tun2socks

TUN packets in, proxied TCP and UDP connections out

tun2socks picks up raw IP packets from a TUN interface, hands them to gVisor's TCP/IP stack running in user space, and opens the matching TCP and UDP connections through a proxy server. Programs on the machine need no proxy setting; the routing table only has to point their traffic at the interface. The project is written in Go and ships prebuilt binaries.

Outbound over SOCKS5, Shadowsocks, SSH or a GOST relay

• --proxy understands eight URL schemes: http:// (the server must support CONNECT), socks4://, socks5:// (Unix domain sockets included), ss:// with optional HTTP obfuscation, ssh:// with a password or a private key, relay:// for GOST's relay protocol, direct:// for testing, and reject://, which refuses every outgoing connection.
• Release v2.7.0 has 31 archives covering Linux, macOS, Windows, FreeBSD and OpenBSD, including Linux builds for ARM, MIPS, PowerPC, s390x and LoongArch.
• The fd:// device takes a file descriptor that is already open instead of a named interface. Version 2.6.0 added an iOS-specific option to it.
• Gateway mode forwards layer 3 traffic for other devices on the network. On Linux, the ghcr.io/xjasonlyu/tun2socks Docker image handles the setup: it creates the interface, adds fwmark-based policy routing and reads included or excluded routes from environment variables.
• Settings come from flags or a YAML file (-c). --tun-pre-up and --tun-post-up run a command before and after the interface is created, and --restapi starts an HTTP statistics server.
• IPv6 is supported, including IPv4 carried over IPv6 and the other way round.

Routes and DNS are on you, and HTTP or SSH carry no UDP

Addresses and routes are a manual job. tun2socks connects the TUN interface to the proxy and does nothing else. The wiki examples bring up the interface and default route with ip on Linux, sometimes with rp_filter turned off, add nine routes with route on macOS, and use netsh on Windows, where the wintun driver is a separate download. In the repository, only the Docker image's entrypoint script automates this, and only on Linux.

DNS is out of scope. The wiki's DNS page is explicit: tun2socks is not designed for name resolution, and setting up DNS servers is the user's job.

UDP support depends on the protocol. SOCKS5 and Shadowsocks carry it, and Relay wraps it in TCP. HTTP, SOCKS4 and SSH are TCP only; the SSH backend answers any UDP request with an "unsupported" error.

A proxy running on the same host causes a routing loop. The wiki warns against a proxy listening locally (127.0.0.1:1080). Binding tun2socks to the physical interface with --interface works around it, and the wiki says users need enough networking knowledge to set that up themselves.

Memory needs tuning. The project is built for performance first and warns that memory use can run high, with TCP buffers at 1 MiB by default. For low-RAM hosts the wiki recommends 16k to 64k buffers (--tcp-sndbuf, --tcp-rcvbuf), which can sometimes use up to 80% less memory than large ones.

The README claims tun2socks performs best in every scenario, based on a 2021 benchmark. The wiki comparison against badvpn-tun2socks and go-tun2socks was run with v2.3.2, released in November 2021.

Licensed MIT since v2.6.0. Releases up to v2.5.2 were under GPL-3.0.

Latest release: v2.7.0, July 12, 2026. That version added the SSH proxy. Version 2.6.0 shipped in June 2025, and 2.5.2 in November 2023. The most recent commit is from October 11, 2026.