snix

snix

Cross-platform SNI-spoofing DPI-bypass proxy. Single binary. No cgo. Batteries included.

snix tricks DPI censorship systems into accepting your TLS connections by injecting a fake ClientHello with a whitelisted SNI during the TCP handshake. The real TLS handshake then proceeds unobstructed. It is a Go rewrite of patterniha/SNI-Spoofing, expanded with multi-platform backends, anti-fingerprinting, a TUI, and a built-in network scanner.

New here? Read the full walkthrough:

• 🇬🇧 GUIDE.md — zero-to-finish in English.
• 🇮🇷 GUIDE-fa.md — صفر تا صد به فارسی.

Both cover every step from signing up for Cloudflare through a working bypass, including Xray client configs and optional domain setup. Start there if this is the first time you've set up any circumvention tool. The README below is the short reference for everyone else.

Table of contents

• What snix does
• What snix is NOT
• What you need before installing
• Install — Linux
• Install — Windows
• Install — build from source
• First-time setup
• Daily usage
• TUI walkthrough
• CLI reference
• Configuration reference
• Anti-fingerprinting knobs
• Hooking snix into your proxy client
• Troubleshooting
• Relation to patterniha/SNI-Spoofing
• Credits + license
• نسخه فارسی / Persian version

What snix does

[your browser or proxy client]
        │
        ▼
[snix on 127.0.0.1:40443]  ──── at TCP handshake time snix:
        │                         1) observes outbound SYN
        │                         2) observes inbound SYN-ACK
        │                         3) observes outbound ACK
        │                         4) injects a fake TLS ClientHello
        ▼                            with a whitelisted SNI such as
[your upstream proxy server, e.g.    `auth.vercel.com` and a deliberately
 VLESS over Cloudflare on port 443]  wrong TCP sequence number

• The DPI middlebox reads the fake ClientHello first, sees a whitelisted domain (auth.vercel.com), and marks the flow as allowed.
• The real server receives the fake packet too — but because its sequence number is out-of-window (or its checksum is corrupted) the server silently drops it. No connection damage.
• The real TLS handshake to your proxy server then proceeds over the already-whitelisted TCP flow and succeeds.

What snix is NOT

snix is a client-side DPI-bypass layer, not a VPN.

You still need:

• A proxy server somewhere outside the censored network (Xray/VLESS, VMess, Trojan, sing-box, etc.), ideally on port 443 and fronted via a CDN such as Cloudflare.
• A client that speaks that proxy protocol (Xray, v2ray, sing-box, NekoBox, v2rayN, etc.). snix does not speak VLESS/VMess/Trojan yet — that's in the v1.0 roadmap.

snix sits between the client and the internet. Every connection the client opens gets the SNI-spoof treatment.

What you need before installing

1. A proxy server. If you don't have one, the first-run wizard (snix init --wizard) can walk you through deploying a free Cloudflare Worker that acts as your proxy in about 60 seconds.
2. Root / Administrator access on the device you're installing on. Packet interception requires kernel-level filter access on both Linux (NFQUEUE + iptables) and Windows (WinDivert).
3. A TLS-based proxy client already installed. snix is the layer in front; you still need Xray / v2ray / sing-box / NekoBox to speak the proxy protocol itself.

Install — Linux

One-liner (recommended)

curl -fsSL https://get.snix.sh | sudo sh

The script:

1. Detects your distro + architecture.
2. Downloads the signed release tarball from GitHub.
3. Verifies the minisign signature.
4. Places snix into /usr/local/bin.
5. Writes /etc/systemd/system/snix.service (disabled by default).
6. Installs bash + zsh completions.

Then:

sudo snix init --wizard      # create config + pick best SNIs/IPs for your ISP
sudo snix start              # run the engine in your shell, or:
sudo systemctl enable --now snix    # run as a managed service

Manual install

Download from https://github.com/SamNet-dev/snix/releases:

curl -LO https://github.com/SamNet-dev/snix/releases/latest/download/snix-linux-amd64.tar.gz
curl -LO https://github.com/SamNet-dev/snix/releases/latest/download/snix-linux-amd64.tar.gz.minisig

minisign -Vm snix-linux-amd64.tar.gz -P $(cat snix-pubkey.txt)   # verify

tar -xzf snix-linux-amd64.tar.gz
sudo install -m 0755 snix /usr/local/bin/snix

Architectures: amd64, arm64, armv7.

