Chisel
A tool that tunnels TCP and UDP traffic over HTTP, encrypted with SSH, for getting past firewalls.
- Stars
- 16.7k
- Forks
- 1.6k
- Licence
- MIT
- Language
- Go
- Last update
- 26 days ago
- Type
- CLI
What it is
Chisel is a single program that runs as either a server or a client and forwards network connections between them. Its traffic is wrapped in HTTP and encrypted using the SSH protocol, which lets it pass through firewalls and proxies that block other kinds of traffic. The README says it is mainly useful for getting through firewalls, and can also give a secure entry point into a private network.
- Expose a local port (for example 3000) on a remote server through a chisel server
- Forward a remote service to your own machine using a reverse port forward, if the server is started with reverse enabled
- Run a SOCKS5 proxy through the server, if the server is started with socks5 enabled
- Use chisel as a ProxyCommand so ssh can connect through an HTTP path
Great for
- Developers who need to reach a service on a private machine from outside its network
- People on networks that restrict traffic and only allow web-style connections
- Admins who want a simple encrypted entry point into an internal network
- Anyone who wants SSH to work through an HTTP proxy using the stdio ProxyCommand option
Not ideal for
- Users who need a managed, hosted service with support, since this is self-run software with no hosting offered in the README
- Those who need a polished graphical interface, since the README only describes command-line usage
- Anyone unable to run a server they control, because the server side must be hosted somewhere reachable
How to get it
- 1
Install with a package manager
You'll need: Go (only if installing from source)
Install from source with Go
go install github.com/jpillora/chisel@latestFedora install
sudo dnf -y install chisel - 2
Run it
- Start a server with: chisel server --port $PORT --backend http://example.com
- Deploy the server to a host you control, or run it on your own machine
- From another machine, connect a client with: chisel client <server-url> 3000
- Visit the server's address in a browser or use the forwarded port locally
- 3
Get the most out of it
- Set --authfile or --auth so only known users can connect, and anchor address patterns as the README advises
- Pin the server key with --keyfile or --key and share the fingerprint with clients to detect man-in-the-middle attacks
- Use --backend to make the server answer normal web requests with another site, which helps it blend in
- Enable --reverse and --socks5 on the server only when you need those features
Downloads
Strengths
- Single executable containing both client and server
- Encrypted connections via SSH and optional fingerprint checks against man-in-the-middle attacks
- Client reconnects automatically with exponential backoff after network drops
Trade-offs
- Security depends on correct setup: the README notes that authfile patterns are not anchored by default and need care
- Some features such as reverse forwarding and SOCKS5 must be explicitly enabled on the server
- The README describes minimum OS versions and points older systems to an older release
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| chisel (this) | 16.7k | CLI | intermediate | 26 days ago | Developers who need to reach a service on a private machine from outside its network |
| gost | 18.3k | CLI | intermediate | 2 months ago | Developers who want a single binary to run a local or remote SOCKS5 or HTTP proxy |
| bore | 11.6k | CLI | beginner | 9 months ago | Developers who want to share a local web app or API with someone for a quick test |
| croc | 40.8k | CLI | beginner | 4 days ago | People who need to send a file to someone without setting up a server, accounts, or port forwarding |
| kratos | 26k | Library | intermediate | 5 days ago | Go developers building a set of backend services that talk over HTTP or gRPC |
| chi | 23k | Library | intermediate | 19 days ago | Go developers building REST API services |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.