burrow

Turn any SSH server into a universal local proxy — one local port speaking SOCKS5 + HTTP/HTTPS (auto-detected), tunnelled over a single SSH session. Optionally flip on a system-wide VPN (TUN) to route everything through it.

Built for people who just want ssh as their proxy/VPN, without ssh -D, tun2socks, or routing tables. Linux-first; Windows is a secondary target; macOS ships the proxy CLI.

GPL-3.0-or-later.

Install

Arch (AUR) — CLI + desktop app + VPN helper:

yay -S burrow-tunnel-bin    # prebuilt binaries (fast)
yay -S burrow-tunnel        # or build from source

macOS (Homebrew) — prebuilt proxy CLI (the system-wide VPN is Linux/Windows):

brew install 0443n/tap/burrow-tunnel

Debian/Ubuntu, Fedora, Windows — grab a package from the latest release: a .deb/.rpm (CLI in burrow-cli, desktop app in burrow) or the Windows all-in-one installer.

Run

# CLI — manage profiles (the password/passphrase is prompted, stored in the keyring)
burrow profile add work --host example.com --user alice              # password auth (default)
burrow profile add box  --host 10.0.0.5 --user root \
    --auth key --key ~/.ssh/id_ed25519                              # key auth
burrow profile list                  # list saved profiles
burrow test work                     # verify auth + host key, then exit

# CLI — run the proxy in the foreground (Ctrl-C to stop)
burrow up work                       # SOCKS5 + HTTP on 127.0.0.1:1080
burrow up work --vpn                 # + route ALL system traffic (Linux/Windows; prompts for auth)
burrow profile rm work               # delete a profile and its secrets

# Desktop app (Linux/Windows) — tray, start-on-login, notifications, restores your last session
cargo run -p burrow-ui               # or launch "burrow" from your app menu
burrow-ui --minimized                # start hidden to the tray (used by "Start on login")

Point anything at it (socks5h keeps DNS on the server, no leak):

curl -x socks5h://127.0.0.1:1080 https://ifconfig.me

The system-wide VPN is Linux + Windows only. On macOS, use the proxy and point apps at socks5h://127.0.0.1:1080.

Build from source

Needs stable Rust and, for the default russh backend (aws-lc-rs), cmake + a C/C++ compiler.

cargo build --release      # -> target/release/{burrow, burrow-ui, burrow-helper}

• burrow — CLI
• burrow-ui — desktop app (Slint window + tray)
• burrow-helper — privileged VPN helper (the GUI/CLI find it as a sibling, or via $BURROW_HELPER)

Dev notes

• Release builds are slow (several minutes). The release profile is tuned for tiny single binaries — fat lto, codegen-units = 1, opt-level = "z" (see Cargo.toml) — and russh's default crypto backend (aws-lc-rs) compiles C/assembly via cmake. For day-to-day work use a debug build (cargo build / cargo run); reserve --release for packaging.
• Smoke-test the proxy with no SSH server: cargo run -p burrow-core --example direct_proxy -- 127.0.0.1:1080
• cargo test covers the core parsing/config/dialer logic.