# erebe/wstunnel

Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available

Repository: https://github.com/erebe/wstunnel
Canonical: https://ross.abutalabs.com/products/wstunnel
Language: Rust
License: BSD-3-Clause
License Family: permissive
Topics: reverse-tunnel, socks5-proxy, tcp-tunnel, transparent-proxy, tunneling, udp-tunnel, websocket, wireguard, wireguard-tunnel, http2, socks, socks5
Last push: 2026-08-25T19:21:22+00:00

## Health v2 (maintenance only)
Score: 97/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 93, longevity 100
- inputs: {"age_days": 3763, "days_push": 8, "days_rel": 46, "gap_med": 18.5, "n_releases_24m": 25}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6996, forks 559 (observed 2026-08-28T04:09:52.585586+00:00)

## What it is
wstunnel is a Rust CLI tool that tunnels arbitrary TCP, UDP, Unix socket, or stdio traffic over WebSocket, HTTP2, or WebTransport to bypass firewalls, proxies, and DPI. It supports static and dynamic (Socks5, HTTP, transparent) tunneling in both forward and reverse directions, with TLS/mTLS and standalone static binaries.

## Use cases
- bypass firewall or DPI restrictions on a public network
- tunnel traffic over websocket since http is always allowed
- expose a service behind NAT via reverse tunnel
- create a socks5 proxy over a websocket connection
- tunnel wireguard udp traffic over websocket
- route traffic through an http proxy gateway

## When to choose
- you need to tunnel arbitrary TCP/UDP traffic through networks that only allow HTTP/WebSocket
- you want a single static binary with no runtime dependencies
- you need reverse tunneling or dynamic socks5/transparent proxying
- you want TLS/mTLS with certificate auto-reload out of the box

## When to avoid
- you need a general-purpose VPN with full network-layer encryption like WireGuard alone
- you need a GUI-managed VPN solution for non-technical users
- your network already allows direct connections and you just need a plain VPN

## Facets
- artifact type: cli-tool
- maturity: active
- function: proxy, networking, websocket, vpn, security
- domain: networking, security, privacy, censorship-circumvention
- platform: windows, cross-platform, cli
- tags: tunneling, websocket-tunnel, firewall-bypass, dpi-evasion, socks5-proxy, wireguard, http2, static-binary, reverse-tunnel, transparent-proxy, command-line, linux, macos

## Member repositories
- erebe/wstunnel (main) score 97

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:52.585586+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:41:05.986510+00:00, confidence not recorded.
  - readme: https://github.com/erebe/wstunnel (fetched 2026-08-28T04:09:52.585586+00:00, sha ccac248f71cc)
- Data as of 2026-08-30T08:39:29.467469+00:00.