CipherRelay（密流）

A self-hosted encrypted proxy: a Rust server, a local HTTP/HTTPS/SOCKS5 client and a Flutter app for Windows, macOS, Linux, Android and iOS. The repository and binaries keep their proxy-everything names; protocols and application identifiers stay compatible.

App ─► local client (HTTP · SOCKS5 · TUN) ══ encrypted, over TCP or QUIC ══► server ─► Internet
                                                                               └─► relay ─► …

Features

• Encrypted native sessions: TCP, UDP and ICMP payloads are always encrypted (AES-256-GCM), node probes included.
• Wire protocols: legacy, the default, works with every deployed node; v3 needs no extra round trip.
• Carriers: TCP by default, or TLS 1.3 QUIC per node. A switch affects new sessions only. QUIC pools isolate connections that stop acknowledging traffic so new sessions can reconnect, without replaying existing requests (recovery behavior).
• Local proxy: HTTP, HTTPS CONNECT and SOCKS5, including UDP ASSOCIATE, on one port. Optionally sets the system proxy.
• TUN capture: whole-device capture with process bypass and loop prevention on desktop; the platform VPN API on mobile. Windows process-bypassed UDP preserves source mappings across STUN/P2P targets when ownership is unambiguous (details).
• Routing: geo-based direct or proxy decisions, a reverse mode and keyword lists.
• Control plane: nodes, groups, relay chains with load balancing, metrics and a managed SOCKS5 endpoint that rejects mainland China source IPs (Hong Kong, Macao and Taiwan remain eligible).
• App proxies: send single apps through the proxy without TUN (macOS and Windows).

Quick start

Server

docker run -d --name proxy-server --restart=always -p 1081:1081 \
  -e SECRET_KEY=your-32-char-secret-key \
  ackingliu/http2-server:latest

Open TCP 1081 in the firewall and use a private 32-byte SECRET_KEY. The one-line systemd installer, multiple instances and every variable are in server deployment and systemd. QUIC needs an additional UDP listener and a certificate: QUIC carrier.

App

Install CipherRelay from the app releases, add the server as a node, and connect. Per-platform notes are in client usage.

CLI

Download http-proxy-cli from the releases:

./http-proxy-cli -s YOUR_SERVER -c 7890 --set-system-proxy   # TCP
./http-proxy-cli -s quic://YOUR_SERVER:10811 -c 7890         # QUIC
./http-proxy-cli -s YOUR_SERVER -c 7890 --tun                # capture all traffic (administrator)

Without --set-system-proxy, point applications at 127.0.0.1:7890 (HTTP or SOCKS5). Options, TOML configuration, SOCKS5 UDP and TUN are covered in client usage.

Transport choices

Setting	Default	Alternative	Before switching
Wire protocol	legacy	v3: PROXY_WIRE_PROTOCOL=v3 or the app toggle	Upgrade every relay and server; PROXY_REQUIRE_V3=1 then rejects legacy (v3)
Carrier	TCP: a bare host	QUIC: quic://host:port	Deploy a QUIC listener with a certificate (QUIC)

The two combine freely, and neither changes what a session carries. Compatibility and recovery behaviour: network resilience.

Management

Tool	Purpose
proxy-tui	Terminal monitor and runtime configuration of nodes, groups, relay and metrics
http-proxy-admin	Scriptable control CLI with JSON output, including managed SOCKS5

proxy-tui -H 127.0.0.1 -p 1081 -k SESSION_KEY --token ADMIN_TOKEN
http-proxy-admin -H 127.0.0.1 -p 1081 -k SESSION_KEY ping

In the TUI, the Nodes tab takes host:port, while the Relay tab needs a typed target such as node host:port, group_ref asia or a full proxy URL. See TUI and admin CLI, dynamic relay and managed SOCKS5.

Documentation

• Use and deploy: client usage · server (Docker) · systemd · QUIC carrier · managed SOCKS5 · dynamic relay · metrics and management · Android VPN · iOS · Mac App Store edition
• Protocols and design: v3 wire protocol · network resilience · TUN ICMP echo · node probe batching · Rust UI runtime · galaxy geometry
• Operations and records: releasing · admin test script · QUIC validation · node sync incident · memory investigation

Development

cargo build --workspace
cargo test --workspace

On Windows (MSVC toolchain, VS 2022 Build Tools with C++, CMake, FVM):

.\scripts\windows\build.ps1 -Configuration Debug   # Rust, FFI DLL and the Flutter app
.\scripts\windows\run-ui.ps1                       # app with hot reload

The Flutter app lives in the ui/flutter submodule and runs only through FVM. proxy-core owns the single mimalloc build (deps/better_mimalloc_rs) used by every binary and the FFI library. Layout, checks, compatibility rules and packaging are in AGENTS.md; release steps are in releasing.

Editions and naming

Every platform shows CipherRelay (CipherRelay.exe, CipherRelay, CipherRelay.app). Bundle and package IDs, storage, protocols and Windows single-instance keys are unchanged from Proxy UI, so upgrades keep their settings. macOS has two editions: the direct download (a Developer ID DMG with system proxy, TUN helper, LAN access and process bypass) and a sandboxed Mac App Store edition with a Packet Tunnel and separate settings (Mac App Store). For release file names, see client packaging.