Ligolo-ng is a tunneling and pivoting tool that uses TUN interfaces to establish reverse connections without requiring SOCKS proxies.
The tool solves the problem of network pivoting in penetration testing by creating a userland network stack using Gvisor. Instead of routing traffic through SOCKS proxies or TCP/UDP forwarders, it establishes a TUN interface on the relay server. Packets sent to this interface are translated and transmitted to the remote agent's network. For TCP connections, this means SYN packets are translated to connect() calls on the remote side, with SYN-ACK responses sent on successful connection or RST packets on connection errors. This approach allows standard tools like nmap to work directly without proxychains, improving both simplicity and performance.
Ligolo-ng suits penetration testers and red teamers who need to tunnel through compromised systems without administrative privileges on the agent side. The tool supports multiple platforms for agents and can handle multiple simultaneous tunnels. It offers both reverse and bind connection modes, automatic certificate configuration with Let's Encrypt, and websocket support. The recent addition of a web interface and API enables multiplayer functionality, while daemon mode allows running it as a service. Automatic route and interface management works across Windows, Linux, macOS, and BSD. The README distinguishes it from Ligolo, Chisel, and Meterpreter by emphasizing its TUN interface approach as superior to SOCKS-based alternatives for tool compatibility and performance.
The project shows active development with substantial recent feature additions including the web interface, configuration file support, daemon mode, auto-bind functionality, and automatic route management. Development appears focused on expanding operational capabilities and ease of deployment rather than incremental refinements.
