sshuttle-rs

中文说明

A Rust-based sshuttle-style transparent proxy orchestrator. It turns an upstream SOCKS/HTTP proxy into system-wide traffic steering, with native backends for Linux and Windows.

• Upstream proxy types: socks5, socks4, http (CONNECT)
• Linux transparent backend: iptables/ip6tables and nft selector
• Linux bypass controls: --bypass-uid, --bypass-gid
• Windows modes:
  • system-proxy (WinINET registry)
  • transparent (built-in native WinDivert dataplane, with external engine fallback)
• DNS capture: optional (--dns-capture), SOCKS5 UDP path supported
• Operations helpers: doctor, cleanup
• Policy engine: JSON/YAML (--policy-file) + explain + doctor --bypass-check-process

sshuttle-rs is usable as a preview/early release. The core paths are implemented and CI-covered, but long-running production validation is still ongoing.

cargo run -- run --mode transparent --proxy 127.0.0.1:1080 --proxy-type socks5 --listen 127.0.0.1:18080

UDP capture (non-DNS) example on Linux:

sudo cargo run -- run \
  --mode transparent \
  --proxy 127.0.0.1:1080 \
  --proxy-type socks5 \
  --udp-capture \
  --udp-listen 127.0.0.1:19090 \
  --udp-port 443 \
  --udp-port 3478

Linux (kernel-level owner match):

sudo cargo run -- run \
  --mode transparent \
  --proxy 127.0.0.1:1080 \
  --proxy-type socks5 \
  --bypass-uid 1001 \
  --bypass-gid 1001

Windows (transparent mode; passed to worker/native backend):

cargo run -- run `
  --mode transparent `
  --platform windows `
  --proxy 127.0.0.1:1080 `
  --proxy-type socks5 `
  --bypass-process "program-a.exe" `
  --bypass-process "program-b.exe"

Policy file (recommended for precise matching):

cargo run -- run `
  --mode transparent `
  --platform windows `
  --proxy 127.0.0.1:1080 `
  --proxy-type socks5 `
  --policy-file .\\examples\\policy.sample.yaml

Windows native dataplane dependency (required):

• place WinDivert.dll and matching WinDivert*.sys beside sshuttle-rs.exe
• or set build/runtime env to driver bundle path via WINDIVERT_PATH
• run in elevated shell (Administrator)
• Official release zip already bundles WinDivert runtime for x86_64 and i686 Windows targets.

You can use either json or yaml; see:

• examples/policy.sample.yaml
• examples/policy.sample.json

Dry-run:

cargo run -- run --mode transparent --proxy 127.0.0.1:1080 --proxy-type socks5 --dry-run

Doctor:

cargo run -- doctor --mode transparent --platform auto --linux-backend auto --dns-capture

Doctor bypass-check with policy:

cargo run -- doctor `
  --platform windows `
  --policy-file .\\examples\\policy.sample.yaml `
  --bypass-check-process "sslocal.exe" `
  --bypass-check-dst 8.8.8.8:443 `
  --bypass-check-proto tcp `
  --policy-strict

Explain one flow:

cargo run -- explain `
  --policy-file .\\examples\\policy.sample.yaml `
  --process-name "sslocal.exe" `
  --dst 8.8.8.8:443 `
  --proto tcp

Cleanup:

cargo run -- cleanup --mode transparent --platform auto --listen 127.0.0.1:18080

CI runs:

• cargo check
• cargo test
• cargo clippy -D warnings

Release is tag-driven (v*) with multi-arch artifacts.

Build matrix:

• Linux AMD64: x86_64-unknown-linux-gnu
• Linux ARM64: aarch64-unknown-linux-gnu
• Linux ARM32: armv7-unknown-linux-gnueabihf
• Linux RISC-V64 (best-effort): riscv64gc-unknown-linux-gnu
• macOS Apple Silicon (M-series): aarch64-apple-darwin
• Windows AMD64: x86_64-pc-windows-msvc
• Windows ARM64: aarch64-pc-windows-msvc
• Windows 32-bit x86: i686-pc-windows-msvc

Native packaging note:

• Windows release artifact must include:
  • sshuttle-rs.exe
  • WinDivert.dll
  • WinDivert64.sys (and architecture variants when applicable)
• aarch64-pc-windows-msvc artifact includes a note file only for WinDivert runtime because official WinDivert arm64 package is unavailable.

• Architecture (English)
• 架构说明（中文）
• Policy Spec (English)
• Policy 规范（中文）
• Windows Native Dataplane (English)
• Windows 原生数据面说明（中文）
• Linux Backend (English)
• Linux 后端说明（中文）
• Troubleshooting (English)
• 故障排查（中文）