WatTunnel: an open-source tunnel for networks where only ping gets through

[JohnWatsoon]

Hi everyone 👋

In Iran right now, many routes to the outside world cut TCP, UDP, GRE, IPIP and ESP after a few packets. Only ICMP (ping) gets through. Most tunnels treat that link like a clean TCP pipe and stall, so I built WatTunnel specifically for it.

What it does
🔹 Hides traffic in ICMP echo, timestamp, info or mask messages, with 640-byte datagrams sized for filtered routes
🔹 Also runs the same encrypted session over UDP, TCP, TLS, WebSocket, HTTP/2 and gRPC (works behind Cloudflare), with a reverse mode when only one side can dial out
🔹 Forwards any TCP and UDP port from one process, and adds or removes ports live without dropping users

How it performs
🔹 Delay-based pacing (random loss isn’t treated as congestion), selective acks, fast loss repair, adaptive FEC, and interactive traffic prioritized over bulk
🔹 On a real ICMP-only Iran ⇄ Europe route: ~33 MB/s, the route’s full capacity. GOST v3 ICMP got 1.6–5.4 MB/s on the same servers. Single connection: ~25 MB/s vs 1.0–1.6.
🔹 ~40 MB RAM and 6–7× less CPU per MB than GOST
🔹 Carrying 250–300 real users in production through a single process

Security and ops
🔹 ChaCha20-Poly1305 with per-session keys. Unauthenticated packets get no reply, so scans see nothing.
🔹 One-line install, token pairing, live dashboard, connection doctor with a built-in speed test, auto-heal, per-port traffic stats and quotas, verified updates with rollback
🔹 Single static Go binary, MIT-licensed

Benchmarks against GOST, BackPack, Hans, pingtunnel and ptunnel-ng (including an honest clean-link comparison where others do fine) are in the repo:
👉 github.com/JohnWatsoon/WatTunnel

I’d really appreciate feedback, especially on the transport design and security. Issues and PRs are welcome 🙏