Repolode
Submit
daeuniverse

daeuniverse/honk

An experimental Linux transparent-proxy engine in Rust that follows dae's eBPF design and dae config syntax, with sing-box-style outbound groups.

View on GitHub
Stars
1,547
Forks
133
Open issues
29
Last commit
11 hours ago

What is it?

honk is a transparent proxy engine for Linux. It captures TCP and UDP traffic from LAN-forwarded and host-originated sources through TC eBPF, routes it with compiled rules, and forwards it through a range of outbound protocols. Its datapath and configuration syntax follow dae, while its outbound groups and Clash-compatible API draw on sing-box.

Supported outbounds include SOCKS5, Shadowsocks/2022, Trojan, AnyTLS, Hysteria2, TUIC, Juicity, VMess, VLESS, direct and block. Outbound groups cover Selector, URLTest, LoadBalance, Fallback and Score. DNS upstreams can use UDP, TCP, DoT, DoH, DoQ or DoH3, optionally routed through a node or group.

The project is an early alpha and is not recommended for production. It runs only on Linux 6.12+ with root privileges and requires eBPF support; there is no FakeIP engine and no Windows or macOS datapath.

Key features

  • 01Transparent TCP/UDP interception through TC eBPF on Linux.
  • 02Multiple outbound protocols, including Trojan, VLESS, VMess, Hysteria2 and TUIC.
  • 03Selector, URLTest, LoadBalance, Fallback and Score outbound groups.
  • 04Encrypted DNS upstreams (DoT, DoH, DoQ, DoH3) with routing and caching.
  • 05Subscriptions, configuration reload and a Clash-compatible REST/WebSocket API.
  • 06A honk-tool CLI for operations.

Use cases

  • Running a transparent proxy gateway on a Linux router or OpenWrt-class device.
  • Routing LAN traffic through different outbound nodes by rule.
  • Experimenting with eBPF-based traffic interception and proxy protocols.
  • Driving a Clash dashboard or the doona web UI to manage nodes.

Quick start

  1. 1

    Download an archive for your platform from the Releases page

  2. 2

    Follow the startup guide for kernel checks, installation and connectivity verification

Things to know

  • Early alpha and not recommended for production; expect breaking changes.
  • Linux only, requiring root, Linux 6.12+ and specific kernel options; no Windows or macOS datapath.
  • Transparent proxying changes network hooks and sysctls, so keep an out-of-band management path available.
  • Licensed under GPL-3.0-only, a copyleft license.

Topics

#transparent-proxy#ebpf#rust#linux#proxy#dns#networking

FAQ

What is honk?
An experimental Linux transparent-proxy engine in Rust that follows dae's eBPF design and dae config syntax, with sing-box-style outbound groups. honk is a transparent proxy engine for Linux. It captures TCP and UDP traffic from LAN-forwarded and host-originated sources through TC eBPF, routes it with compiled rules, and forwards it through a range of outbound protocols. Its datapath and configuration syntax follow dae, while its outbound groups and Clash-compatible API draw on sing-box.
Is honk free to use? What license does it have?
honk is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is honk still maintained?
Actively maintained. The last commit to honk was on Nov 6, 2026.
What can I use honk for?
Running a transparent proxy gateway on a Linux router or OpenWrt-class device. Routing LAN traffic through different outbound nodes by rule. Experimenting with eBPF-based traffic interception and proxy protocols. Driving a Clash dashboard or the doona web UI to manage nodes.
How do I install honk?
Download an archive for your platform from the Releases page Follow the startup guide for kernel checks, installation and connectivity verification
Where can I get honk?
The source code and installation instructions are on GitHub: https://github.com/daeuniverse/honk

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects