x6nux/he-ipv6-pool

If you already have a Hurricane Electric tunnel and want many IPv6 exit addresses without rebuilding your server's networking, this project is worth a look. It runs the IPv6 stack in user space and exposes the pool through a single SOCKS5/HTTP port.

The problem

You have a machine with a public IPv4 and a free HE 6in4 tunnel, and you want requests to leave from different IPv6 addresses, perhaps for testing or for avoiding per-IP limits on sites that support IPv6. Doing this by hand usually means creating tunnel interfaces, adding addresses from the routed /64 or /48, and wiring up a proxy per address, which interferes with the host's own networking. With this project, you register the tunnel, run one install command, and point clients at one proxy port; the exit address is chosen by a username suffix, so no per-address setup remains on the client side.

What's different

The mechanism is the interesting part: the whole IPv6 path is carried over a userspace gVisor stack, so no sit/gif/TUN device is created and the routing table is left alone. The same port auto-detects SOCKS5 (including UDP) and HTTP CONNECT, and the username string controls the exit address: random per connection, pinned to a session, rotated on a TTL, spread across /64s, or fixed to one address. That makes the pool usable from ordinary curl with a socks5h:// URL, without custom client code.

The trade-off is that this is a narrow, IPv6-only exit: requests to IPv4-only targets are refused outright, there is no IPv4 fallback, and SOCKS5 BIND and UDP fragmentation are unsupported. Correctness also depends on HE actually routing each prefix to your tunnel; the README notes that a newly assigned /48 can take time to become usable, and that its own test of a Singapore-assigned /48 returned unreachable while a US Ashburn tunnel worked. Users also need to release protocol 41 and the proxy port at the cloud provider's firewall, which the install command cannot do for you.

Who should try it

The good fit is someone running a Linux host with a real public IPv4 and an HE tunnel who needs several IPv6 source addresses for testing or scraping sites with AAAA records, and who values keeping the host's own network untouched. The poor fit is anyone whose targets are IPv4-only, who needs IPv4 exits, or who wants a managed, dynamic-IP-friendly setup: endpoint updates are manual via the HE update URL, and the admin commands assume Linux with systemd. macOS builds exist, but the README says the tunnel has not been validated there on a real HE connection, and Windows is not supported. Docker Compose is a documented alternative to the systemd installer, though it must use host networking and still requires host firewall rules.

Requirements and limitations

The essentials are an HE account and a tunnel with an assigned /64 or /48, a public IPv4 endpoint that responds to HE's ICMP ping, and inbound protocol 41 plus the proxy port opened both on the host and at the cloud provider. Linux install requires systemd; without it you run the binary manually with CAP_NET_RAW. Choose a European or North American tunnel server if you can, since the README recommends those for routing and IP-geolocation reasons.

Ongoing care matters: if the server's IPv4 changes, the HE endpoint does not update itself; you need a cron job against the tunnelbroker update URL. Expect to verify each prefix is routed, and do not run the Docker and systemd versions side by side, because the README says they reset each other's connections. Sessions that pin one IP can trip per-IP rate limits under concurrency; the documented answer is -cidr-64 or lower concurrency.

HotRepo's take

HotRepo first tracked this repository on 2026-10-24; on the go NEW-REPOSITORY board (not the overall Trending board) it showed 50 total stars at #15 on 2026-10-25, two days after creation. The sample has no comparable daily-board history, so persistence cannot yet be judged. Before adopting, verify that HE routes your specific /48 on the tunnel server you pick, since the README treats unrouted prefixes as the main source of partial failures.

See the project instructions and HE TunnelBroker.