Brook — Cross-Platform Network Proxy and VPN Tool

Introduction

Brook is a cross-platform proxy and VPN tool written in Go. It provides a simple, single-binary deployment for both server and client with support for custom protocols, SOCKS5, transparent proxying, and DNS-over-HTTPS.

What Brook Does

• Runs as both a proxy server and client with a single executable
• Supports its own Brook protocol, SOCKS5, and WebSocket-based transport
• Provides transparent proxying on Linux for system-wide traffic routing
• Includes DNS features with DNS-over-HTTPS and custom DNS resolver support
• Offers a GUI client for Windows, macOS, Android, and iOS

Architecture Overview

Brook is a single Go binary that can operate in multiple modes: server, client, WebSocket server/client, transparent proxy, DNS server, and relay. The Brook protocol wraps traffic in an encrypted stream using a password-derived key. For censorship-resistant scenarios, the WebSocket mode disguises proxy traffic as standard HTTPS connections. On Linux, the transparent proxy mode uses iptables or nftables rules to redirect all system traffic through Brook.

Self-Hosting & Configuration

• Deploy the server with a single command specifying port and password
• No configuration files needed for basic setups; all options are CLI flags
• Use WebSocket mode with a domain and TLS certificate for HTTPS-based transport
• Enable transparent proxy mode on Linux for routing all traffic without per-app configuration
• The GUI clients support importing server configurations via Brook-format links

Key Features

• Single binary with zero dependencies for both server and client
• Multiple transport modes including raw TCP, WebSocket, and WebSocket over TLS
• Built-in DNS resolver with DNS-over-HTTPS support
• Transparent proxy mode for Linux without manual iptables configuration
• Cross-platform GUI client with a consistent interface

Comparison with Similar Tools

• Shadowsocks — Uses a custom AEAD protocol; Brook offers simpler deployment with similar performance
• WireGuard — Kernel-level VPN with stronger encryption; Brook operates in user space with more transport flexibility
• V2Ray — Feature-rich but complex configuration; Brook prioritizes simplicity with CLI-driven setup
• Trojan — Mimics HTTPS traffic; Brook's WebSocket mode achieves similar obfuscation with a lighter footprint

FAQ

Q: Is Brook traffic detectable? A: In WebSocket-over-TLS mode, Brook traffic resembles normal HTTPS WebSocket connections, making it resistant to basic deep packet inspection.

Q: Can I use Brook as a full VPN? A: On Linux, Brook's transparent proxy mode routes all system traffic through the proxy, functioning similarly to a VPN. On other platforms, it operates as a SOCKS5/HTTP proxy.

Q: Does Brook support multiple users on one server? A: The basic server mode uses a shared password. For multi-user setups, you can run multiple Brook server instances on different ports.

Q: How does Brook compare to V2Ray in performance? A: Brook is lighter in memory usage and startup time due to its simpler architecture. Throughput is comparable for most use cases.

Sources

• https://github.com/txthinking/brook
• https://brook.app