v0.1.0 · Open source · Apache-2.0

Sockrocket.
Proxy that ships.

Native GUI, CLI, and AsusWRT-Merlin — one Rust stack from your laptop to the whole LAN.

Download v0.1.0 View source

Protocols

Surfaces

7.4k

CN CIDRs

Arch targets

100%

Rust

Features

Built for daily use,
not demo day.

Through-proxy latency, real routing, and a Merlin plugin that shares the same engine as the desktop client.

⚡

Warm through-proxy tests

Node ranking measures exit-side RTT on a warm path — what browsing feels like, not a fake TCP ping to server:port.

🧭

Smart routing

Domain, GeoIP (built-in CN CIDRs), and CIDR rules. System proxy for typical apps; TUN when something ignores the OS proxy. How GeoIP works →

🔏

TLS fingerprint craft

Patched rustls (craftls) with REALITY and browser-like ClientHello — built for hostile networks.

📡

Subscriptions

Clash, V2Ray / VMess, SingBox URLs. Auto-detect, update, dedupe, batch test.

🖥️

GUI + CLI

Native GPUI desktop app and a lean CLI for headless or scripted setups.

🛰️

LAN-wide Merlin

Official AsusWRT-Merlin package: one musl binary, Web UI, iptables/DNS, hot-reload node switch.

Routing & GeoIP

China direct without a fat MMDB.

geoip:CN is powered by a curated in-binary CIDR list — small enough for Merlin flash, accurate enough for domestic direct.

What “GeoIP” means here

Not MaxMind. Sockrocket ships a lightweight in-memory GeoIP database built from ~7456 aggregated China IPv4 CIDRs (from 17mon/china_ip_list; refresh via scripts/update-china-cidrs.sh), plus private ranges. Rules like geoip: CN → direct hit this table.

Rule types

domain / domain-suffix / domain-keyword
ip-cidr, geoip, dst-port (priority + list order)
final catch-all → proxy or direct
Actions: direct · proxy · reject

Built-in China-direct set

Out of the box: private/LAN CIDRs, common CN domain suffixes & keywords, then the CN IP list, then match-all → proxy. Your custom rules prepend this set (first match wins).

Merlin extras

Same CIDR list can load into a kernel ipset for hardware-NAT direct (cn_ipset_direct). TUN Fake-IP keeps international names on the domain path; domestic answers stay real IPs so geoip/direct still works.

Why not MaxMind GeoLite? A Country MMDB is typically several megabytes — painful on Merlin JFFS next to a ~10 MB musl binary, plus license/update friction. The curated CN list keeps the router package lean; gaps are covered by domain rules and the TUN domestic-IP table.

Same YAML on desktop CLI and Merlin (rules: prepend the built-in set):

rules:
  - rule_type: "domain-suffix"
    pattern: "google.com"
    target: "proxy"
    priority: 10
  - rule_type: "dst-port"
    pattern: "443"
    target: "direct"
  - rule_type: "geoip"
    pattern: "CN"
    target: "direct"
  - rule_type: "final"
    pattern: ""
    target: "proxy"

asuswrt-merlin · koolcenter

Same engine on the router.

What works in the GUI works on Merlin — transparent proxy for every device on your LAN.

Platform packages: arm64 (hnd_v8), armv7 soft/hard float
Hot-reload set_node without tearing down listeners
Through-proxy probe concurrency capped for router stability

Merlin guide →

Protocols

The ones that matter.

Including QUIC next-gen transports and Reality obfuscation.

ShadowsocksLight, general purpose

TCPUDPAEAD 2022

VMessCDN-friendly

WSTLS

VLessLow overhead

REALITYWS

TrojanHTTPS camouflage

TLS

TUIC v50-RTT reconnect

QUIC

Hysteria2Lossy networks

QUIC

Setup & config

Install once. Configure the same way.

GUI and Merlin share subscriptions, nodes, and routing rules. CLI uses the same config.yaml shape. Defaults: SOCKS5 :1080 · HTTP :1087.

Install — macOS: open the DMG and drag to Applications. Windows: unzip and run Sockrocket.exe. Linux: extract the tarball and run install.sh (or launch ./sockrocket).
Add a subscription — paste a Clash / V2Ray / SingBox URL → Update. Or add nodes manually.
Pick a node — Test / Test all (warm through-proxy RTT), then select a node and connect.
Traffic mode — enable System proxy for browsers and most apps; turn on TUN when an app ignores the OS proxy (admin / root required).
Routing — built-in China-direct is on by default; add custom domain / GeoIP / CIDR rules in Settings (same model as YAML rules:). See Routing & GeoIP.

