Ombrac

Ombrac is a high-performance, Rust-based TCP tunneling solution designed for secure communication

Features

• High Performance: Leverages QUIC's multiplexing capabilities with bidirectional streams for efficient and low-latency transmission.
• Secure Communication: Encryption is ensured by the built-in TLS layer of QUIC.
• Zero-RTT Support: Optional 0-RTT or 0.5-RTT connections for faster handshakes (at the cost of slightly weakened security).

Installation

Releases

Download the latest release from the releases page.

Homebrew

brew tap ombrac/tap && brew install ombrac

Crates

cargo install ombrac-client ombrac-server

Build

cargo build --bin ombrac-client --bin ombrac-server

NOTE: On linux systems, aws-lc-rs will be used for cryptographic operations. A C compiler and CMake may be required on these systems for installation.

Docker

Pull from GitHub Container Registry

docker pull ghcr.io/ombrac/ombrac/ombrac-server:latest
docker pull ghcr.io/ombrac/ombrac/ombrac-client:latest

QuickStart

Server

ombrac-server -l "[::]:443" -k "secret" --tls-cert "./cert.pem" --tls-key "./key.pem"

Starts the Ombrac server listening on port 443, using the provided TLS certificate and key for encrypted communication.

Client

ombrac-client -s "example.com:443" -k "secret"

Will sets up a SOCKS5 server on 127.0.0.1:1080, forwarding traffic to example.com:443.

Alternatively, you can use the --tls-mode insecure option to skip TLS verification. This is not recommended for production environments as it bypasses certificate validation, potentially exposing your communication to security risks.

Run the container

docker run --name ombrac-server \
  --restart always \
  -p 2098:2098/udp \
  -dit ghcr.io/ombrac/ombrac/ombrac-server:latest \
  -l 0.0.0.0:2098 \
  -k secret \
  --tls-mode insecure

docker run --name ombrac-client \
  --restart always \
  -p 1080:1080/tcp \
  -dit ghcr.io/ombrac/ombrac/ombrac-client:latest \
  -s example.com:2098 \
  -k secret \
  --socks 0.0.0.0:1080 \
  --log-level INFO \
  --tls-mode insecure

CLI

Server

Usage: ombrac-server [OPTIONS] --secret <STR> --listen <ADDR>

Options:
  -h, --help     Print help
  -V, --version  Print version

Required:
  -k, --secret <STR>   Protocol Secret
  -l, --listen <ADDR>  The address to bind for transport

Transport:
      --tls-mode <TLS_MODE>         Set the TLS mode for the connection
                                    tls: Standard TLS. The client verifies the server's certificate
                                    m-tls: Mutual TLS with client and server certificate verification
                                    insecure: Generates a self-signed certificate on the fly with `SANs` set to `localhost` (for testing only) [default: tls] [possible values: tls, m-tls, insecure]
      --ca-cert <FILE>              Path to the Certificate Authority (CA) certificate file
                                    Used in 'mTLS' modes
      --tls-cert <FILE>             Path to the TLS certificate file
      --tls-key <FILE>              Path to the TLS private key file
      --zero-rtt                    Enable 0-RTT for faster connection establishment (may reduce security)
      --alpn-protocols <PROTOCOLS>  Application-Layer protocol negotiation (ALPN) protocols
                                    e.g. "h3,h3-29" [default: h3]
      --congestion <ALGORITHM>      Congestion control algorithm to use (e.g. bbr, cubic, newreno) [default: bbr]
      --cwnd-init <NUM>             Initial congestion window size in bytes
      --idle-timeout <TIME>         Maximum idle time (in milliseconds) before closing the connection
                                    30 second default recommended by RFC 9308 [default: 30000]
      --keep-alive <TIME>           Keep-alive interval (in milliseconds) [default: 8000]
      --max-streams <NUM>           Maximum number of bidirectional streams that can be open simultaneously [default: 1000]

Logging:
      --log-level <LEVEL>  Logging level (e.g., INFO, WARN, ERROR) [default: WARN]
      --log-dir <PATH>     Path to the log directory
      --log-prefix <STR>   Prefix for log file names (only used when log-dir is specified) [default: log]

Client

Usage: ombrac-client [OPTIONS] --secret <STR> --server <ADDR>

Options:
  -h, --help     Print help
  -V, --version  Print version

Required:
  -k, --secret <STR>   Protocol Secret
  -s, --server <ADDR>  Address of the server to connect to

Endpoint:
      --http <ADDR>   The address to bind for the HTTP/HTTPS server
      --socks <ADDR>  The address to bind for the SOCKS server [default: 127.0.0.1:1080]

Transport:
      --bind <ADDR>                 The address to bind for transport
      --server-name <STR>           Name of the server to connect (derived from `server` if not provided)
      --tls-mode <TLS_MODE>         Set the TLS mode for the connection
                                    tls: Standard TLS with server certificate verification
                                    m-tls: Mutual TLS with client and server certificate verification
                                    insecure: Skip server certificate verification (for testing only) [default: tls] [possible values: tls, m-tls, insecure]
      --ca-cert <FILE>              Path to the Certificate Authority (CA) certificate file
                                    in 'TLS' mode, if not provided, the system's default root certificates are used
      --client-cert <FILE>          Path to the client's TLS certificate for mTLS
      --client-key <FILE>           Path to the client's TLS private key for mTLS
      --zero-rtt                    Enable 0-RTT for faster connection establishment (may reduce security)
      --alpn-protocols <PROTOCOLS>  Application-Layer protocol negotiation (ALPN) protocols
                                    e.g. "h3,h3-29" [default: h3]
      --congestion <ALGORITHM>      Congestion control algorithm to use (e.g. bbr, cubic, newreno) [default: bbr]
      --cwnd-init <NUM>             Initial congestion window size in bytes
      --idle-timeout <TIME>         Maximum idle time (in milliseconds) before closing the connection
                                    30 second default recommended by RFC 9308 [default: 30000]
      --keep-alive <TIME>           Keep-alive interval (in milliseconds) [default: 8000]
      --max-streams <NUM>           Maximum number of bidirectional streams that can be open simultaneously [default: 100]
  -4, --prefer-ipv4                 Try to resolve domain name to IPv4 addresses first
  -6, --prefer-ipv6                 Try to resolve domain name to IPv6 addresses first

Logging:
      --log-level <LEVEL>  Logging level (e.g., INFO, WARN, ERROR) [default: WARN]
      --log-dir <PATH>     Path to the log directory
      --log-prefix <STR>   Prefix for log file names (only used when log-dir is specified) [default: log]

License

This project is licensed under the Apache-2.0 License.