNS handling, transparent proxy modes, tunneling, and advanced cipher methods.

BoringTun is a high-performance, portable implementation of the WireGuard VPN protocol written in Rust, designed so that developers and system integrators can run WireGuard tunnels entirely in user space across a variety of operating systems without kernel modules. It implements the core WireGuard protocol — including key exchange, encryption (ChaCha20-Poly1305), and authenticated transport — while omitting platform-specific tunneling stacks, allowing embedment in custom VPN client applications or userspace networking tools. The repository includes both a library for programmatic use and a command-line executable that can act as a userspace WireGuard interface on supported platforms like Linux and macOS. Because it’s written in Rust, BoringTun benefits from strong safety guarantees, memory safety without garbage collection, and cross-platform support, making it suitable for mobile, desktop, and server environments.

VPNCloud is a peer-to-peer VPN solution that uses UDP tunneling to create secure, distributed virtual networks. Unlike traditional VPNs, VPNCloud creates mesh-like connections between nodes and is particularly useful for remote access, private networks, or IoT environments. It supports both encrypted and plaintext tunnels, dynamic peer discovery, and flexible routing. With minimal configuration, VPNCloud provides a lightweight way to link multiple machines across the internet as if they were on the same LAN.

Narrowlink is a zero-config tunneling and reverse proxy solution that enables secure access to services behind firewalls or NATs without exposing public IPs. Unlike traditional tools like ngrok, Narrowlink is peer-to-peer and privacy-focused, using WireGuard and WebRTC to establish direct encrypted tunnels between peers. It is designed to make exposing local services simple, fast, and secure with no need for port forwarding or cloud relays. Narrowlink is ideal for developers, self-hosters, and remote teams looking for frictionless, encrypted connectivity.

Tabularis is a free, open-source desktop database client for PostgreSQL, MySQL/MariaDB, and SQLite. Built with Rust and Tauri v2, it is fast, lightweight, and cross-platform (Windows, macOS, Linux). Features: SQL Notebooks with inline charts and cross-cell variables. AI-powered SQL assistant (OpenAI, Claude, Ollama, and more). Built-in MCP server for AI agent integration. Visual Query Builder with drag-and-drop JOINs. Plugin system to add any database driver. Monaco-based editor with smart autocomplete. High-performance data grid with inline editing. ER Diagram visualization. SSH tunneling. Secure credential storage via OS keychain. Split view, saved queries, SQL dump/import, 10+ themes, customizable shortcuts. Hackable, extensible, and built for everyday SQL work. https://tabularis.dev https://github.com/debba/tabularis

Cake is a compact, powerful toolkit that combines a flexible TCP/UDP proxy, port forwarding system, and connection manager designed for both development and penetration testing scenarios. It enables users to create complex networking flows where traffic can be proxied, relayed, and manipulated between endpoints — useful for debugging networked applications, inspecting protocols, or tunneling traffic through different hops. The tool is designed to work with multiple protocols and supports dynamic rule definitions so that incoming and outgoing connections can be routed, rewritten, or logged according to user-defined policies. Unlike many simple proxies, Cake can act as a full connection broker: it can bind to arbitrary interfaces, handle simultaneous upstream/downstream sessions, and apply traffic rules on the fly. This makes it suitable for troubleshooting tricky network behavior, simulating network conditions, or chaining services in a modular test environment.

Next generation tracker and advertisement blocker. Privaxy is a MITM HTTP(s) proxy that sits in between HTTP(s) talking applications, such as a web browser and HTTP servers, such as those serving websites. By establishing a two-way tunnel between both ends, Privaxy is able to block network requests based on URL patterns and to inject scripts as well as styles into HTML documents. Operating at a lower level, Privaxy is both more efficient as well as more streamlined than browser add-on-based blockers. A single instance of Privaxy on a small virtual machine, server or even, on the same computer as the traffic is originating from, can filter thousands of requests per second while requiring a very small amount of memory.