darkflare: Tunnel TCP Traffic Through a CDN

Overview

DarkFlare forwards TCP traffic through HTTP(S) requests to a server behind a CDN such as Cloudflare. Its client can expose a local port or connect through standard input and output, while its server forwards traffic to a chosen TCP destination.

It may suit people who need to reach services such as SSH across networks that permit HTTPS but restrict other connections. The tunnel provides traffic obfuscation, not end-to-end confidentiality, so sensitive sessions should use their own encryption.

Key Features

• Client and server components for TCP-over-CDN tunneling.
• Client-side destination selection, with an option for the server to override it.
• Local-port forwarding and stdin/stdout mode for SSH ProxyCommand integration.
• Optional outbound SOCKS5, HTTP, or HTTPS proxy support.
• HTTP and HTTPS server modes, with configurable TLS certificate files.
• Server-side destination validation and optional Cloudflare-only access.
• Debug logging and a silent server mode.

Use Cases

• Connect to an SSH host when a network blocks direct SSH but allows HTTPS.
• Carry other TCP-based services across restrictive networks, when authorized by the network owner.
• Integrate a tunnel into SSH workflows without binding a local port, using stdin/stdout mode.
• Route the client's outbound connection through an existing SOCKS5 or HTTP proxy.

Getting Started

Download the client and server binaries from the GitHub Releases page. For example, run a client forwarding local port 2222 to an SSH service through a CDN endpoint:

./darkflare-client -l 2222 -t https://cdn.example.com:443 -d <ssh-host>:22

See the README for server setup, TLS configuration, and other options.

Alternatives

• wiredoor: Wiredoor routes private services over WireGuard through a self-hosted ingress, rather than carrying TCP connections inside CDN-routed HTTP(S) requests.
• tunn: tunn manages SSH port forwards from YAML configuration, while DarkFlare tunnels TCP over CDN-routed HTTP(S) requests.
• tailscale: Tailscale connects devices through a WireGuard-based private network, rather than tunneling TCP through HTTP(S) requests routed via a CDN.

Considerations

• The README explicitly cautions that the tunnel provides obscurity, not security. Use end-to-end encryption for sensitive traffic.
• A working deployment requires a reachable server and appropriate CDN hostname and origin configuration. HTTPS server mode needs TLS certificates.
• The README documents potential SSH host-key and certificate issues when launching sshd, and notes that pppd may require root privileges or additional sudo configuration.
• Use only where you have authorization. The README frames the tool as educational and warns against bypassing an employer's firewall without permission.