A high-performance, open-source anti-DPI / anti-censorship tunnel in Go. It disguises encrypted VLESS/Trojan traffic as SSH, TLS/HTTPS, SMTP/IMAP and a DirectAdmin panel over dynamic, self-scaling connection pools — very hard to fingerprint or block.
bash <(curl -fsSL https://raw.githubusercontent.com/hedioum/Hedioum-Pool-Tunnel/main/install.sh)
One node listens behind SSH, TLS/HTTPS, STARTTLS SMTP/IMAP, implicit-TLS SMTPS/IMAPS and a DirectAdmin panel — each install presents a different, shifting on-wire signature.
With a domain, the TLS mimic serves a genuine, auto-renewing ACME certificate — CT-logged like any real HTTPS host — with a safe self-signed fallback.
ChaCha20-Poly1305 + HKDF. The token is never sent on the wire and channel-bound auth defeats MITM — with a single crypto layer for high throughput.
SSH is the long-lived backbone; non-SSH pipes retire on a randomized time/byte budget and churn to fresh connections — no fixed long-lived signature.
Least-loaded balancing that scales on real bandwidth, fluctuating rate caps, and zero-downtime draining — no lag when connections cycle.
One SOCKS5 port serves TCP and UDP-over-TCP, so QUIC/HTTP3, DNS and voice/video work — on an isolated sub-pool, with no DNS leak by design.
Unauthorized probes get a real sshd, a DirectAdmin login, or a per-install-unique web page — even the bare IP looks like an ordinary host.
Non-interactive setup, in-place node editing, an interactive dashboard, safe self-update, a built-in speedtest, probe, and an egress IP-reputation check.