Run your own privacy transport with Umbra’s CLI client and server. Use a real site as cover, choose TCP or QUIC for your network, and connect your apps through local SOCKS5.
MIT open source. Self-hosted. Alpha software.
For your own deployment
Choose Umbra when you want to run both endpoints and connect the apps you already use, with clear limits on what the transport protects.
Unauthenticated requests are forwarded to your configured real destination rather than receiving a proxy-specific rejection. This does not guarantee an undetectable connection.
Chrome profiles guide the TLS ClientHello shape, including extension order and GREASE. This follows browser handshake patterns, not a promise of an identical browser fingerprint.
You do not need to obtain or renew a CA-issued certificate for the Umbra node. You still need keys and a reachable real TLS 1.3 site as cover.
A local SOCKS5 entry can carry TCP and UDP over separately configured transports. Connect a Clash-style client through SOCKS5 to keep its routing rules.
From installation to your first connection
Download and install a matching release asset, or optionally build from source below. Generate keys, configure the server and CLI client, then point your apps to the local SOCKS5 listener on loopback.
git clone https://github.com/lotosli/umbra.gitcd umbracargo build --release./target/release/umbra keygenDocumentation
Install both endpoints, choose your transport settings, and compare options before committing to a deployment.
Compare the options, check the limits, then set up Umbra.
Get started