Awesome Open Source
Awesome Open Source

Reflow: One proxy to rule them all

This program let you make full use of all your proxies, VPNs, and interfaces, automatically.


  • Route ip packets to proxies

    It operates on the network layer, so you can stop worrying about proxy support in applications. You can use a socks5 proxy wherever you want. And you won't forget to use your privacy-enhanced VPNs, ever.

  • Detect protocol metadata for finer-grained control

    In addtion to ip address and port, protocol (HTTP, TLS, SSH, etc.) metadata (domain name, user-agent, etc.) are detected.

  • Prefix-match domain names and ip subnets

    Use a trie or prefix tree to sort domains and addresses into zones, because they have a natural hierarchical ownership structure

  • Use a tree diagram to configure any routing strategy

    Any decision-making process that can be expressed as a cascade of conditional statements can be used. Use all the protocol information to make intelligent routing decisions. Privacy, speed, low cost, choose any three.

  • Selectively proxy DNS queries depending on the domain name

  • Drop traffic to domains or ip address known to serve only ads and tracking

    It handles tens of thousands of domains with ease even on an OpenWrt device


After you have the nightly version of Cargo installed.

Clone the project git clone

and run cargo install, the binary will be installed in ~/.cargo/bin/reflow

You can now run it using reflow --config path, where path is the directory containing all the configuration

A good starting point for the configuration is reflow.conf

What does the Decision Tree do in a proxy?

This is where the power of reflow shows, you'll get a basic idea by looking at an example with comments:

    # when your computer wants to make a connection to the internet
    # reflow inspects the first packets, thoroughly
    # first, it checks the domain, (if the application layer protocol uses a domain)
    cond domain {
      # if it's listed as one of "secret-sites" (including sub-domains) in configuration
      # use the proxy defined as privacyproxy
      secret-sites => privacyproxy
      # block traffic to known ad servers by domain
      # "reset" is a built-in option, which means drop the connection
      adservers => reset
      # you can chain rules, the following will only match when the domain is in https-only and the protocol is http
      # otherwise, this "cond domain" section doesn't match, and rules following it will be tried
      https-only => cond protocol {
        http => reset

    # next look at ip addresses
    cond ip {
        # you can use workvpn0 to access your working environment
        worknet => workvpn0
        # "direct" is a another built-in option, meaning use the existing default route 
        homelan => direct
    # if the rules above hasn't produced a match, continue to check the protocol
    cond protocol {
      ssh => any [
        cond ip  {
        # some ssh hosts may be only accessible through a certain proxy
            mars => moon
        # another example of combing conditions: when the protocol is ssh AND the port is 22
        cond port eq 22 => proxy1
        # this will always match sucessfully for ssh traffic
    # catch-all rule for everything else

The enclosing any[ and ] means rules listed inside it will be tried one by one


Example configuration and documentation is provided at reflow.conf


Please try it and give any kind of feedback by opening issues


Here're some features being developed or considered:

  • Built-in tun support, add UDP support
  • Support more protocols
  • Chaining proxies
  • Add Dns over https or tls support
  • Add Dns cache

Make a Donation

BTC: bc1q8cxs2e3wf525f958zgxzq4skl94nfzwuuq97qz

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
rust (3,547
proxy (452
vpn (207
protocol (160
socks5 (63
socks (44
tap (36

Find Open Source By Browsing 7,000 Topics Across 59 Categories