Distribution packages

• Debian/Ubuntu .deb and Fedora/RHEL .rpm ship with each release.
• AUR: yay -S snix-bin.
• Arch: coming soon.

Install — Windows

Installer (recommended)

1. Download snix-setup.exe from https://github.com/SamNet-dev/snix/releases.
2. Right-click → Run as Administrator. Follow the installer.
3. The installer:
   • Puts snix.exe into C:\Program Files\snix\.
   • Bundles WinDivert.dll and WinDivert64.sys alongside it.
   • Adds a Start Menu shortcut that launches the TUI with auto-UAC.
   • Optionally registers a Windows Service for automatic startup.
4. Launch from the Start Menu. First launch shows the wizard.

Portable zip

1. Download snix-windows-amd64.zip, extract anywhere.
2. Open an elevated Command Prompt or PowerShell.
3. cd to the folder, then:

   snix.exe init --wizard
   snix.exe tui
   

The zip contains:

snix-windows-amd64/
  snix.exe
  WinDivert.dll
  WinDivert64.sys
  LICENSE
  README.md

All three files must live in the same directory for snix to find the WinDivert driver.

Install — build from source

git clone https://github.com/SamNet-dev/snix.git
cd snix
go build -o snix ./cmd/snix

Requirements: Go 1.23+, no C toolchain, no other tooling. Cross-compile:

GOOS=linux   GOARCH=amd64 go build -o snix-linux   ./cmd/snix
GOOS=windows GOARCH=amd64 go build -o snix.exe     ./cmd/snix
GOOS=darwin  GOARCH=arm64 go build -o snix-macos   ./cmd/snix

On Windows the engine requires WinDivert. Download v2.2.2 from https://github.com/basil00/Divert/releases/tag/v2.2.2, extract x64/WinDivert.dll and x64/WinDivert64.sys, put them next to the built snix.exe.

First-time setup

Run the wizard:

snix init --wizard

You'll see:

snix first-run wizard

Step 1/5 — Do you have a proxy server already?  (y/n)
> y

Step 2/5 — Paste your server address:
  Host:        my-proxy.example.com
  Port [443]:  443

Step 3/5 — Scanning your network for working SNIs and CDN IPs…
  SNI probes  [████████████████] 55/55  ok=55  reset=0  timeout=0
  IP probes   [████████████████] 20/20  reachable=18

  Top SNIs:
    1. auth.vercel.com           12ms
    2. cdn.segment.io            14ms
    3. static.cloudflareinsights 16ms
  Top IPs:
    1. 104.21.2.17    3ms
    2. 172.65.250.78  3ms

Step 4/5 — Anti-fingerprinting knobs (recommended ON):
  Randomize timing?   (Y/n) y
  Randomize padding?  (Y/n) y
  Strategy rotation?  (Y/n) y

Step 5/5 — Integrate with a proxy client?
  Detected: xray at /usr/local/bin/xray
  Update Xray config to use snix on 127.0.0.1:40443? (y/N) y
  Backup written to ~/.config/xray/config.json.bak
  Done.

Config written to /root/.config/snix/config.yaml
Run `sudo snix start` to launch.

If you said "n" at Step 1, the wizard offers to deploy a Cloudflare Worker:

  You don't have a proxy server yet. snix can deploy one for free on
  Cloudflare in ~60 seconds.

  Deploy Cloudflare Worker? (Y/n) y
  Open this URL in your browser:
    https://dash.cloudflare.com/?to=/:account/workers/services/new?name=snix-<random>
  After deploy completes, paste the Worker URL here:
  > worker-name.username.workers.dev

Daily usage

Two ways to drive snix: the TUI (interactive) or the CLI (scriptable).

TUI

snix tui        # opens full-screen dashboard

Press 1-7 to switch tabs, ? for help, q to quit. See TUI walkthrough.

