OpenFlux: A SOCKS5 TCP tunnel using Yandex and MAX transports
A Go TCP-tunnel research tool for developers that exposes SOCKS5 and swaps Yandex or MAX transports.
GitHub p1neappleXpress/OpenFlux Updated 2026-09-12 Branch main Stars 1.1K Forks 88
Go Swift Shell C TCP tunnel SOCKS5 Yandex Docs MAX WebRTC Linux VPS

🧭 Decision Guide

Why trending now: Cannot be determined from the provided materials

Try it if you

  • You need to deploy an exit node on a Linux VPS and route a desktop client through SOCKS5 :1080.
    The README's “Requirements” and “Usage” sections require a Linux VPS / VDS exit node and show the --socks5 :1080 example.
  • You are researching pluggable TCP transports and are willing to implement the Transport interface from transport/transport.go.
    The README's “Implementing custom transports” section explicitly allows implementing the Transport interface and registering it in main.go.
  • Your build environment can provide Go 1.26.3+, Android NDK 27.0.12077973+, or Xcode 26.6+.
    The README's “Requirements” section lists the minimum Go, Android NDK, and XCode versions.

Skip it if you

  • You must use an important MAX account, or losing the account would have critical consequences.
    The README's MAX warning says not to use a primary or important MAX account or an account whose loss would be critical.
  • You cannot accept MAX account restrictions caused by an external VPS, or restrictions that may continue after stopping OpenFlux.
    The README's MAX warning says an external VPS may cause account restrictions and that restrictions may persist after stopping OpenFlux.
  • You need a mature and stable MAX transport rather than the experimental WebRTC DataChannel backend.
    The README states that MAX transport should be considered experimental until the blocking mechanism is understood.
  • You lack root access or cannot configure iptables rules on the Linux exit node.
    The README's “Setting up exit node” section requires root access and provides iptables configuration commands.

Requirements

  • Go v. 1.26.3+, required to build the desktop client / exit node binary.
  • Android NDK v.27.0.12077973+, required to build the Android client binary.
  • XCode v. 26.6+, required to build the iOS client binary.
  • A Linux VPS / VDS exit node.
  • Root access on the exit node.
  • The legacy Yandex document editor is required for the Yandex transport.
  • The MAX transport requires a MAX token and User ID, corresponding to --maxToken and --maxUid.

First step (verbatim from README)

go mod tidy

Watch out

  • Scope the exit-node RST rule to a dedicated egress IP; the README does not recommend dropping all outbound RST packets host-wide.
    The README's “Setting up exit node” section says a host-wide -j DROP makes closed ports appear filtered and affects unrelated connections.
  • -m owner --uid-owner does not work in this scenario because the tunnel-breaking RST is generated by the kernel without an owning socket.
    The README's exit-node instructions explicitly say the owner match never fires.
  • The Yandex exit-node command requires a legacy document URL and uses --exit-node, --local-ip, and --url.
    The README's scoped command contains --exit-node --local-ip 203.0.113.10 --url "YOUR_YANDEX_DOC_URL".
  • The iOS client is not only a command-line artifact; it also involves SwiftUI, XcodeGen, and liboflux.a.
    The README's Structure section lists ios-app, SwiftUI, XcodeGen, and liboflux.a.

Not stated in the README

  • The README provides no throughput, latency, or concurrent-connection benchmarks for the Yandex or MAX transports.
  • The README does not explain the trigger conditions, scope, or appeal process for MAX account restrictions.
  • The README does not provide Android APK or iOS TestFlight version numbers or a compatible-device list.
  • The README does not specify the CPU, memory, bandwidth, or distribution version required for the Linux VPS.
  • The README provides no independent information about security audits, encryption, or transport-level data confidentiality.
  • The project has only one release, rel 0.0.1, and 10 recent commits; the README does not describe a future release plan.

💡 Deep Analysis

6
It depends I have a Linux VPS/VDS with root access and plan to run an Exit Node. I do not want RST-suppression iptables rules to affect unrelated host connections. Is OpenFlux suitable?
For: A network-experiment engineer operating a Linux VPS/VDS with root access who needs to isolate userspace TCP egress connections

It depends: it is suitable only if you can provide a dedicated egress IP or an isolated network namespace/container.

