apernet / hysteria

Hysteria is a powerful, lightning fast and censorship resistant proxy.

Hysteria is a powerful, lightning fast and censorship resistant proxy.

Get Started

中文文档

Hysteria 1.x (legacy)

---

🛠️ Jack of all trades

Wide range of modes including SOCKS5, HTTP Proxy, TCP/UDP Forwarding, Linux TProxy, TUN - with more features being added constantly.

⚡ Blazing fast

Powered by a customized QUIC protocol, Hysteria is designed to deliver unparalleled performance over unreliable and lossy networks.

✊ Censorship resistant

The protocol masquerades as standard HTTP/3 traffic, making it very difficult for censors to detect and block without widespread collateral damage.

💻 Cross-platform

We have builds for every major platform and architecture. Deploy anywhere & use everywhere. Not to mention the long list of 3rd party apps.

🔗 Easy integration

With built-in support for custom authentication, traffic statistics & access control, Hysteria is easy to integrate into your infrastructure.

🤗 Chill and supportive

We have well-documented specifications and code for developers to contribute and/or build their own apps. And a helpful community, too.

---

If you find Hysteria useful, consider giving it a ⭐️!

hysteria's Issues

Update upstream quic-go

Transport interface

• Core server
• Core client
• ACL
• HTTP
• Relay
• SOCKS5
• TProxy

udp tproxy doesn't work

version

./hysteria -v
Hysteria version v0.8.0-1-g0719e89 2021-05-09 08:04:12 0719e8980e1b127729819622cb794e00e71e4b83

config

{
...
  "socks5": {
    "listen": "127.0.0.1:1080"
  },
  "tproxy_tcp": {
    "listen": "127.0.0.1:12345",
    "timeout": 300
  },
  "tproxy_udp": {
    "listen": "127.0.0.1:12345",
    "timeout": 60
  }
}

rules

iptables -t mangle -N proxy
iptables -t mangle -A PREROUTING -d 8.8.8.8 -j proxy

iptables -t mangle -A proxy -p udp -j TPROXY --on-port 12345 --on-ip 127.0.0.1 --tproxy-mark 0x01/0x01
iptables -t mangle -A proxy -p tcp -j TPROXY --on-port 12345 --on-ip 127.0.0.1 --tproxy-mark 0x01/0x01

ip route add local default dev lo table 100
ip rule add fwmark 1 lookup 100

logs

# tcp worked
dig @8.8.8.8 google.com +tcp

; <<>> DiG 9.13.1 <<>> @8.8.8.8 google.com +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48535
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             216     IN      A       142.250.181.238

hysteria: 2021-05-09T09:56:18Z [DEBU] [src:192.168.3.230:5777] [dst:8.8.8.8:53] [action:Proxy] TCP TProxy request
hysteria: 2021-05-09T09:56:19Z [DEBU] [src:192.168.3.230:5777] [dst:8.8.8.8:53] TCP TProxy EOF

# udp didn't work
dig @8.8.8.8 google.com

; <<>> DiG 9.13.1 <<>> @8.8.8.8 google.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

hysteria: 2021-05-09T09:55:50Z [DEBU] [src:192.168.3.230:55016] UDP TProxy request

seems hysteria received the udp request (didn't recognize dst?), but didn't response

Using hysteria socks5 + ipt2socks, udp tproxy is ok.

Prometheus Active Conn Gauge

Reed-Solomon Erasure Coding FEC for UDP traffic

Prometheus Metrics

#41

TUN mode

socks udp issue

It seems that udp function does not work properly (or maybe i'm wrong1?). I used hysteria with tun2socks but dns lookups could not be processed (but for example v2ray client' socks could process the dns requests).

Better CLI

SOCKS5 & HTTP basic auth

HTTP proxy support

Client timeout issue

Hi
Sometimes client gives timeout and can not process the requests and i have to restart the client to works again.
I can not see any reason and logs are something like "...:443] [action:Proxy] SOCKS5 TCP request".
Also i applied sysctl recommends but the issue still exists.

