OpenFlux

Open source alternative to Astrill VPN

2.2K stars
GPL-3.0
Active this week
Last commit 6 days ago

Last verified Oct 21, 2026

Run TCP tunnels through Yandex Docs or MAX WebRTC transports, surfacing a SOCKS5 proxy on localhost. GPL-3.0 Go tool with Android and iOS clients.

Visit website GitHub2.2K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who OpenFlux is for#

Researchers studying traffic obfuscation in Go

OpenFlux provides a working, readable Go implementation of pluggable transports that hide TCP inside application-layer messaging protocols. The Transport interface is the documented extension point for testing new backends against the existing SOCKS5 and exit-node infrastructure.

Skip if:

If your research requires high-throughput or low-latency benchmarks, OpenFlux's dependence on Yandex Docs or MAX Messenger infrastructure adds variable latency you cannot control.

Go developers building and testing custom transport protocols

The Transport interface and the two included transport backends serve as a complete reference for adding new obfuscation channels. Implementing the interface and registering it in main.go's switch block connects the new backend to the existing SOCKS5 server and exit-node pipeline.

Skip if:

If you need a maintained transport framework with a plugin ecosystem and community-tested implementations, established obfuscation libraries are more mature than building on top of a research tool.

Security engineers auditing obfuscated tunnel designs

OpenFlux demonstrates how TCP traffic can be embedded inside collaboration protocols that are typically allowlisted on corporate or regional networks. Both included transports are documented in the README with setup instructions, making the architecture legible for audit and evaluation.

Skip if:

If you need a production-audited tool for end-user deployment, OpenFlux is positioned as a research implementation with no warranties; a purpose-built audited tool is more appropriate.

iOS and Android developers studying VPN-layer integrations

The iOS client shows how to connect a Go tunnel backend to iOS Network Extension for system-wide VPN coverage. The Android binary integrates via NDK. Both are open source and serve as reference implementations for mobile integration with a Go-based pluggable transport backend.

Skip if:

If you need an App Store or Play Store distribution for end users, the iOS client is on TestFlight only and the Android APK requires sideloading; neither has a public app store listing.

the problem

The problem it solves#

Network operators that apply deep packet inspection can identify and block conventional VPN handshakes, proxy protocols, and common tunnel signatures without ever checking the traffic destination. The more a tool's traffic pattern resembles a known bypass protocol, the faster it gets blocked, leaving users on restricted networks without a working outbound path.

Experimenting with alternative transport layers is also technically expensive. Most available open source tunneling tools expose a fixed protocol with no extension point, so researchers who want to test a new obfuscation channel must fork and refactor the tunnel core before they can run a single experiment.

how OpenFlux solves it

How it solves it#

SOCKS5 proxy interface

The client binary starts a SOCKS5 listener at :1080 by default, accepting connections from any browser or application configured to use a local proxy. Traffic is packaged into the configured transport and sent to the exit node for decapsulation. The --socks5 flag changes the listen address if needed.

Yandex Docs cursor transport

TCP packets are encoded as Yandex Docs cursor messages and transmitted through Yandex's document collaboration channel. This makes tunnel traffic appear as document-editing activity to network inspection systems. The exit node requires a Yandex document URL passed via --url, and the legacy Yandex Docs editor must be enabled in the Yandex interface.

MAX Messenger WebRTC transport

Routes packets through MAX Messenger WebRTC DataChannels using a valid MAX account. Marked experimental in the README due to unknown blocking behavior; using it from an external VPS may lead to account restrictions that persist after the tool stops. Auth token and user ID are passed via --maxToken and --maxUid flags.

Pluggable transport extension point

The Transport interface in transport/transport.go defines the contract for adding new backends. Adding a custom transport requires implementing that interface and registering it in the switch block in main.go. The Yandex and MAX transports serve as working reference examples. No changes to the SOCKS5 server or tunnel core are needed.