# macOS — open DMG, drag Sockrocket to Applications
open sockrocket-macos-aarch64.dmg

# if Gatekeeper blocks (unsigned builds):
xattr -cr /Applications/Sockrocket.app

# Linux
tar xzf sockrocket-linux-x86_64.tar.gz
./Sockrocket-*-linux-x86_64/install.sh

# Windows — extract ZIP, run Sockrocket.exe

Language: status-bar cycle EN → VI → 中文 (saved). Do not paste subscription URLs into public chats.

Init — generate a starter config.yaml, then edit listen ports, subscriptions, and rules.
Subscriptions — under subscriptions: set name, url, format: auto. Nodes fill in on start (or when you refresh).
Active node — active_node: 0 selects the first node; null stays direct.
Rules — same rule_type / pattern / target as GUI and Merlin. Custom rules prepend the built-in China-direct set.
Run — point apps at local SOCKS/HTTP, or put a system-proxy / TUN front-end in front of the CLI.

sockrocket-cli --init config.yaml
# edit subscriptions / rules / active_node, then:
sockrocket-cli config.yaml

# minimal shape
listen_addr: "127.0.0.1"
socks_port: 1080
http_port: 1087
subscriptions:
  - name: "My sub"
    url: "https://example.com/sub"
    format: "auto"
active_node: 0

Full field reference: docs/configuration.md · example: config.yaml.example.

Pick the package — from Releases download sockrocket-merlin-<platform>.tar.gz. Match uname -m / SoC: hnd_v8 (aarch64 BCM490x) vs hnd (armv7 BCM675x) is the usual mistake.
Software Center (recommended) — router Web UI → Software Center (koolcenter / softcenter) → Offline install → upload the matching .tar.gz → Install. Wrong platform .valid → reject or Exec format error.
Open the plugin — Sockrocket tile in Software Center, or http://<router-lan-ip>/ext/sockrocket/sockrocket.asp.
Configure — add subscription → Update → wait for nodes → select node → enable transparent proxy / TUN as needed. Same rules engine as desktop.
Optional — SSH install if you prefer; edit /jffs/addons/sockrocket/config.yaml (listen 0.0.0.0 for LAN). Service: sockrocket.sh start|stop|restart|status|update-subs.

# —— Software Center plugin install (recommended) ——
# 1. Download sockrocket-merlin-<platform>.tar.gz from GitHub Releases
# 2. Router Web UI → Software Center (koolcenter / softcenter)
# 3. Offline install / upload package → select the .tar.gz → Install
# 4. Open the Sockrocket tile (or /ext/sockrocket/sockrocket.asp)

# —— SSH install (optional) ——
uname -m
scp sockrocket-merlin-hnd_v8.tar.gz admin@192.168.50.1:/tmp/
ssh admin@192.168.50.1
cd /tmp && tar xzf sockrocket-merlin-hnd_v8.tar.gz
sh sockrocket/install.sh hnd_v8

Archive root is always sockrocket/ (koolcenter module name). LAN devices need no client — traffic hits iptables/TUN on the router, then GeoIP/domain rules. Full guide: docs/merlin.md.

Community

Announcements and Q&A.

Release notes on Telegram; questions on GitHub Discussions. Do not post subscription URLs, tokens, or personal identifiers.

Channel for release announcements.

t.me/sockrocket

Discussions

Q&A and feedback on GitHub.

Open Discussions

Issues

Bug reports and regressions.

Open Issues

Download

Every platform we ship.

Prebuilt GUI, CLI, and Merlin packages on GitHub Releases.

Linux

x86_64 and aarch64 GUI + CLI.

Releases

macOS

Intel and Apple Silicon native.

Releases

Windows

x86_64 GUI + CLI .exe.

Releases

Merlin

arm64 / armv7 soft & hard float packages.

Packages Docs

Sockrocket.Proxy that ships.

Built for daily use,not demo day.

Warm through-proxy tests

Smart routing

TLS fingerprint craft

Subscriptions

GUI + CLI

LAN-wide Merlin

China direct without a fat MMDB.

What “GeoIP” means here

Rule types

Built-in China-direct set

Merlin extras

Same engine on the router.

The ones that matter.

Install once. Configure the same way.

Announcements and Q&A.

Telegram

Discussions

Issues

Every platform we ship.

Linux

macOS

Windows

Merlin

Sockrocket.
Proxy that ships.

Built for daily use,
not demo day.