  • The README requires root access for the Exit Node and explains that the gvisor userspace TCP stack has no kernel socket, causing the kernel to emit RST packets that must be suppressed.
  • It recommends scoping the rule to a dedicated egress IP such as 203.0.113.10, then starting the Exit Node with --local-ip.
  • It also recommends running the Exit Node in its own network namespace or container so the rule does not touch the host’s main services.
  • A host-wide DROP should not be assumed safe: the README says it makes closed ports appear filtered and affects unrelated connections. If the host cannot be isolated, this is not a good fit.
  • Usage / Setting up exit node: `You must have root access on exit node machine`
  • Usage: `The exit node's TCP connections live in a userspace stack (gvisor)`
  • Usage: `Recommended (scoped to a dedicated egress IP)`
  • Usage: `Even cleaner: run the exit node in its own network namespace / container`
  • Usage: `A blanket -j DROP on all outbound RSTs makes every closed port answer with silence`
sudo iptables -A OUTPUT -p tcp --tcp-flags RST RST -s 203.0.113.10 -j DROP
sudo ./universal-bypass-tool --exit-node --local-ip 203.0.113.10 \
    --url "YOUR_YANDEX_DOC_URL" --debug
Not stated in the README：The README does not specify compatibility across Linux distributions, kernel versions, or container runtimes.；It provides no quantitative impact of the iptables rule on throughput, latency, or other network services.
Yes I only want to run the client on a Linux, macOS, or Windows desktop, let a browser connect to localhost:1080, and use an existing Exit Node through Yandex Transport. Is OpenFlux suitable?
For: A developer on desktop Linux, macOS, or Windows who only needs a browser to use Yandex Transport through a local SOCKS5 proxy

Yes, this matches the README’s minimal desktop path, provided that you already have a reachable Exit Node and a Yandex document URL.

  • The desktop client starts a SOCKS5 proxy with --client; the default listen address is :1080, which the browser can use as localhost:1080.
  • The requirements specify Go 1.26.3+ for building the desktop client and Exit Node.
  • The default transport is yandex, and the client command only needs the Yandex document URL, SOCKS5 address, and optional debug logging.
  • This is not a serverless proxy: the documented architecture still requires a remote Exit Node. It also supports only the legacy Yandex document editor, so service behavior or account permissions may cause failures.
  • Requirements: `Golang v. 1.26.3+`
  • Usage / Setting up desktop client: `./universal-bypass-tool --client --url "YOUR_YANDEX_DOC_URL" --socks5 :1080 --debug`
  • Usage: `Then set up SOCKS5 proxy in your browser at localhost:1080.`
  • Flags: `--socks5` defaults to `:1080`; `--transport` defaults to `yandex`
  • Setting up exit node: `Only legacy Yandex document editor is supported`
./universal-bypass-tool --client --url "YOUR_YANDEX_DOC_URL" --socks5 :1080 --debug
Not stated in the README：The README does not state compatibility beyond browsers or how SOCKS5 DNS requests are handled.；It does not explain how to create and permission the Yandex document URL or diagnose URL invalidation.
Yes I am comparing Yandex Docs cursor messages with MAX WebRTC DataChannel for TCP tunneling and want a browser to connect through SOCKS5. Is OpenFlux suitable for this experiment?
For: A network-protocol researcher comparing Yandex Docs and MAX WebRTC DataChannel as TCP tunnel transports through a SOCKS5 entry point

Yes, because the project is explicitly a pluggable TCP-tunnel prototype for network-stack research.

  • Its documented architecture is Client (SOCKS5) → Transport → Exit Node → Internet, so a browser does not need to understand the underlying transport.
  • It already includes two replaceable backends: Yandex sends data through Docs cursor messages, while MAX uses a WebRTC DataChannel.
  • The Transport interface and --transport flag support switching backends for comparing connectivity, latency, and disconnect behavior.
  • However, the README provides no throughput, latency, concurrency, or reconnection benchmarks. MAX is explicitly experimental and may cause account restrictions, so results should not be treated as production-network performance.
  • Overview: `Client (SOCKS5) --> Transport --> Exit Node --> Internet`
  • Overview: `Yandex - sends packets via Yandex Docs cursor messages`; `Max - sends packets via WebRTC DataChannel`
  • Flags: `--transport`, defaulting to `yandex`
  • MAX warning: `MAX transport should be considered experimental`
./universal-bypass-tool --client --url "YOUR_YANDEX_DOC_URL" --socks5 :1080 --debug
Not stated in the README：The README provides no throughput, latency, concurrency, or recovery data for either transport.；It does not define a reproducible method for comparing Yandex and MAX under identical network conditions.
Yes I use Go 1.26.3+ and want to add a new message or WebRTC transport while keeping the existing TCP tunnel and SOCKS5 entry point. Is OpenFlux a suitable extension baseline?
For: A protocol developer using Go 1.26.3+ who wants to add a non-traditional transport while maintaining both the client and Exit Node

Yes, because the README exposes a direct Transport extension point instead of requiring changes throughout the tunnel core.