Logging Levels

ACL文件支持geosite规则吗

像 proxy geosite:geolocation-!cn 这样可行么

HTTPS proxy

iptables tproxy

Something like https://www.v2fly.org/config/protocols/dokodemo.html

Benchmark in README

UDP receive buffer size

连接不上服务器

yudeMacBook-Air:hysteria_darwin_amd64 brite$ ./cmd proxy client -config config.json
2021/07/06 10:47:56 Configuration error: no SOCKS5 listen address
yudeMacBook-Air:hysteria_darwin_amd64 brite$ ~/hysteria_darwin_amd64/hysteria_darwin_amd64/cmd proxy client -server mydomain.com:36710 -socks5-addr localhost:2080 -up-mbps 10 -down-mbps 50
2021/07/06 10:48:14 Configuration loaded: {SOCKS5Addr:localhost:2080 SOCKS5Timeout:0 ACLFile: ServerAddr:mydomain.com:36710 Username: Password: Insecure:false CustomCAFile: UpMbps:10 DownMbps:50 ReceiveWindowConn:0 ReceiveWindow:0 Obfs:}

2021/07/06 10:48:26 Client initialization failed: NO_ERROR: Handshake did not complete in time
yudeMacBook-Air:hysteria_darwin_amd64 brite$ cat config.json
{
"server": "mydomain.com:36710",
"up_mbps": 10,
"down_mbps": 50,
"socks5": {
"listen": "127.0.0.1:2080"
},
"http": {
"listen": "127.0.0.1:2081"
}
}
yudeMacBook-Air:hysteria_darwin_amd64 brite$

怎么解决？

ACME

https://github.com/caddyserver/certmagic

Option to disable SOCKS5 UDP

hysteria是否支持NGINX 的 SNI分流？

Hello,

我使用下面的配置，可以正常的使用sni分流给trojan-gfw和x2ray，把tls部分交给他们处理，但是我是用同样的方法分流给hysteria却无法使用，服务端没有任何输出，请问找个要怎么处理，因为我想要的是nginx监听443然后分流给各种代理工具。

...
stream {
    map $ssl_preread_server_name $name {
        xxxxxx.com 127.0.0.1:7001;  #hysteria监听端口
        default 127.0.0.1:4433;
    }
    server {
        listen 443 reuseport;
        listen [::]:443 reuseport;
        proxy_pass $name;
        ssl_preread on;
    }
}
...

Better obfs

No-encryption mode

Client-side ACL

可否增加单端口多用户和流量统计的支持？

hysteria的速度确实非常快，感谢作者开源。

现在hysteria只适用于自建服务器的用户。请问是否考虑加上单端口多用户和流量统计等功能？这样服务提供商也可以把hysteria加进来，让更多的人用到。

运行客户端命令遇错

hi.

我在mac上运行：
./cmd proxy client -server vps-ip:36710 -socks5-addr localhost:1081 -up-mbps 10 -down-mbps 50 -obfs BlueberryFaygo -username xyz -password abc
显示：
...
2020/05/03 16:28:07 Client initialization failed: CRYPTO_ERROR: x509: cannot validate certificate for my-vps-ip because it doesn't contain any IP SANs.

怎么解决？

Great acceleration on large files, but slower on small files

Hello, Good work on this.

I tried this out over a very slow link (satellite) of 500-600ms latency. I used it to proxy Windows Shares (CIFS/SMB).

I saw a very good improvement on transferring medium/large files, but on files smaller than 50Mb, and very small files like a Word document of less than 1Mb, I saw speed degradation.

I'm wondering if this is something that could be remedied. I'm haven't fully delved into your code and QUIC.

It may just be due to the CIFS/SMB protocol which sitll obviously occurs despite using Hysteria.

And frankly, ultimately my end goal isn't to proxy CIFS to accelerate it. I'm really on the look out for a fast file transfer mechanism over high latency links. Something that wouldn't suffer the TCP penalties - like you tell it transfer at 50Mbps and it starts right off at that speed instead of starting slow and little by little increase in speed.

