Hyperion Tunnel
High-performance secure tunneling protocol — WorldNana
Quick start
# 1. Generate TLS certificate
hyperion gencert --out-dir ./certs --cn my.server.com
# 2. Generate configs
hyperion genconfig --type server --output server.toml
hyperion genconfig --type client --output client.toml
# 3. Run server
hyperion server --config server.toml
# 4. Run client
hyperion client --config client.toml
Build
# Debug
cargo build
# Release (LTO, stripped)
cargo build --release
# Cross-compile to Linux x86_64 from macOS
cargo build --release --target x86_64-unknown-linux-musl
Language selection
# Russian
HYPERION_LANG=ru hyperion server --config server.toml
# Chinese
HYPERION_LANG=zh hyperion --lang zh server -c server.toml
# Persian
HYPERION_LANG=fa hyperion client -c client.toml
Commands
| Command |
Description |
hyperion server -c server.toml |
Start tunnel server |
hyperion client -c client.toml |
Start tunnel client |
hyperion genconfig --type server |
Generate server config |
hyperion genconfig --type client |
Generate client config |
hyperion gencert --cn hostname |
Generate self-signed cert |
hyperion status |
Show connection status |
Architecture
┌─────────────────────────────────────────────────────┐
│ CLI (clap + i18n) │
│ EN / RU / ZH / FA │
└──────────────────┬──────────────────────────────────┘
│
┌──────────────────▼──────────────────────────────────┐
│ Server / Client Logic │
│ ┌─────────────────────────────────────────────┐ │
│ │ Multiplexer (Mux) │ │
│ │ Stream 1 Stream 2 Stream N ... │ │
│ │ [OPEN][DATA*][FIN] per stream │ │
│ └─────────────────────────────────────────────┘ │
└──────────────────┬──────────────────────────────────┘
│
┌──────────────────▼──────────────────────────────────┐
│ Frame Codec │
│ [Type:1][Flags:1][StreamID:2][Len:4][Payload] │
└──────────────────┬──────────────────────────────────┘
│
┌──────────┴──────────┐
│ │
┌───────▼───────┐ ┌─────────▼──────┐
│ TCP + TLS │ │ QUIC │
│ (tokio-rustls)│ │ (quinn) │
└───────────────┘ └────────────────┘
│
┌───────▼───────────────────────────────────────────┐
│ TLS 1.3 only (rustls, ring backend) │
│ X25519 ECDHE · AES-256-GCM · ChaCha20-Poly1305 │
│ Forward secrecy · Replay protection │
└───────────────────────────────────────────────────┘
Binary frame format
0 1 2 3 4 5 6 7
+-------+-------+-------+-------+-------+-------+-------+-------+
| Type | Flags | Stream ID | Payload Length |
+-------+-------+-------+-------+-------+-------+-------+-------+
| Payload (0 – 65535 bytes) |
+-------+-------+-------+-------+-------+-------+-------+-------+
| Type |
Value |
Purpose |
| DATA |
0x01 |
Tunnel payload |
| WINDOW_UPDATE |
0x02 |
Flow control |
| RST_STREAM |
0x03 |
Abort stream |
| PING |
0x04 |
Keepalive |
| GOAWAY |
0x05 |
Graceful shutdown |
| SETTINGS |
0x06 |
Connection params |
| AUTH |
0x07 |
Authentication |
| OPEN |
0x08 |
Open new stream |
Security properties
- TLS 1.3 only — TLS 1.2 disabled at the rustls config level
- Forward secrecy — guaranteed by TLS 1.3 ephemeral key schedule
- Replay protection — 64-bit sliding window + timestamp validation
- Token auth — pre-shared hex tokens; mTLS optional
- Strict validation — all frames validated before processing
Module map
src/
├── main.rs CLI entry point
├── lib.rs Crate root
├── error.rs Unified error types
├── protocol/
│ ├── frame.rs Binary codec (zero-copy via bytes::Bytes)
│ └── mux.rs Stream multiplexer (like yamux/HTTP2)
├── transport/
│ ├── traits.rs Transport / Connection / Listener traits
│ ├── tcp.rs TCP + TLS 1.3 backend
│ └── quic.rs QUIC backend (quinn)
├── crypto/
│ ├── tls.rs rustls config builders
│ └── replay.rs Sliding-window replay protection
├── config/mod.rs TOML/JSON config structs
├── cli/
│ ├── mod.rs clap commands
│ └── i18n.rs EN/RU/ZH/FA message tables
├── server/mod.rs Server logic
└── client/mod.rs Client + reconnect loop
Reality-style hardening
- TLS 1.3 only
- X25519/ring crypto provider
- HTTP/2 + HTTP/1.1 ALPN camouflage
- 0-RTT disabled
- Replay protection enabled
- Configurable Reality SNI and short IDs
