tcptun

Go TCP tunnel and mixed proxy

Fast client-server tunneling for modern proxy deployments.

tcptun carries SOCKS5, HTTP CONNECT, and tunnel traffic through native, VLESS, VMess, Trojan, and REALITY/Vision modes with low overhead and production-friendly configuration.

Download latest View source 
$ tcptun server \
  --listen 0.0.0.0:443 \
  --tunnel-protocol vless \
  --transport raw \
  --tunnel-security reality \
  --flow xtls-rprx-vision

$ tcptun client \
  --listen 127.0.0.1:1080 \
  --server-addr proxy.example.com:443

Capabilities

One binary, several deployment shapes.

Mixed local proxy

Accepts SOCKS5, SOCKS5 UDP ASSOCIATE, HTTP proxy, and HTTP CONNECT traffic from one local listener.

Multiple tunnel protocols

Use the native protocol for full coverage, or VLESS, VMess, and Trojan for compatible TCP tunneling.

REALITY/Vision support

Run VLESS over raw transport with REALITY/Vision for deployments that need realistic TLS behavior.

Efficient transports

Carry tunnels over raw TCP, WebSocket, HTTP/2, or HTTP/3, with multiplexing in native mode.

Deploy

Start with generated config files.

Generate ready-to-edit server, client, and route configuration files, then run the matching server and local client commands. 

tcptun config --protocol vless \
  --server-addr proxy.example.com:443

tcptun server --config server.json
tcptun client --config client.json

Usage Guide

From a fresh server to a local proxy port.

The fastest path is to generate matching JSON files, copy the server file to your VPS, and keep the client file on your computer.

1

Generate config

Create server, client, and route files with one shared token.

tcptun config --protocol vless \
  --transport raw \
  --server-addr proxy.example.com:443
2

Run the server

On public servers, tcptun only dials public destination IPs and drops private ranges.

tcptun server --config server.json
3

Run the client

The client opens a local mixed proxy endpoint for SOCKS5, HTTP proxy, and CONNECT traffic.

tcptun client --config client.json
4

Use the proxy

Point your browser, app, or CLI tool at the local listener.

curl -x socks5h://127.0.0.1:1080 \
  https://ifconfig.me

REALITY/Vision

Use VLESS over raw transport with tunnel_security set to reality and flow set to xtls-rprx-vision. The server needs a private key, allowed server names, and a fallback destination; the client needs the matching public key, server name, UUID, and short ID.

Behind nginx

Use WebSocket transport when placing tcptun behind a standard HTTP reverse proxy. Run the server on loopback and proxy the configured tunnel path to that local port.

Config Generator

Generate ready-to-run config files.

Fill in the deployment details and generate matching server.json, client.json, and route.json. Tokens and REALITY keys are generated in your browser. 

Click Generate to create config files.

Xray / V2Ray Converter

Convert JSON configs in your browser.

Paste an Xray or V2Ray JSON config and generate a tcptun client.json or server.json. Conversion runs locally in this page; the config never leaves your browser.

tcptun output 
Paste a config and click Convert.

Download

Prebuilt binaries for common platforms.

Release packages include the binary, English and Chinese README files, docs, and SHA-256 checksum files.

Open releases