snitun

What it is and what it does

SniTun is a proxy and multiplexer library that secures TCP connections by encrypting them end-to-end using Fernet tokens for authentication and AES (CBC, GCM, or GCM-SIV) for payload encryption. It intercepts external TLS/SNI connections, validates clients via a challenge-response handshake, and forwards traffic through an encrypted multiplexed channel to local endpoints. The library handles protocol versioning, flow control (pause/resume), and connection lifecycle management (new, data, close, ping messages) within the multiplexer frame format.

The package is designed for scenarios where you need to proxy TLS connections through an untrusted network while maintaining encryption and authentication. It uses aiohttp for async HTTP operations and cryptography for all encryption primitives. Configuration is flexible via environment variables for queue sizes and watermarks. The implementation supports both stateful (AES-GCM) and stateless-nonce (AES-GCM-SIV) modes, with the latter providing nonce-misuse resistance at the cost of requiring OpenSSL 3.0+.

Use it for:

• Secure remote access to local services by proxying TLS connections through an encrypted multiplexed tunnel with token-based authentication.
• Building a home automation or IoT gateway that forwards external device connections to internal services without exposing them directly.
• Implementing a VPN-like proxy layer where multiple clients share a single encrypted multiplexer session with per-connection isolation.
• Protecting against man-in-the-middle attacks on untrusted networks by encrypting both the multiplexer protocol and the forwarded TLS payload.
• Multi-tenant or multi-device scenarios where clients authenticate via Fernet tokens and the server routes traffic based on SNI hostname matching.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

SniTun is an SNI proxy with TCP multiplexer that encrypts traffic end-to-end using Fernet tokens and AES ciphers, forwarding external TLS connections through an encrypted multiplexed channel to local endpoints.

Yes, if you need an encrypted SNI proxy with multiplexing and are comfortable with GPL v3 licensing. The package is production-stable, actively maintained, has low install friction, and no known vulnerabilities. Install only if your project can comply with copyleft terms and your deployment targets Python 3.13+.

Install

snitun on PyPI

pip install snitun

uv add snitun

poetry add snitun

Installing snitun

Before you install

Low install friction with only two runtime dependencies (aiohttp and cryptography). Active maintenance with a recent commit on 2026-08-01 and production-stable status. Requires Python 3.13 or later.

License in practice

Licensed under GPL v3 (copyleft). Any application that links or distributes this package must also be released under a compatible open-source license; proprietary or closed-source projects cannot use it without legal review.

Quickstart

pip install snitun

from snitun.multiplexer import SniTunMultiplexer
from aiohttp import ClientSession

# Typically instantiated within an async context with Fernet token and AES configuration
multiplexer = SniTunMultiplexer(fernet_token, aes_key, aes_iv)

Requires Python 3.13 or later. For aes-gcm-siv cipher support, OpenSSL 3.0+ is required on the server side.

Verify before relying

• Whether the package provides server-side SniTun implementation or only client-side multiplexer components.
• Specific performance characteristics or throughput limits for the multiplexer under typical load.
• Whether session master and token generation are included or must be implemented separately.

Package facts

Evidence: snitun-0.47.0-py3-none-any.whl

Keywords: sni, proxy, multiplexer, tls

Tags

More Python Modules packages