CLI + systemd (Linux)

sudo systemctl enable --now snix
journalctl -u snix -f            # follow logs
sudo systemctl stop snix

CLI + Services (Windows)

If you chose "Install as Service" during setup:

sc query snix
sc start snix
sc stop snix

Otherwise, launch from the Start Menu shortcut.

TUI walkthrough

Tab 1 — Home

Shows:

• Which config file is loaded.
• How many profiles are defined.
• Which profile is active and its summary (listen, connect, strategy).
• A short explainer of what snix does.

Tab 2 — Profiles

List of profiles. Keys:

Right pane shows full details of the highlighted profile including its SNI pool, randomization settings, and fallback IPs.

Tab 3 — Scan

Probe the network to find which SNIs and CDN IPs work. Keys:

Live progress bars for each scan type. Top-10 leaderboards update as results arrive.

Tab 4 — Run

Starts / stops the bypass engine as a subprocess. Keys:

Engine stdout and stderr are tailed live into the Engine Output panel. Scrollable with ↑↓ / PgUp/PgDn.

Windows: the engine subprocess needs Administrator. If the TUI was launched non-elevated you'll see the missing-privilege error in the log panel; restart the TUI from an elevated shell.

Tab 5 — Settings

Toggle anti-fingerprinting knobs on the active profile. All changes save to disk immediately. Keys:

The right pane explains what the highlighted knob does and why you'd want it.

Tab 6 — Help

Scrollable long-form help: what SNI spoofing is, every keybinding, CLI parity table, troubleshooting.

Tab 7 — About

Version, license, credits, support links.

CLI reference

snix init                     create a starter config at ~/.config/snix/config.yaml
snix init --wizard            interactive first-time setup (recommended)
snix status                   show loaded config + active profile
snix tui                      launch the full interactive TUI
snix start                    run the bypass engine (needs root / admin)
snix start -p NAME            start using a non-active profile
snix scan sni --target IP     probe SNIs against IP (default 1.1.1.1)
snix scan ip                  probe Cloudflare IPs for reachability + RTT
snix scan all                 run both scans and print a ready-to-paste profile
snix profile list             list profiles
snix profile switch NAME      make NAME the active profile
snix update                   upgrade to the latest release (verifies signature)
snix --version                print version
snix --help                   print top-level help

Global flags:

-c, --config PATH    use a non-default config path
-v, --verbose        verbose logging

Configuration reference

Default location:

• Linux / macOS: ~/.config/snix/config.yaml (or $XDG_CONFIG_HOME/snix/config.yaml).
• Windows: %APPDATA%\snix\config.yaml.

Full example with every field:

version: 1

# Which profile to use on `snix start`. Must match one of `profiles[].name`.
active: default

log:
  # debug | info | warn | error
  level: info

profiles:
  - name: default

    # Where snix listens for client connections (Xray, v2ray, etc.).
    listen: "127.0.0.1:40443"

    connect:
      # Your upstream proxy server. Domain or IP.
      host: my-proxy.example.com
      port: 443
      # If `host` fails or its DNS resolution is blocked, snix will try
      # these IPs in order. Useful to pin known-working Cloudflare edges.
      fallback_ips:
        - 104.21.2.17
        - 172.65.250.78

    spoof:
      # Default strategy. Used when `strategy_rotation` is empty.
      # wrong_seq     — inject fake ClientHello with out-of-window seq
      # wrong_checksum — same + corrupted TCP checksum (double-safety)
      strategy: wrong_seq

      # If set (recommended), snix picks a strategy per flow at random
      # from this list. Breaks DPI pattern-matching on packet shape.
      strategy_rotation: [wrong_seq, wrong_checksum]

      # The SNIs snix rotates through when building the fake ClientHello.
      # Run `snix scan sni` to discover which ones work on your ISP.
      sni_pool:
        - auth.vercel.com
        - cdn.segment.io
        - static.cloudflareinsights.com

      # random (default): uniform random pick per flow
      # round_robin: deterministic cycle
      sni_selection: random

      # Jitters the delay between the real ACK and the fake ClientHello.
      # Defeats timing-based DPI fingerprints.
      randomize_timing: true
      min_delay: 500us
      max_delay: 5ms

      # Varies the ClientHello packet length so it's not always 517 bytes.
      randomize_padding: true
      min_extra_pad: 0
      max_extra_pad: 600

