RawLink: Open-Source Encrypted TCP Tunnel in Rust Adds SSH Traffic Mimicry

An encrypted tunnel built from scratch

A new open-source project called RawLink reached Hacker News's front page on 20 October 2026, offering an encrypted TCP tunnel written from the ground up in Rust. According to the project's GitHub repository, its developer, who publishes under the name zolagonano, presents it as an encrypted transport with SSH disguise built in — a from-scratch take on the kind of secure tunnelling that VPN software usually provides.

RawLink does not behave like a conventional device-level VPN that captures all of a machine's traffic. Instead, the client runs a local SOCKS5 proxy. Applications connect to that proxy, RawLink encrypts the traffic and pushes it through a tunnel to a remote server, and the server decrypts it and forwards each request to its real destination. Several connections can share one tunnel, the software handles multiple tunnels at once, and it reconnects automatically when a tunnel drops.

The wire protocol

Data is encrypted with AES-256-GCM, and the repository notes that other cipher schemes could be supported in future. Every packet carries a session identifier and a packet number, and over TCP each packet is prefixed with its length so the receiving side can locate packet boundaries.

The packet design is where the project gets interesting. A 17-byte header — a version field, a key indicator, some reserved bits, the session ID and the packet number — serves as additional authenticated data for the AES-GCM computation, while the body is encrypted and carries a 16-byte authentication tag. The header itself cannot be encrypted, because the receiver must read the session ID before it knows which key to use for decryption. To stop that metadata leaking onto the wire, every header is XOR-masked with an XChaCha20 keystream before transmission. The upshot, according to the repository, is that a full packet should look like uniform random bytes to anyone who lacks the pre-shared key. Connections are authenticated with that key, supplied to both ends as 64 hexadecimal characters.

Obfuscation options

A separate, optional obfuscation layer sits on top of the core protocol and offers two modes. The first, called rand, makes traffic resemble random noise: it disguises headers, inserts arbitrary padding and can push out filler traffic when the link is idle. The second, ssh, goes further and dresses the connection up as an ordinary SSH session, including a faked initial handshake and a configurable banner string such as an OpenSSH version, before switching over to the encrypted tunnel. Client and server must be configured with the same mode for a tunnel to come up.

Running it is deliberately simple. A server is started with a listen address and the pre-shared key; the client points at that server and exposes a local SOCKS5 port; applications then route through it, for example by pointing curl at a socks5h proxy on localhost.

Caveats before routing anything sensitive

The developer is unusually direct about the project's maturity. The README states that the implementation was produced with the help of AI and then reviewed, but that it still lacks a rigorous security audit, and warns users to apply appropriate safeguards and proceed at their own risk for sensitive work. The project is under development, its resistance to network censorship has not been verified, and the protocol specification and documentation remain works in progress. A blog post by the developer explains the design, the code is dual-licensed under MIT and Apache-2.0, and issues and pull requests are invited.

Why it matters

Most users reach for WireGuard, OpenVPN or a commercial service, and those tools are battle-tested in a way a brand-new protocol is not. But small, readable protocol implementations serve a different purpose: one person can audit them, they document design trade-offs in the open, and they act as a testbed for anti-censorship techniques that larger projects adopt slowly. RawLink's choices — authenticated headers masked into apparent randomness, optional SSH mimicry and idle-time cover traffic — target environments where the shape of a connection alone can get it blocked, which keeps the project relevant to censorship research even if it never becomes anyone's daily driver. The explicit warnings about the missing audit are the right call, and anyone considering it for serious use should treat it as an interesting experiment rather than production infrastructure.