meow-rs is a high-performance, rule-based tunneling proxy kernel in Rust — routing, transparent proxy, DNS snooping, and a built-in dashboard, packed into one ~6 MiB static binary.
Every claim on this page is a measured fact, not a tagline. meow-rs is engineered to a quantitative footprint bar — binary size, idle memory, and hot-path allocations are all under budget, every release.
Ingredients: Rust, Tokio, rustls, hickory-dns, Axum, tower — and a great deal of open-source goodness. Contains: network sockets. Free from: garbage collectors, telemetry, vendor lock-in.
* Percent Daily Value is a joke. Measured on aarch64: stripped static binary ~6 MiB, idle RSS ~9 MB, ~35 KB per connection at steady state. Your mileage varies with traffic. GPL-3.0.
Bring your existing Clash / mihomo config — meow-rs speaks the same dialect. Point it at a subscription or write rules by hand. It builds the routing table, opens the listeners, and serves a dashboard at /ui.
mixed-port: 7890 external-controller: 127.0.0.1:9090 proxies: - { name: hk, type: trojan, server: ex.com, port: 443, password: "•••" } proxy-groups: - { name: Proxy, type: url-test, proxies: [hk] } rules: - GEOIP,CN,DIRECT # stay home if it's local - MATCH,Proxy # everything else clears the wall
A full proxy kernel, not a toy — protocols, transports, a rule engine, and the plumbing to run it as a real gateway.
Shadowsocks, Trojan, VLESS (XTLS-Vision), VMess, Hysteria2, Snell, HTTP & SOCKS5 outbounds — TCP and UDP relay.
Domain, IP-CIDR, GeoIP, port, process, and regex rules with AND/OR/NOT logic. First match wins.
Kernel-level interception via nftables (Linux) or pf (macOS). SNI extraction, DNS snooping, loop-safe via SO_MARK.
Built-in UDP resolver with caching, FakeIP, and an IP→domain reverse table to recover hostnames for transparent flows.
Selector, URL-Test, Fallback, LoadBalance, and Relay groups with health checks. Dead nodes get skipped — it lands on its feet.
Encrypted Client Hello via BoringSSL, DNS-sourced ECH configs, and uTLS fingerprints for Chrome, Firefox, Safari, iOS & more.
Axum-powered API plus a built-in web UI at /ui — switch proxies, edit rules, watch live traffic. Mount your own dashboard too.
Import Clash YAML subscriptions, cache to disk for instant startup, and refresh in the background on a schedule.
| Crate | Purpose |
|---|---|
| meow-common | Core traits & types — ProxyAdapter, Rule, Metadata, ProxyHealth |
| meow-trie | Domain trie for fast pattern matching |
| meow-transport | TLS (rustls + BoringSSL ECH), WebSocket, gRPC, H2, HTTPUpgrade |
| meow-proxy | Protocols (SS, Trojan, VLESS …) & groups (Selector, URLTest, Fallback, Relay) |
| meow-rules | Rule matching engine & parser with logic composition |
| meow-dns | Resolver, cache, snooping (IP→domain), FakeIP, UDP server |
| meow-tunnel | Core routing engine, TCP/UDP relay, connection statistics |
| meow-listener | Inbound handlers — Mixed / HTTP / SOCKS5 / TProxy |
| meow-config | YAML parsing, subscription fetcher, proxy providers |
| meow-api | REST API (Axum) + embedded web dashboard |
| meow-app | CLI entry point — health checks, subscription refresh, geodata |
| meow-bench | Standalone benchmark binary (throughput, latency, DNS, memory) |
Requires Rust 1.89+.
cargo build --release
Copy the example and add your servers.
cp config.example.yaml \ config.yaml
Start it, then open the dashboard.
./target/release/meow \
-f config.yaml
# → 127.0.0.1:9090/uiPoint your tools at the proxy.
export https_proxy=\ http://127.0.0.1:7890 curl https://ipinfo.io
Crack open the tin, point it at your servers, and watch every connection land on the right side of the wall.