aether

Aether is a censorship-circumvention client written in Rust, aimed at heavily restricted networks where DPI, protocol fingerprinting, UDP throttling and endpoint blocking are common. It discovers reachable endpoints automatically, establishes an encrypted tunnel, and exposes a local SOCKS5 proxy (default 127.0.0.1:1819) for applications. Key capabilities described in the README: - Automatic endpoint discovery with end-to-end data-plane validation, so a gateway is trusted only after it actually passes traffic. - MASQUE transport over HTTP/3 (QUIC) or HTTP/2 (TLS), with optional TLS ClientHello fragmentation on HTTP/2. - WireGuard transport, plus nested modes: nested WireGuard (`gool`) and nested MASQUE (`--mim`), where an inner tunnel is dialled from inside an outer one to obtain a different exit address. - Traffic obfuscation and routing rules by domain, address or port, matched from the TLS server name so rules keep working behind a tun front end. - Upstream proxy support, so Aether can dial out through another VPN or proxy already running on the machine. - Optional Tor integration (built with the `tor` feature, using arti): Tor through the tunnel (`--tor`), the tunnel through Tor (`--tor-reverse`), or Tor alone (`--tor-only`). With `--tor`, a second proxy on 127.0.0.1:1820 exits via Tor. Where Tor is blocked, the reverse/only modes fetch bridges from bridgedb and use pluggable transports shipped in the `pt/` folder. - Automatic reconnection and quick-reconnect to the last known-good gateway. - Configuration via command-line flags, environment variables, or interactive prompts. Platforms and packaging: prebuilt binaries for Windows x86_64, macOS (Apple Silicon and Intel), Linux x86_64/arm64/armv7 (glibc and musl static builds), OpenWrt routers (aarch64, armv7l, x86_64; MIPS not supported), and Android via Termux with a one-line install script. Each archive has a matching `.sha256` file and a combined `SHA256SUMS.txt`. A Docker image is published on GHCR, with a `/data` volume recommended to persist the generated WARP identity between runs. Building from source requires Rust 1.98 or newer, a C/C++ compiler and CMake, with Cloudflare's `quiche` repository placed alongside the `aether` directory; the Cargo manifest lives at `aether/Cargo.toml`. Operational notes from the README: the SOCKS5 proxy has no authentication, so it should be bound to localhost or a LAN address and never exposed on the WAN; on OpenWrt the config should live on persistent storage such as `/etc/aether`; and when the router routes its own traffic into a tun front end, `--mark 0xff` can be used so Aether's sockets bypass the tun. The project is developed by CluvexStudio and its MASQUE support is built on Cloudflare's Quiche library.