Asynchronous Rust Proxy AGPL-3.0+ / Commercial • Tokio Engine

Alighieri: Asynchronous SOCKS5 Proxy Server

A lightweight, intuitive, and efficient asynchronous SOCKS5 proxy server written in Rust on the Tokio runtime. Features explicit deny-by-default access control, Argon2id authentication, a Dante-inspired rule language, automatic Let's Encrypt TLS, and native Windows Service, Linux systemd, and macOS launchd operation.

Download Alighieri → View on GitHub ← All Tools & Ecosystem
Language / Runtime: Rust • Tokio Async I/O
Standards: RFC 1928 / RFC 1929 (TCP CONNECT • UDP ASSOCIATE)
Config Syntax: Dante-Inspired Rule Blocks
Deployment: Windows Service • Linux systemd • macOS launchd • CLI
Core Engineering

High-Performance Asynchronous Architecture

Alighieri uses Rust and Tokio to manage TCP streams and UDP associations with asynchronous I/O. Configurable connection, authentication, and bandwidth limits control resource use; blocking work such as operating-system DNS resolution runs on dedicated blocking workers.

PROTOCOL PIPELINE

Asynchronous SOCKS5 Transport & Policy Pipeline

Rust • Tokio Async • RFC 1928 / 1929 • ACME TLS
Alighieri Asynchronous SOCKS5 Transport & Policy Pipeline Diagram showing client connections entering the Tokio async event loop, authenticated with Argon2id and ACME TLS, evaluated by Dante-inspired ACL rules, and dispatched to target TCP and UDP destinations. CLIENT INGRESS Client Endpoints TCP & UDP Ingress SOCKS5 Clients Standard RFC 1928 apps SOCKS5-over-TLS Encrypted channel ingress ProxiFyre / Web / SSH Local and remote callers ASYNC RUNTIME Tokio Event Engine Event-driven non-blocking I/O Auto ACME TLS TLS-ALPN-01 certificates Argon2id Auth RFC 1929 hash verification Rate & Flow Control Token-bucket policing POLICY & ACCESS CONTROL ACL Rule Engine Deny-by-default evaluation client pass / block Ingress interface & IP rules socks pass / block Target IP, port & method filter Session Audit Log Structured events & metrics UPSTREAM RELAY Destinations Async stream relay TCP Streams Web, APIs, RDP, SSH UDP ASSOCIATE DNS, VoIP, gaming IPv4 & IPv6 Native dual stack
Asynchronous SOCKS5 Pipeline: Alighieri executes on the Tokio asynchronous runtime to manage non-blocking TCP streams and UDP associations. Inbound connections undergo optional TLS termination and Argon2id authentication before being verified against Dante-inspired deny-by-default access control lists, ensuring secure and high-throughput proxy routing.

Asynchronous Non-Blocking I/O

Uses Tokio tasks for asynchronous TCP and UDP relaying. The repository includes reproducible throughput, handshake, and UDP benchmarks; results depend on workload, configuration, and host resources.

Dante-Inspired Rule Language

Adopts an intuitive, line-oriented configuration structure inspired by Dante (client pass/block and socks pass/block), providing explicit, deny-by-default access control without legacy bloat.

Authentication & Security

Supports anonymous mode and RFC 1929 username/password authentication backed by Argon2id password hashing. Includes token-bucket bandwidth policing and connection rate limiting.

Automated Let's Encrypt TLS

Supports a TLS listener with automated ACME certificate issuance and renewal via TLS-ALPN-01. TLS protects authentication, SOCKS5 control, and TCP CONNECT traffic. UDP relay datagrams use separate sockets outside the TLS stream.

Windows, Linux & macOS Native

First-class support on Windows (console process, native Windows Service with Windows Event Log integration), Linux (systemd unit, journald logging, and container images), and macOS (console binary, Homebrew tap, and launchd service templates).

ProxiFyre Companion & RDP Egress

Functions as the ideal server companion to ProxiFyre. Features optional Windows RDP egress to multiplex TCP streams through existing Remote Desktop sessions without opening remote ports.

Getting Started

Quick Installation & Configuration

Install Alighieri via Homebrew on macOS, Cargo from crates.io, run pre-built binaries, or use the interactive local configuration wizard:

macOS / Linux / Windows Quick Start

# Install on macOS via official Homebrew tap

brew install wiresock/tap/alighieri


# Or install from crates.io using Rust toolchain

cargo install alighieri --locked


# Launch the local configuration wizard in your browser

alighieri config wizard --output alighieri.conf


# Validate configuration file without starting server

alighieri --check --json alighieri.conf


# Start proxy server on default port 1080

alighieri alighieri.conf


# Verify connectivity through SOCKS5 listener

curl --socks5-hostname 127.0.0.1:1080 https://example.com

View Alighieri on GitHub →