Android APK and iOS VPN client

A standalone Android APK is maintained at the OpenFluxAndroid repository. An iOS client built by a contributor runs as a system-wide VPN using iOS Network Extension, supports DNS-over-TLS, and is distributed via TestFlight. Both are open source and represent fully functional client-side integrations with the Go tunnel backend.

strengths · trade-offs

Strengths and trade-offs#

Strengths

GPL-3.0 with full source visibilityThe complete Go codebase, including both transport backends, the SOCKS5 server, and the userspace TCP stack integration, is available under GPL-3.0. Researchers and engineers can trace every packet path from SOCKS5 listener to exit-node forwarding. Modifications are permitted; distributing a modified version requires publishing changes under the same license.
Transport interface designed for extensionAdding a new backend requires implementing one Go interface in transport/transport.go and one switch-case entry in main.go. The tunnel core and SOCKS5 server need no changes. This makes OpenFlux a practical testbed for experimenting with new traffic obfuscation channels without rewriting the surrounding infrastructure.
Community-built mobile clientsAn Android APK and an iOS client with system-wide VPN support via iOS Network Extension are available. The iOS build includes DNS-over-TLS. Few Go tunneling projects include production-quality mobile clients; these extend OpenFlux beyond desktop-only use to full device coverage on two major mobile operating systems.
Active development since June 2026 launchThe repository was created in June 2026 and recorded over 1,100 GitHub stars in roughly three months. The last commit was in September 2026, matching the current month. 28 open issues indicate active community engagement rather than an abandoned release.

Trade-offs

-MAX transport carries account restriction riskThe README explicitly warns that using the MAX transport from an external VPS may cause MAX account restrictions that persist after the tool stops, and that the blocking mechanism is not yet understood. The README advises against using a primary account. Treat this transport as a research path, not a production option for accounts where access loss would be a problem.
-Exit node requires root access and iptables rulesRunning the exit node requires root access on a Linux VPS and configuring iptables RST suppression on the outbound RST flag. The README documents a scoped approach using a dedicated IP alias to limit the rule's blast radius, but this is not a zero-configuration deployment. Users unfamiliar with Linux network administration will need to follow the documentation carefully.
-No prebuilt binaries or container imagesThe README and repository provide no prebuilt release binaries or Docker image. Both the client and exit-node must be built from source with Go 1.26.3 or later. Building mobile clients requires additional toolchains: Android NDK v27.0.12077973 or later for Android, XCode 26.6 or later for iOS.
-Yandex transport requires legacy Yandex Docs editorThe Yandex transport only works with Yandex's legacy document editor, which must be manually enabled from the Yandex Docs interface. If Yandex discontinues the legacy editor mode, this transport path breaks. This is an upstream dependency outside the project's control.

versus alternatives

OpenFlux vs alternatives#

OpenFlux vs Commercial VPN Services

OpenFlux and commercial VPN services both route outbound traffic through an intermediary to the internet, but they differ in transparency, control, and target user. A commercial VPN runs proprietary server software managed by a third party; OpenFlux routes packets through Yandex Docs or MAX WebRTC channels, with an exit node you build and run yourself under GPL-3.0 code.

Feature	OpenFlux	Commercial VPN
License	GPL-3.0	Proprietary
Exit node	Self-hosted Linux VPS, source available	Provider-managed, no source access
Transport type	Yandex Docs, MAX WebRTC (pluggable)	WireGuard, OpenVPN, or proprietary
Client platforms	Desktop (Go), Android, iOS	Typically full platform coverage
Setup	Build from source, VPS with iptables config	Install client app and connect

OpenFlux is the better choice when you need auditable code for the full tunnel path, want to operate your own exit node on infrastructure you control, or need to add custom transport backends. The GPL-3.0 source makes every layer from SOCKS5 listener to exit-node packet forwarding readable and modifiable.

Commercial VPN services are the better choice for users who want a turnkey, zero-administration experience. OpenFlux requires root access on a Linux VPS, iptables configuration, and building from source: a substantially higher bar than installing a client app. Commercial providers also operate large server networks in many countries and offer support, which OpenFlux does not.

install · quick start

Quick start#

bash

Build from source to install the client and exit-node binary using Go 1.26.3 or later.

```bash
git clone https://github.com/p1neappleXpress/OpenFlux
cd OpenFlux
go mod tidy
go build -o universal-bypass-tool .
```

tech stack · detected from GitHub

What it's built on#

Languages: GoJavaScriptPHPSwift

frequently asked

FAQ#

What transports does OpenFlux support?

