Who OpenFlux is for#
Researchers studying traffic obfuscation in Go
OpenFlux provides a working, readable Go implementation of pluggable transports that hide TCP inside application-layer messaging protocols. The Transport interface is the documented extension point for testing new backends against the existing SOCKS5 and exit-node infrastructure.
Skip if:
If your research requires high-throughput or low-latency benchmarks, OpenFlux's dependence on Yandex Docs or MAX Messenger infrastructure adds variable latency you cannot control.
Go developers building and testing custom transport protocols
The Transport interface and the two included transport backends serve as a complete reference for adding new obfuscation channels. Implementing the interface and registering it in main.go's switch block connects the new backend to the existing SOCKS5 server and exit-node pipeline.
Skip if:
If you need a maintained transport framework with a plugin ecosystem and community-tested implementations, established obfuscation libraries are more mature than building on top of a research tool.
Security engineers auditing obfuscated tunnel designs
OpenFlux demonstrates how TCP traffic can be embedded inside collaboration protocols that are typically allowlisted on corporate or regional networks. Both included transports are documented in the README with setup instructions, making the architecture legible for audit and evaluation.
Skip if:
If you need a production-audited tool for end-user deployment, OpenFlux is positioned as a research implementation with no warranties; a purpose-built audited tool is more appropriate.
iOS and Android developers studying VPN-layer integrations
The iOS client shows how to connect a Go tunnel backend to iOS Network Extension for system-wide VPN coverage. The Android binary integrates via NDK. Both are open source and serve as reference implementations for mobile integration with a Go-based pluggable transport backend.
Skip if:
If you need an App Store or Play Store distribution for end users, the iOS client is on TestFlight only and the Android APK requires sideloading; neither has a public app store listing.
The problem it solves#
Network operators that apply deep packet inspection can identify and block conventional VPN handshakes, proxy protocols, and common tunnel signatures without ever checking the traffic destination. The more a tool's traffic pattern resembles a known bypass protocol, the faster it gets blocked, leaving users on restricted networks without a working outbound path.
Experimenting with alternative transport layers is also technically expensive. Most available open source tunneling tools expose a fixed protocol with no extension point, so researchers who want to test a new obfuscation channel must fork and refactor the tunnel core before they can run a single experiment.
How it solves it#
SOCKS5 proxy interface
The client binary starts a SOCKS5 listener at :1080 by default, accepting connections from any browser or application configured to use a local proxy. Traffic is packaged into the configured transport and sent to the exit node for decapsulation. The --socks5 flag changes the listen address if needed.
Yandex Docs cursor transport
TCP packets are encoded as Yandex Docs cursor messages and transmitted through Yandex's document collaboration channel. This makes tunnel traffic appear as document-editing activity to network inspection systems. The exit node requires a Yandex document URL passed via --url, and the legacy Yandex Docs editor must be enabled in the Yandex interface.
MAX Messenger WebRTC transport
Routes packets through MAX Messenger WebRTC DataChannels using a valid MAX account. Marked experimental in the README due to unknown blocking behavior; using it from an external VPS may lead to account restrictions that persist after the tool stops. Auth token and user ID are passed via --maxToken and --maxUid flags.
Pluggable transport extension point
The Transport interface in transport/transport.go defines the contract for adding new backends. Adding a custom transport requires implementing that interface and registering it in the switch block in main.go. The Yandex and MAX transports serve as working reference examples. No changes to the SOCKS5 server or tunnel core are needed.
Android APK and iOS VPN client
A standalone Android APK is maintained at the OpenFluxAndroid repository. An iOS client built by a contributor runs as a system-wide VPN using iOS Network Extension, supports DNS-over-TLS, and is distributed via TestFlight. Both are open source and represent fully functional client-side integrations with the Go tunnel backend.
Strengths and trade-offs#
Strengths
- GPL-3.0 with full source visibilityThe complete Go codebase, including both transport backends, the SOCKS5 server, and the userspace TCP stack integration, is available under GPL-3.0. Researchers and engineers can trace every packet path from SOCKS5 listener to exit-node forwarding. Modifications are permitted; distributing a modified version requires publishing changes under the same license.
- Transport interface designed for extensionAdding a new backend requires implementing one Go interface in transport/transport.go and one switch-case entry in main.go. The tunnel core and SOCKS5 server need no changes. This makes OpenFlux a practical testbed for experimenting with new traffic obfuscation channels without rewriting the surrounding infrastructure.
- Community-built mobile clientsAn Android APK and an iOS client with system-wide VPN support via iOS Network Extension are available. The iOS build includes DNS-over-TLS. Few Go tunneling projects include production-quality mobile clients; these extend OpenFlux beyond desktop-only use to full device coverage on two major mobile operating systems.
