Chisel is a fast TCP/UDP tunnel transported over HTTP, secured via SSH.
Chisel solves the problem of accessing services behind firewalls or restrictive network boundaries by tunneling traffic over HTTP, which is typically allowed through most firewalls. The tool works by establishing an encrypted SSH connection over HTTP between a client and server, allowing both TCP and UDP traffic to pass through. It runs as a single executable that includes both client and server components, written in Go for cross-platform compatibility. The approach supports multiple tunnel endpoints over a single connection, client auto-reconnection with exponential backoff to handle network interruptions, and keepalive detection to identify silently dead connections.
Chisel suits scenarios where you need secure network access through restrictive firewalls or want to provide a secure endpoint into your network. It is particularly useful for penetration testing, remote access, and network debugging. The tool supports several deployment patterns: clients can pass through SOCKS or HTTP CONNECT proxies, servers can function as reverse proxies, and reverse port forwarding allows connections to flow through the server and out the client. SOCKS5 support is available on both client and server sides. For SSH users, the tool supports connections over stdio with ProxyCommand integration. Binaries are available for Windows, macOS, Linux, and FreeBSD, with Docker images provided for containerized deployments.
The project maintains active development with regular updates and bug fixes. The maintainers respond to issues and pull requests, indicating ongoing engagement with the user community. Documentation is kept current with usage examples and deployment guides, including a demonstration setup for fly.io. The codebase remains focused on core tunneling functionality without feature bloat, and performance is tracked through benchmarking documentation.
