daeuniverse/honk

honk is an experimental transparent-proxy engine for Linux written in Rust. It intercepts TCP and UDP traffic, both LAN-forwarded and host-originated, and sends it through configurable outbounds and groups. It borrows dae's eBPF datapath and configuration syntax and sing-box's outbound-group and Clash API patterns, but is an independent implementation rather than a port of either Capabilities repository.

What actually changes

Instead of configuring each application to use a proxy, you install honk at the network layer. It uses TC eBPF and the dae0/daens interfaces with compiled routing to capture traffic, then applies dae-syntax configuration startup guide configuration. Outbounds include SOCKS5, Shadowsocks/2022, Trojan, AnyTLS, Hysteria2, TUIC, Juicity, VMess, VLESS, direct and block; groups include Selector, URLTest, LoadBalance, Fallback and Score. Protocol-specific limits matter — VMess is TCP-only, and Trojan/VMess/VLESS H2 XHTTP covers packet-up, stream-up and stream-one protocol limits.

DNS resolution supports UDP, TCP, DoT, DoH, DoQ and DoH3 upstreams, optionally routed through a node or group, with routing and caching. Configuration can be reloaded, and subscriptions are supported.

Control surfaces and builds

There are two web-UI paths. The native API pairs with doona, which adds observations, diagnostics and configuration editing; a separate native-api build can serve an installed doona or the embedded variants in a full build. Clash dashboards such as zashboard pair with the Clash-compatible REST/WebSocket API, which honk enables by setting experimental.clash_api and downloads on first start web interface experimental settings. The build matrix is full (native API, Clash API, embedded doona), native-api (no Clash API) and clash-api (no native API); every build ships as a static musl binary install. OpenWrt users are pointed to a separate package feed OpenWrt feed.

Requirements and cautions

The project labels itself early alpha and not recommended for production, warning of breaking changes, incomplete features and limited real-world validation README. Transparent proxying requires root, Linux 6.12+, specific kernel options and bpffs startup guide. Initial deployment changes network hooks, namespaces and sysctls, so the documentation advises keeping an out-of-band management path available install.

There is no FakeIP engine, no full mihomo parity, and no Windows/macOS datapath; macOS and Windows support remains an exploration item because the datapath is Linux eBPF README. Releases follow SemVer from v0.1.0, and before 1.0 minor releases may change configuration or behavior, so release notes should be read before upgrading; the native API's /api/v1 contract may likewise change in a minor release README. Source builds need extra steps — a plain cargo build --release does not enable the real datapath build from source. Mock mode (--mock-ebpf) allows unprivileged development but does not intercept traffic or test the datapath unprivileged development.

The project is GPL-3.0-only; the development-only dae parser oracle links AGPL-3.0 dae but is not shipped or linked into honk-core license parser oracle.