Show HN: RawLink – Building a VPN protocol from scratch

RawLink is a Rust implementation of a fast, encrypted TCP tunnel that takes local SOCKS5 traffic, encrypts it, and forwards it through one or more reusable tunnels to a remote server. Connections use a pre-shared key for authentication and AES-256-GCM for payload encryption; a single tunnel can multiplex many streams, automatically reconnects on failure, and supports multiple tunnels. Packets carry a 17-byte header used as additional authenticated data (version, flags, an 8-byte session ID, and an 8-byte packet number) followed by an AES-256-GCM-encrypted body and 16-byte tag. Because the receiver needs session and packet numbers before decryption, the header is XOR-masked with an XChaCha20 keystream so wire bytes appear random. Optional obfuscation runs above the core protocol: "rand" adds random padding and dummy traffic, while "ssh" mimics an SSH handshake and banner before switching to encrypted tunnel traffic; server and client obfuscation modes must match.

The repository includes source, tests, and Cargo files and shows recent development activity; the code was written with AI assistance and reviewed by the author but requires a full security audit and censorship-resistance testing before sensitive use. Documentation and formal specifications are in progress and a linked blog post explains protocol and implementation details. The project is MIT/Apache-2.0 licensed, accepts issues and PRs, and warns users to apply appropriate security measures when deploying.