The ultimate goal is to have near instant small file copy (files less than 100MB) and fast copy for large files.

So that's how I ran into your project - I thought the QUIC protocol could be a good starting point and was looking for fast file transfer over QUIC. Didn't find much yet, but did find your project which does work in accelerating existing file transfer protocol. But not so much on small files.

Better log format

Update checker

Proxy SOCKS5 UDP support

Windows: Failed to initialize client

2021-08-05T17:48:16+08:00�[36m [INFO] [config:{Server:www.example.com:443 UpMbps:10 DownMbps:50 SOCKS5:{Listen:127.0.0.1:1080 Timeout:0 DisableUDP:false User: Password:} HTTP:{Listen:127.0.0.1:8080 Timeout:0 User: Password: Cert: Key:} TUN:{Name: Timeout:0 Address: Gateway: Mask: DNS:[] Persist:false} TCPRelay:{Listen: Remote: Timeout:0} UDPRelay:{Listen: Remote: Timeout:0} TCPTProxy:{Listen: Timeout:0} UDPTProxy:{Listen: Timeout:0} ACL: Obfs:example Auth:[] AuthString: ServerName: Insecure:false CustomCA: ReceiveWindowConn:0 ReceiveWindow:0}] �[0mClient configuration loaded

2021-08-05T17:48:21+08:00�[31m [FATA] [error:timeout: no recent network activity] �[0mFailed to initialize client

hysteria-windows-6.0-amd64.exe运行几秒后窗口就会自动关闭，请问怎么样解决？

反代支持

例如服务器已有网站和合法证书，挂在 Nginx 后面，那么如何在 Nginx 上新增域名或挂到已有域名的特定路径后面呢？

注：Nginx 已支持 HTTP/3

如未支持建议添加，如已支持建议文档说明

Relay UDP support

Redo benchmarks

Packet obfuscator interface

Add a packet obfuscator interface to allow users to customize the data encapsulation logic of QUIC packets. Could be very useful for bypassing firewall blocking or QoS.

hysteria 0.7.0 can't run as server mode?

version 0.7.0 c9ab6d0

$ ./hysteria
FATA[2021-04-28T14:03:55Z] Failed to parse client configuration          error="no SOCKS5, HTTP, relay or TProxy listen address" file=config.json

$ cat config.json
{
  "listen": ":9000",
  "cert": "/etc/xx/xx.crt",
  "key": "/etc/xx/xx.key",
  "obfs": "xxxxx",
  "up_mbps": 100,
  "down_mbps": 100
}

Can't run as server on Asus router RT-AC86U

Hello. I have successfully set up Xray and Brook servers on my Asus router RT-AC86U, but failed to set up hysteria server.

The error message prompts:
error while loading shared libraries: libpthread.so.0: cannot open shared object file: No such file or directory

---

In fact, libpthread.so.0 exists in /lib/ directory.

Custom TLS server name

Simplify code, remove the "internal" pkg

Server-side ACL

Feature(for release) request: statically linked release

Refer: DNSCrypt/dnscrypt-proxy#458

Huge problems at higher speed

Hello!
I did test this program and found that it does not work for gigabit speeds
I constantly get errors like
error="INTERNAL_ERROR: too many gaps in received data"
and speed gets capped around 240-250mbit (i have 10Gbit on server and 2x1Gbit(redundant) on client).

Protocol 2.0

• Version Number
• Split host & port

Log level DEBUG by default

Reverse relay

Update dependencies

External auth

HTTP/3 cloaking

HTTP authentication 不工作

如下设置后， 客户端浏览器不管密码输入不输入都可以连接访问 ， 密码随便输也可以连接。
0.8.1版本
chrome+switchyomega， 设置http代理

  "http": {
    "listen": "0.0.0.0:8080", 
    "user": "me",
    "password": "xxx343"
  }