ShadowVPN

Appearance

ShadowVPNUDP · PSK · user-mode VPN in Rust

A fixed point-to-point / multi-client tunnel whose on-wire crypto matches the shadowsocks AEAD UDP scheme byte-for-byte. Runs on Linux, macOS, and Windows — with user-mode policy routing, QUIC/HTTP3 carrier obfuscation, and no kernel ipset or nft rules.

Quick start
What is ShadowVPN?
View on GitHub
🔒

Spec-correct crypto

Per-datagram random salt, HKDF-SHA1 "ss-subkey", zero nonce, AEAD tag — the shadowsocks UDP scheme exactly, interoperable by construction.

Wire protocol

📦

One packet, one datagram

No length prefix, no SOCKS header, no multiplexing. The plaintext is the raw IP packet — UDP boundaries are the frame boundaries.

🖧

User-mode TUN

Async TUN on Tokio via tun-rs — Linux tun0, macOS utun, and Windows Wintun. Pipelined relay loops plus a keepalive.

🧭

Policy routing

Optional split tunnel — send only selected destinations through the tunnel, decided entirely in user space. No ipset, no nft.

Policy routing

✨

Magic DNS

Resolve joined peers by hostname — ping laptop, ssh pi.svpn — the same way Tailscale Magic DNS works, with no extra control plane.

Magic DNS

🌏

gfwlist · chinadns

Tunnel a domain list, or everything that isn't a China IP. Build the China set from a plain CIDR file or a GeoLite2 database.

🎭

Carrier obfuscation

Optionally shape the UDP payload to look like QUIC/HTTP3, or encode it as printable base64 — cosmetic framing to dodge naive classification.

Obfuscation

🪟

Cross-platform client

The client runs on Linux, macOS, and Windows (TUN via Wintun), policy routing included — a self-elevating launcher ships in scripts/.

🦀

Lean Rust

Tokio + RustCrypto, a tiny dependency set, and a Docker end-to-end test suite covering the tunnel, HTTP/3, and policy routing.

Testing

🚀

Line-rate data plane

Pipelined relay loops carry single-flow TCP at ~1 Gbit/s; at broadband rates the tunnel runs at or near line rate.

Benchmarks

Install in one line ​

Linux & macOS — detects your OS/CPU and installs the latest release:

sh
curl -fsSL https://raw.githubusercontent.com/madeye/shadowvpn/main/scripts/install.sh | sudo bash -s -- server
sh
curl -fsSL https://raw.githubusercontent.com/madeye/shadowvpn/main/scripts/install.sh | sudo bash -s -- client

Uninstall with … | sudo bash -s -- uninstall server (or client). All options — pinned versions, --service, --purge, Windows packages — are in the installation guide.

Released under the MIT License.

ShadowVPN — a UDP PSK user-mode VPN in Rust