OpenFlux ships with two built-in transports: Yandex, which encodes packets as Yandex Docs cursor events, and Max, which routes packets through MAX Messenger WebRTC DataChannels. The Max transport is marked experimental. A Go interface in transport/transport.go is the extension point for adding custom transports.

Do I need a server to use OpenFlux?

Yes. The exit node, which decapsulates tunnel packets and forwards them to the internet, must run on a Linux VPS or VDS with root access. The client binary runs locally on your machine and connects to that exit node through the configured transport. No managed exit node option is provided; you operate both ends.

What does the GPL-3.0 license allow?

GPL-3.0 lets you run OpenFlux for any purpose, including internal commercial use. If you distribute a modified version publicly, you must publish those modifications under GPL-3.0. Running the tool privately on your own infrastructure does not trigger the distribution requirement.

Can I build my own transport backend for OpenFlux?

Yes. Implement the Transport interface defined in transport/transport.go, then register the new transport in main.go's switch block. The included Yandex and Max transports serve as complete reference examples. No changes to the SOCKS5 server or tunnel core are needed.

Is the Max transport safe to use?

The README describes the Max transport as experimental and warns that using it from an external VPS may result in account restrictions that persist after stopping the tool. Use a secondary or disposable MAX account if you test this transport. The blocking mechanism is not yet fully characterized.

also worth a look

Similar open-source tools#

Xray-core

Alternative toAstrill VPN

Open source proxy core with XTLS, VLESS, and REALITY protocols

42,256 GitHub stars
Licence MPL-2.0

hysteria

Alternative toAstrill VPN

Fast and censorship-resistant proxy solution

22,692 GitHub stars
Licence MIT

Pulse

InSecurity & Monitoring

Read-only Windows diagnostics with a local AI assistant.

368 GitHub stars
Licence MIT

Obtainium

InIT Management

Android app updates direct from GitHub and F-Droid

20,747 GitHub stars
Licence GPL-3.0

mvt

Alternative toiVerify

Mobile forensics toolkit for detecting spyware on Android and iOS

15,490 GitHub stars
Licence MVT License 1.1

tailcat

Alternative toTailscale

Encrypted tunnels between machines, no account or IP needed

8,432 GitHub stars
Licence BSD-3-Clause

by category

Open source tools in these categories#

471

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

OpenFlux vs Commercial VPN Services

Feature	OpenFlux	Commercial VPN
License	GPL-3.0	Proprietary
Exit node	Self-hosted Linux VPS, source available	Provider-managed, no source access
Transport type	Yandex Docs, MAX WebRTC (pluggable)	WireGuard, OpenVPN, or proprietary
Client platforms	Desktop (Go), Android, iOS	Typically full platform coverage
Setup	Build from source, VPS with iptables config	Install client app and connect

Who OpenFlux is for#

Researchers studying traffic obfuscation in Go

Skip if:

Go developers building and testing custom transport protocols

Skip if:

Security engineers auditing obfuscated tunnel designs

Skip if:

iOS and Android developers studying VPN-layer integrations

Skip if:

The problem it solves#

How it solves it#

SOCKS5 proxy interface

Yandex Docs cursor transport

MAX Messenger WebRTC transport

Pluggable transport extension point

Android APK and iOS VPN client

Strengths and trade-offs#

Strengths

Trade-offs

OpenFlux vs alternatives#

OpenFlux vs Commercial VPN Services

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Developer Tools

IT Management

Security & Monitoring

Find open source alternatives to paid software

Who OpenFlux is for#

Researchers studying traffic obfuscation in Go

Skip if:

Go developers building and testing custom transport protocols

Skip if:

Security engineers auditing obfuscated tunnel designs

Skip if:

iOS and Android developers studying VPN-layer integrations

Skip if:

The problem it solves#

How it solves it#

SOCKS5 proxy interface

Yandex Docs cursor transport

MAX Messenger WebRTC transport

Pluggable transport extension point

Android APK and iOS VPN client

Strengths and trade-offs#

Strengths

Trade-offs

OpenFlux vs alternatives#

OpenFlux vs Commercial VPN Services

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Developer Tools

IT Management

Security & Monitoring

Find open source alternatives to paid software