  • transport/transport.go defines the Transport interface, while Yandex and MAX are separate existing backends.
  • The README explicitly allows implementing that interface and registering a custom transport in the switch block in main.go.
  • Compression, the TCP tunnel, SOCKS5, and packet parsing are separated into distinct components, so a new carrier can reuse the existing client and Exit Node paths.
  • However, the project is only at version 0.0.1. The README does not specify interface stability, lifecycle rules, timeout, cancellation, backpressure, reconnection, or error-propagation semantics; those details must be verified in the source.
  • Implementing custom transports: `You are free to implement the Transport interface from transport/transport.go and register your custom transport in main.go switch block.`
  • Structure: `transport/transport.go # Transport interface`
  • Structure: `compressor.go`, `tunnel/tunnel.go`, `socks5/`, and `network/`
  • Project data: latest release `0.0.1`, with `1` release
go mod tidy
go build -o universal-bypass-tool .
Not stated in the README：The README does not show the Transport interface method signatures or concurrency requirements.；It does not state whether existing transports implement timeout, cancellation, reconnection, or backpressure handling.
It depends I use Xcode 26.6+, need a system-wide VPN through Network Extension, and want to compile the Go core as a static library for a SwiftUI client. Is OpenFlux suitable?
For: An iOS engineer using Xcode 26.6+ who needs a system-wide VPN client through Network Extension and can work with SwiftUI plus a cgo build chain

It depends: the project has a clear iOS integration path, but it is presented as a build-and-test prototype rather than a production-ready iOS VPN product.

  • The requirements specify Xcode 26.6+, and the repository contains export_ios.go, described as the cgo bridge for the iOS static library.
  • The structure lists an ios-app/ SwiftUI client, liboflux.a, build_ios.sh, and build_ios_app.sh.
  • The Clients section states that iOS uses Network Extension for a system-wide VPN and provides a TestFlight beta, demonstrating an existing mobile integration route.
  • However, the README does not document Apple provisioning, Network Extension entitlements, signing, device compatibility, App Store/TestFlight delivery configuration, or security review. That is insufficient for assuming production-release readiness.
  • Requirements: `XCode v. 26.6+`
  • Structure: `export_ios.go # cgo bridge for the iOS static library`
  • Structure: `ios-app/ # SwiftUI iOS client` and `links liboflux.a`
  • Clients: `System-wide VPN via Network Extension`
  • Build: `build_ios.sh` and `build_ios_app.sh`
export XCODE_PATH="<your Xcode.app path>" # optional, defaults to /Applications/Xcode.app
./build_ios.sh
Not stated in the README：The README does not document Network Extension entitlements, Apple signing, or provisioning-profile configuration.；It does not specify supported iOS devices, OS versions, architectures, or TestFlight build constraints.；It provides no iOS security-audit results or App Store release status.
It depends I must build the OpenFlux Android client with Android NDK 27.0.12077973+ and want an installable APK. Does the README provide a sufficiently clear build path?
For: A mobile developer building the Android client with Android NDK 27.0.12077973+ who needs mobile access to the OpenFlux SOCKS5/TCP tunnel

It depends: the README provides a build entry point for the Android binary, but not a complete APK packaging, signing, and installation workflow.

  • The requirements explicitly require Android NDK v27.0.12077973+, showing that Android client construction is supported.
  • The Android build section provides build_android.sh and requires setting ANDROID_NDK_HOME first.
  • The Clients table points Android users to the separate OpenFluxAndroid releases project and labels the deliverable a standalone APK, so the mobile application is separated from this core repository.
  • The README does not specify Android project structure, Gradle or Android Studio versions, signing configuration, ABIs, APK output location, or installation commands. The binary build path is clear, but producing a signed APK solely from this repository is underdocumented.
  • Requirements: `Android Native Development Kit (NDK) v.27.0.12077973+`
  • Build for Android: `export ANDROID_NDK_HOME=<your Android NDK path>` and `./build_android.sh`
  • Clients: `Android ... Standalone APK`, linked to `p1neappleXpress/OpenFluxAndroid`
export ANDROID_NDK_HOME=<your Android NDK path>
./build_android.sh
Not stated in the README：The README does not document the Android APK Gradle, signing, ABI, or release-build process.；It does not document version compatibility between the Android binary and the separate OpenFluxAndroid APK project.

✨ Highlights

  • Go TCP tunnel with Yandex and MAX transport backends
  • The client exposes SOCKS5 while the exit node uses gVisor userspace networking
  • Supports Android, iOS TestFlight, and Linux VPS exit nodes
  • The project has 1,150 stars, 88 forks, and 4 contributors

🔧 Engineering

  • main.go provides client and exit-node modes; the client listens on SOCKS5 :1080.
  • Yandex uses Docs cursor messages, while MAX uses WebRTC DataChannel.
  • The Transport interface allows custom backends registered in transport.go.

⚠️ Risks

  • The README warns that MAX may restrict accounts and restrictions may persist after stopping OpenFlux.
  • Using MAX through an external VPS may trigger account restrictions; MAX remains experimental.
  • The exit node needs IP-scoped iptables rules; global RST drops can affect host connections.

👥 For who?

  • Developers needing Go 1.26.3+ to build the TCP tunnel client or Linux exit node.
  • Teams maintaining clients with Android NDK 27.0.12077973+ or Xcode 26.6+.
  • Engineers researching SOCKS5, pluggable transports, and the gVisor userspace network stack.