{"id":20581847,"url":"https://github.com/blahgeek/unatatp","last_synced_at":"2025-09-07T06:35:05.385Z","repository":{"id":69381135,"uuid":"287688987","full_name":"blahgeek/unatatp","owner":"blahgeek","description":"Userspace NAT is Also a TCP (Transparent) Proxy","archived":false,"fork":false,"pushed_at":"2022-04-17T08:05:18.000Z","size":38,"stargazers_count":8,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-09-07T06:33:45.345Z","etag":null,"topics":["golang","iptables","network","proxy","tcp","vpn"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/blahgeek.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-15T06:10:56.000Z","updated_at":"2024-02-21T00:29:44.000Z","dependencies_parsed_at":null,"dependency_job_id":"67645a75-6c88-42c5-b461-da687390bb92","html_url":"https://github.com/blahgeek/unatatp","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/blahgeek/unatatp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blahgeek%2Funatatp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blahgeek%2Funatatp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blahgeek%2Funatatp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blahgeek%2Funatatp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/blahgeek","download_url":"https://codeload.github.com/blahgeek/unatatp/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blahgeek%2Funatatp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274005336,"owners_count":25205934,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-07T02:00:09.463Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","iptables","network","proxy","tcp","vpn"],"created_at":"2024-11-16T06:31:38.229Z","updated_at":"2025-09-07T06:35:05.342Z","avatar_url":"https://github.com/blahgeek.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## UNATATP\n\n**U**serspace **NAT** is **A**lso a **T**CP (**T**ransparent) **P**roxy \n\nThis is a userspace NAT for TCP that works with iptables [TPROXY](https://www.kernel.org/doc/Documentation/networking/tproxy.txt) target.\nSimply put, in your router, you configure iptables to redirect TCP traffics\nto `unatatp` and `unatatp` will make new TCP connections to the destination on its behalf\nand forward traffic between them.\n\n### Use case\n\nI use `unatatp` to transparently improve TCP performance in my VPN gateway.\n\nI use UDP-based VPN to access the Internet from China\n(because [TCP-over-TCP is a bad idea](http://sites.inka.de/bigred/devel/tcp-tcp.html)\nand I don't like application-level proxy solution since it cannot be applied globally to all traffics).\nMy VPN link is lossy so the performance (network throughput) isn't ideal.\nModern TCP congestion control algorithms like BBR can greatly improve this situation\nbut it needs to be deployed in the server endpoint.\nUsing `unatatp` in the VPN gateway, the TCP CC algorithm being used on the VPN link\nis essentially the one in the VPN gateway, which is under my own control and\ncan improve the overall performance.\n\n![network diagram](./docs/unatatp.png)\n\n### How-to\n\n*Do not copy and paste. Be caution with the network config. You may lose access to your remote machine if configured incorrectly.*\n*You should understand details about iptables and ip command to use this.*\n\nBuild and run unatatp:\n\n```\ngo build\n./unatatp -port 9999\n# Or to use systemctl:\ncp unatatp /usr/local/bin/\ncp unatatp@.service /etc/systemd/system/\nsystemctl start unatatp@9999\n```\n\nConfigure system:\n```\n# Add route table and policy so that packets can be delivered to local\nip rule add fwmark 0x100/0xf00 lookup 100\nip route add local default dev lo scope host \n\n# Redirect traffics to local port (unatatp process), trigger route recheck\niptables -t mangle -A PREROUTING -p tcp -s 192.168.0.0/24 -j TPROXY --to-ip 127.0.0.1 --to-port 9999 --tproxy-mark 0x100/0xf00\niptables -t mangle -A PREROUTING -m socket --transparent -j MARK --set-mark 0x100/0xf00\n\n# IPv6 is also supported, use ip6tables to do similar config\n```\n\n### Note\n\nThis is a NAT instead of a full transparent proxy.\nThis is the usual use case for IPv4 anyway.\nIt seems that it's impossible to do SNAT after TPROXY ([source](https://lists.balabit.hu/pipermail/tproxy/2007-August/000489.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fblahgeek%2Funatatp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fblahgeek%2Funatatp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fblahgeek%2Funatatp/lists"}