      # Random offset applied to the fake packet's IP identification
      # field. 1 = upstream behaviour (always +1). Higher = more variance.
      ip_id_delta_range: 64

    health:
      # Background probe interval (not yet wired to auto-failover).
      interval: 30s
      auto_failover: true

Defaults (if you omit the field):

Anti-fingerprinting knobs

Why each knob matters:

• randomize_timing — upstream emits the fake ClientHello exactly 1 ms after the final ACK. A DPI watching for "ACK immediately followed by 517-byte PSH packet with specific seq pattern" can flag this. Random jitter in [500 µs, 5 ms] makes the timing an uninteresting noise field.
• randomize_padding — upstream's fake ClientHello is always 517 bytes. With randomize_padding: true + max_extra_pad: 600, snix emits packets in [517, 1117] bytes. Removes a trivially fingerprintable invariant.
• strategy_rotation — wrong_seq alone always produces the same shape (valid TLS, valid checksum, wildly wrong seq). Rotating with wrong_checksum means half of your connections have valid seq + invalid checksum instead. Two different shapes to pattern-match means twice the DPI engineering required to catch you.
• ip_id_delta_range — upstream always sets the fake packet's IPv4 ident field to ack_packet.ident + 1. A range of 64 scatters the delta uniformly in [1, 64], removing the predictable tell.
• sni_selection: random — round-robin is deterministic; random makes per-flow SNI choice unrelated to flow order.

Recommended for production:

spoof:
  strategy_rotation: [wrong_seq, wrong_checksum]
  sni_pool: [... at least 3 SNIs ...]
  sni_selection: random
  randomize_timing: true
  min_delay: 500us
  max_delay: 5ms
  randomize_padding: true
  max_extra_pad: 600
  ip_id_delta_range: 64

Hooking snix into your proxy client

Point your proxy client's outbound at 127.0.0.1:40443. Every proxy stack works slightly differently; quick notes:

Xray / v2ray

In your config.json, under outbounds[0].settings.vnext[0].address (or equivalent), replace your real proxy server address with "127.0.0.1" and port 40443. Then in snix's config put the real server in connect.host + connect.port.

snix's wizard can edit this for you: snix init --wizard → Step 5.

sing-box

Same concept: set the server field of your outbound to "127.0.0.1" and server_port: 40443. snix handles the actual TLS.

NekoBox / v2rayN

Import your existing profile, then edit the node's address → 127.0.0.1, port → 40443.

SOCKS5-ready clients (browsers, curl)

snix doesn't currently expose SOCKS5; it's a transparent TCP relay. Use Xray or sing-box to expose SOCKS5 on a different port, with snix as the outbound address.

Troubleshooting

"No config loaded" on the Home screen → Run snix init or snix init --wizard to create one. Check snix status to see where it's looking.

ERROR_ACCESS_DENIED (run as Administrator) on Windows → Launch from an elevated shell. The TUI does a pre-check and prints snix/windows: process is not running elevated; relaunch elevated.

WinDivert.dll not loadable on Windows → The DLL and driver must be in the same folder as snix.exe, or on %PATH%. If you used the installer, this is automatic. For portable usage, keep all three files together.

Scan reports "0 OK" in Scan → SNI → Try a different --target. The default 1.1.1.1 accepts any SNI because Cloudflare DNS has a universal default cert. Other edge IPs only serve their own customers' domains. If even 1.1.1.1 shows resets, your ISP may be blocking raw TLS handshakes at the TCP layer — use the --target of a known-working proxy IP instead.

snix start succeeds but the proxy client can't reach anything → Verify your proxy server is actually reachable without DPI first (try curl -vk --resolve myserver:443:YOUR_IP https://myserver/ on a network without DPI). If that works, turn on snix's --verbose and watch the log for snix: injected ... lines. No injection log = client isn't hitting 127.0.0.1:40443; misconfigured proxy client.

Connection works for 30 seconds, then drops → Some ISPs use flow-based classifiers that catch unusual patterns later. Enable full anti-fingerprinting (all three knobs) and restart.

