Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI • Hacker News Board

Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#1

Post by lobito25 » Wed, Jan 07, 2026, 12:30 AM UTC

A fast SOCKS5 proxy that tunnels your traffic through what looks like normal SMTP email, bypassing Deep Packet Inspection firewalls.

How it works: - Client runs a local SOCKS5 proxy (127.0.0.1:1080) - Traffic is sent to server disguised as SMTP (EHLO, STARTTLS, AUTH) - DPI sees legitimate email session, not a VPN/proxy

Features: - One-liner install on any Linux VPS - Multi-user with per-user secrets and IP whitelists - Auto-generated client packages (just double-click to run) - Auto-reconnect on connection loss - Works with any app that supports SOCKS5

Tech: Python/asyncio, TLS 1.2+, HMAC-SHA256 auth

GitHub: https://github.com/x011/smtp-tunnel-proxy

Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI
github.com

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#2

Post by thedougd » Wed, Jan 07, 2026, 3:58 AM UTC

Quite a few things use STARTTLS. I imagine the same technique could be applied to those other protocols, giving users some options as they fight hostile networks.

Clever

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#3

Post by montyanne » Wed, Jan 07, 2026, 4:50 AM UTC

thedougd wrote: post #2

Quite a few things use STARTTLS. I imagine the same technique could be applied to those other protocols, giving users some options as they fight hostile networks. Clever

Just curious - how much of this was AI generated? The readme has crazy emojis & the code was all checked in at once, which is usually my telltale for these kinds of things. Didn't see anything crazy in the source files.

I think its polite to indicate AI agent usage in security related projects like this since they can have huge holes if they're just being vibe coded.

-- Edit: Intended to post this on the board root, sorry.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#4

Post by m132 » Wed, Jan 07, 2026, 4:59 AM UTC

That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#5

Post by catlifeonmars » Wed, Jan 07, 2026, 5:07 AM UTC

m132 wrote: post #4

That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.

What would you reach for out of curiosity?

For me RTP+rateless erasure codes come to mind, but I’m feeling Rube Goldbergy today.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#6

Post by pogue » Wed, Jan 07, 2026, 5:11 AM UTC

m132 wrote: post #4

That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.

I was thinking this too. I'm assuming it doesn't look like an SMTP server from the outside? Because if it does, that would absolutely land your IP up on many, many DNSbls very quickly if it started getting probed.

Interesting idea though, spoofing other protocols than HTTP/HTTPS are probably a good idea for censorship evasion in countries with incredibly strict national firewalls.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#7

Post by zamadatix » Wed, Jan 07, 2026, 5:31 AM UTC

pogue wrote: post #6

m132 wrote: post #4

That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.

I was thinking this too. I'm assuming it doesn't look like an SMTP server from the outside? Because if it does, that would absolutely land your IP up on many, many DNSbls very quickly if it started getting probed. Interesting idea though, spoofing other protocols than HTTP/HTTPS are probably a good idea for censorship evasion in countries with incredibly strict national firewalls.

TECHNICAL.md lays it out a bit more, but it claims to be RFC 5321 compliant with a realistic initiation sequence so it should somewhat look like a real SMTP server for the first bit.

Ending up on any DNSBLs shouldn't be a problem unless you have a static home IP you plan on running an actual SMTP server from after this though.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#8

Post by zamadatix » Wed, Jan 07, 2026, 5:41 AM UTC

montyanne wrote: post #3

thedougd wrote: post #2

Quite a few things use STARTTLS. I imagine the same technique could be applied to those other protocols, giving users some options as they fight hostile networks. Clever

Just curious - how much of this was AI generated? The readme has crazy emojis & the code was all checked in at once, which is usually my telltale for these kinds of things. Didn't see anything crazy in the source files. I think its polite to indicate AI agent usage in security related projects like this since they can have huge holes if they're just being vibe coded. -- Edit: Intended to post this on the board root,…

It's a fair question but I had a bit of a chuckle at the idea having a shit ton of emojis in your GitHub readme was the first flag it might be AI. Mostly because I always assumed the opposite - that GitHub readmes were a big part of the emoji ridden listicle training data (the other being slop "news" site/social media listicles) for AIs in the first place. After all, they are decently well written and come with grabbing the code to train from anyways.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#9

Post by pogue » Wed, Jan 07, 2026, 5:56 AM UTC

zamadatix wrote: post #7

pogue wrote: post #6

Earlier quoted context omitted.

I was thinking this too. I'm assuming it doesn't look like an SMTP server from the outside? Because if it does, that would absolutely land your IP up on many, many DNSbls very quickly if it started getting probed. Interesting idea though, spoofing other protocols than HTTP/HTTPS are probably a good idea for censorship evasion in countries with incredibly strict national firewalls.

TECHNICAL.md lays it out a bit more, but it claims to be RFC 5321 compliant with a realistic initiation sequence so it should somewhat look like a real SMTP server for the first bit. Ending up on any DNSBLs shouldn't be a problem unless you have a static home IP you plan on running an actual SMTP server from after this though.

>SMTP traffic on port 587 (submission) is expected and normal

Any residential dynamic or static IP with this port opened is definitely going to get flagged. Most ISPs already prevent these ports from being open, either by policy or by residential routers.

It would probably very quickly end up on something like SpamHaus's PBL, which looks for this kind of thing.[1]

I would imagine you would also find yourself on Shodan pretty quickly getting hit with constant nmap & login attempts from malicious actors. Spam bots are always looking for insecure servers to send emails from.

I feel like ssh, SFTP, or even a secure DNS server would probably make more sense as something to hide traffic from DPI than an SMTP server.

[1] https://www.spamhaus.org/blocklists/policy-blocklist/

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#10

Post by sebazzz » Wed, Jan 07, 2026, 5:58 AM UTC

catlifeonmars wrote: post #5

m132 wrote: post #4

That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.

What would you reach for out of curiosity? For me RTP+rateless erasure codes come to mind, but I’m feeling Rube Goldbergy today.

I think HTTP web sockets would be an interesting tunneling protocol.