- Active development since June 2026 launchThe repository was created in June 2026 and recorded over 1,100 GitHub stars in roughly three months. The last commit was in September 2026, matching the current month. 28 open issues indicate active community engagement rather than an abandoned release.
Trade-offs
- -MAX transport carries account restriction riskThe README explicitly warns that using the MAX transport from an external VPS may cause MAX account restrictions that persist after the tool stops, and that the blocking mechanism is not yet understood. The README advises against using a primary account. Treat this transport as a research path, not a production option for accounts where access loss would be a problem.
- -Exit node requires root access and iptables rulesRunning the exit node requires root access on a Linux VPS and configuring iptables RST suppression on the outbound RST flag. The README documents a scoped approach using a dedicated IP alias to limit the rule's blast radius, but this is not a zero-configuration deployment. Users unfamiliar with Linux network administration will need to follow the documentation carefully.
- -No prebuilt binaries or container imagesThe README and repository provide no prebuilt release binaries or Docker image. Both the client and exit-node must be built from source with Go 1.26.3 or later. Building mobile clients requires additional toolchains: Android NDK v27.0.12077973 or later for Android, XCode 26.6 or later for iOS.
- -Yandex transport requires legacy Yandex Docs editorThe Yandex transport only works with Yandex's legacy document editor, which must be manually enabled from the Yandex Docs interface. If Yandex discontinues the legacy editor mode, this transport path breaks. This is an upstream dependency outside the project's control.
OpenFlux vs alternatives#
OpenFlux vs Commercial VPN Services
OpenFlux and commercial VPN services both route outbound traffic through an intermediary to the internet, but they differ in transparency, control, and target user. A commercial VPN runs proprietary server software managed by a third party; OpenFlux routes packets through Yandex Docs or MAX WebRTC channels, with an exit node you build and run yourself under GPL-3.0 code.
| Feature | OpenFlux | Commercial VPN |
|---|---|---|
| License | GPL-3.0 | Proprietary |
| Exit node | Self-hosted Linux VPS, source available | Provider-managed, no source access |
| Transport type | Yandex Docs, MAX WebRTC (pluggable) | WireGuard, OpenVPN, or proprietary |
| Client platforms | Desktop (Go), Android, iOS | Typically full platform coverage |
| Setup | Build from source, VPS with iptables config | Install client app and connect |
OpenFlux is the better choice when you need auditable code for the full tunnel path, want to operate your own exit node on infrastructure you control, or need to add custom transport backends. The GPL-3.0 source makes every layer from SOCKS5 listener to exit-node packet forwarding readable and modifiable.
Commercial VPN services are the better choice for users who want a turnkey, zero-administration experience. OpenFlux requires root access on a Linux VPS, iptables configuration, and building from source: a substantially higher bar than installing a client app. Commercial providers also operate large server networks in many countries and offer support, which OpenFlux does not.
Quick start#
Build from source to install the client and exit-node binary using Go 1.26.3 or later.
```bash
git clone https://github.com/p1neappleXpress/OpenFlux
cd OpenFlux
go mod tidy
go build -o universal-bypass-tool .
```What it's built on#
- Languages
- GoSwift
FAQ#
What transports does OpenFlux support?
OpenFlux ships with two built-in transports: Yandex, which encodes packets as Yandex Docs cursor events, and Max, which routes packets through MAX Messenger WebRTC DataChannels. The Max transport is marked experimental. A Go interface in transport/transport.go is the extension point for adding custom transports.
Do I need a server to use OpenFlux?
Yes. The exit node, which decapsulates tunnel packets and forwards them to the internet, must run on a Linux VPS or VDS with root access. The client binary runs locally on your machine and connects to that exit node through the configured transport. No managed exit node option is provided; you operate both ends.
What does the GPL-3.0 license allow?
GPL-3.0 lets you run OpenFlux for any purpose, including internal commercial use. If you distribute a modified version publicly, you must publish those modifications under GPL-3.0. Running the tool privately on your own infrastructure does not trigger the distribution requirement.
Can I build my own transport backend for OpenFlux?
Yes. Implement the Transport interface defined in transport/transport.go, then register the new transport in main.go's switch block. The included Yandex and Max transports serve as complete reference examples. No changes to the SOCKS5 server or tunnel core are needed.
Is the Max transport safe to use?
The README describes the Max transport as experimental and warns that using it from an external VPS may result in account restrictions that persist after stopping the tool. Use a secondary or disposable MAX account if you test this transport. The blocking mechanism is not yet fully characterized.
Similar open-source tools#
tailcat
Encrypted tunnels between machines, no account or IP needed
airstats
Sixteen macOS metrics in your menu bar at 0.046% CPU
hysteria
Fast and censorship-resistant proxy solution
Tor Browser
Secure browsing through the Tor network with anti-fingerprinting
Sonarr
Smart PVR for Usenet and BitTorrent TV fans
iloader
Free open-source iOS sideloader for Windows, Mac, and Linux