Real traffic stalls when strategy_rotation: [wrong_seq, wrong_checksum] → Shouldn't happen in this release; we always pair wrong_checksum with out-of-window seq. If it does, remove wrong_checksum from rotation and file an issue with the tcpdump from the failing flow.

High CPU under load → Expected at this version (we don't yet use splice() on Linux or TransmitFile on Windows). v0.8 brings a zero-copy relay.

How do I uninstall?

• Linux: sudo rm /usr/local/bin/snix /etc/systemd/system/snix.service
• Windows: Control Panel → Apps → snix → Uninstall.

How do I update?

• snix update auto-upgrades to the latest release (signature verified).
• Or re-run the installer; it's safe to overwrite.

Where are the logs?

• When run via snix start: stdout/stderr.
• When run via systemd: journalctl -u snix.
• When run via Windows Service: Event Viewer → Application logs.
• TUI Run tab: in-memory tail (not persistent).

Relation to patterniha/SNI-Spoofing

snix is a Go rewrite of patterniha/SNI-Spoofing. That project discovered and implemented the wrong-seq bypass technique that makes everything here possible. If you like snix, please star their repo too. This project would not exist without their work.

Our bypass engine is byte-for-byte identical to theirs for the core trick: the fake ClientHello, the wrong TCP sequence number, the timing, and the state machine all produce wire-identical packets. That parity is locked in with a golden test that regenerates reference bytes from the upstream Python and fails any build that diverges.

On top of that identical foundation we add:

Design decision: we never remove a capability that upstream has. You can run snix with every randomization knob turned OFF and the engine behaves exactly like patterniha/SNI-Spoofing: same packet on the wire, same timing, same state transitions. The randomization layer is additive.

Where we are stricter than upstream: we narrow the packet filter to the exact IP+port pair instead of just the host, so unrelated traffic never gets pulled into the bypass engine. Where we are more permissive than upstream: we don't tear down a connection when we see an unexpected packet. We skip the bypass for that flow but let the connection continue. Both are safety improvements that don't change the core behaviour.

If you want the smaller, simpler, Windows-only Python version, go use the upstream. If you want the same bypass as a single signed binary on Linux and Windows, with a wizard, a scanner, and a TUI, that's snix.

Credits + license

• Upstream algorithm + first implementation: patterniha — this project would not exist without their work. The core wrong-seq bypass is theirs; everything else here is a cross-platform rewrite and expansion.
• WinDivert by Basil Fierz — the signed kernel driver we use on Windows.
• Bubble Tea and Lipgloss — the TUI framework.
• Linux kernel netfilter team — for NFQUEUE.

Support the upstream author:

USDT (BEP20): 0x76a768B53Ca77B43086946315f0BDF21156bF424
Telegram:     @patterniha

License: GPL-3.0. Matches upstream. See LICENSE.

Community

• GitHub Discussions: https://github.com/SamNet-dev/snix/discussions
• Issues: https://github.com/SamNet-dev/snix/issues
• Telegram: (link once channel exists)

snix — نسخهٔ فارسی

[مرورگر یا کلاینتِ پروکسیِ شما]
        │
        ▼
[snix روی 127.0.0.1:40443] ─── در لحظهٔ دست‌دادنِ TCP:
        │                       ۱) بستهٔ SYNِ خروجی را رصد می‌کند
        │                       ۲) بستهٔ SYN-ACKِ ورودی را رصد می‌کند
        │                       ۳) بستهٔ ACKِ خروجی را رصد می‌کند
        │                       ۴) یک ClientHelloِ جعلی تزریق می‌کند
        ▼                         با SNIِ مجاز مثلِ `auth.vercel.com`
[سرورِ پروکسیِ شما، مثلِ          و با شمارهٔ توالیِ TCPِ عمداً غلط
 VLESS پشتِ Cloudflare رویِ ۴۴۳]

curl -fsSL https://get.snix.sh | sudo sh

sudo snix init --wizard      # ساختِ پیکربندی + پیدا کردنِ بهترین SNI/IP
sudo snix start              # اجرایِ موتور در همین شلِ جاری، یا:
sudo systemctl enable --now snix    # اجرا به‌صورتِ سرویسِ مدیریت‌شده

curl -LO https://github.com/SamNet-dev/snix/releases/latest/download/snix-linux-amd64.tar.gz
curl -LO https://github.com/SamNet-dev/snix/releases/latest/download/snix-linux-amd64.tar.gz.minisig

minisign -Vm snix-linux-amd64.tar.gz -P $(cat snix-pubkey.txt)   # بررسیِ امضا

tar -xzf snix-linux-amd64.tar.gz
sudo install -m 0755 snix /usr/local/bin/snix

snix.exe init --wizard
snix.exe tui

snix-windows-amd64/
  snix.exe
  WinDivert.dll
  WinDivert64.sys
  LICENSE
  README.md

git clone https://github.com/SamNet-dev/snix.git
cd snix
go build -o snix ./cmd/snix

GOOS=linux   GOARCH=amd64 go build -o snix-linux   ./cmd/snix
GOOS=windows GOARCH=amd64 go build -o snix.exe     ./cmd/snix
GOOS=darwin  GOARCH=arm64 go build -o snix-macos   ./cmd/snix

snix init --wizard

snix first-run wizard

گامِ ۱ از ۵ — آیا از قبل سرورِ پروکسی دارید؟  (y/n)
> y

گامِ ۲ از ۵ — آدرسِ سرور را وارد کنید:
  Host:        my-proxy.example.com
  Port [443]:  443

گامِ ۳ از ۵ — در حالِ اسکنِ شبکه برای SNI و IPهایِ کارآمد…
  SNI probes  [████████████████] 55/55  ok=55  reset=0  timeout=0
  IP probes   [████████████████] 20/20  reachable=18

گامِ ۴ از ۵ — کلیدهایِ ضد-اثرانگشت (پیشنهاد: فعال):
  Randomize timing?   (Y/n) y
  Randomize padding?  (Y/n) y
  Strategy rotation?  (Y/n) y

گامِ ۵ از ۵ — ادغام با کلاینتِ پروکسی؟
  شناسایی شد: xray در /usr/local/bin/xray
  آیا تنظیماتِ Xray برایِ استفاده از snix تغییر کند؟ (y/N) y
  نسخهٔ پشتیبان در ~/.config/xray/config.json.bak
  انجام شد.

پیکربندی در /root/.config/snix/config.yaml ذخیره شد.
برای اجرا: `sudo snix start`

  هنوز سرورِ پروکسی ندارید. snix می‌تواند یک سرورِ رایگان رویِ
  Cloudflare در حدودِ ۶۰ ثانیه برایتان بسازد.

  آیا Cloudflare Worker مستقر شود؟ (Y/n) y
  این آدرس را در مرورگر باز کنید:
    https://dash.cloudflare.com/?to=/:account/workers/services/new?name=snix-<random>
  پس از اتمام، آدرسِ Worker را اینجا جای‌گذاری کنید:
  > worker-name.username.workers.dev

snix tui

sudo systemctl enable --now snix
journalctl -u snix -f
sudo systemctl stop snix

sc query snix
sc start snix
sc stop snix

snix init                     ساختِ پیکربندیِ اولیه
snix init --wizard            راه‌اندازیِ تعاملی (توصیه‌شده)
snix status                   نمایشِ پیکربندیِ بارگذاری‌شده و profileِ فعال
snix tui                      اجرایِ TUIِ کامل
snix start                    اجرایِ موتور (نیازمند root/admin)
snix start -p NAME            اجرا با profileِ غیرفعال
snix scan sni --target IP     اسکنِ SNI
snix scan ip                  اسکنِ IPهایِ Cloudflare
snix scan all                 اسکنِ کامل و چاپِ پیکربندیِ آماده
snix profile list             فهرستِ profileها
snix profile switch NAME      تغییرِ profileِ فعال
snix update                   ارتقا به آخرین نسخه

spoof:
  strategy_rotation: [wrong_seq, wrong_checksum]
  sni_pool: [... دستِ‌کم ۳ SNI ...]
  sni_selection: random
  randomize_timing: true
  min_delay: 500us
  max_delay: 5ms
  randomize_padding: true
  max_extra_pad: 600
  ip_id_delta_range: 64

USDT (BEP20): 0x76a768B53Ca77B43086946315f0BDF21156bF424
Telegram:     @patterniha