All Nodes
This page is a quick inventory of the public configurable WaterWall nodes found in the current source tree. Use the dedicated node page for exact settings, lifecycle behavior, and examples.
Basic Reading Guide
- Listener and device nodes usually sit at the edge of a chain and create or receive traffic.
- Connector nodes usually sit at the outbound edge and connect to an external endpoint.
- Packet nodes carry raw IP packets or datagram-like packet buffers, not ordinary TCP byte streams.
- Bridge nodes cross between packet and stream models or between separate chain branches.
- Most
Client/Serverprotocol pairs must be configured on opposite sides of the path.
Public Configurable Nodes
| Node | Main use | Common placement |
|---|---|---|
AuthenticationClient | Attaches authenticated user identity or credentials for authentication-aware server-side nodes. | Before an authentication-aware server/protocol node. |
AuthenticationServer | Authenticates incoming identities and controls accepted users. | Server-side chain before protected traffic. |
Bgp4Client | Client side of the BGP4-style tunnel pair. | Paired with Bgp4Server. |
Bgp4Server | Server side of the BGP4-style tunnel pair. | Paired with Bgp4Client. |
BlackHole | Terminal sink adapter that drops payload or rejects traffic for blocking and tests. | End of a policy/test chain. |
Bridge | Connects two independent chain branches inside one config. | Usually used as a named pair/branch join. |
ConnectionFisherClient | Opens or races multiple client-side paths and keeps the useful connection. | Paired with ConnectionFisherServer. |
ConnectionFisherServer | Server side for ConnectionFisher paths. | Paired with ConnectionFisherClient. |
Disturber | Simulates loss, delay, or corruption for testing. | Test chains. |
DomainResolver | Advanced support node that resolves dest_ctx domains before forwarding Init. | Usually created internally by connector/router/client nodes. |
EncryptionClient | Client-side AEAD framing/encryption. | Paired with EncryptionServer. |
EncryptionServer | Server-side AEAD framing/decryption. | Paired with EncryptionClient. |
HalfDuplexClient | Splits or coordinates half-duplex upload/download behavior. | Paired with HalfDuplexServer. |
HalfDuplexServer | Server side of the half-duplex tunnel pair. | Paired with HalfDuplexClient. |
HeaderClient | Prepends a one-time WaterWall port header or IPv4 PROXY protocol header. | Paired with HeaderServer for WaterWall headers, HeaderServer PROXY source mode, or before a PROXY-aware backend. |
HeaderServer | Consumes a WaterWall port header, reads IPv4 PROXY source fields, or applies a constant destination port. | Paired with HeaderClient or placed behind a trusted PROXY sender. |
HttpClient | Wraps payload in HTTP, HTTP/2, h2c, custom upgrade, split HTTP, or WebSocket client framing. | Before TlsClient for HTTPS, or before a transport node for cleartext HTTP. |
HttpServer | Parses HTTP/WebSocket server-side framing and forwards body payload. | After TlsServer for HTTPS, or after a listener for cleartext HTTP. |
IpManipulator | Applies packet-level TCP/TLS/SNI manipulation tricks. | Packet chains. |
IpOverrider | Rewrites source/destination IP or port fields in packet traffic. | Packet chains. |
JunkDatagramSender | Sends extra datagrams according to configured modules/policies. | Packet or UDP-oriented evasion/test paths. |
KeepAliveClient | Sends keepalive/heartbeat data to detect broken paths. | Paired with KeepAliveServer. |
KeepAliveServer | Server side of keepalive/heartbeat handling. | Paired with KeepAliveClient. |
LoggerTunnel | Logs or dumps payload without modifying chain behavior. | Anywhere suitable for debugging. |
MuxClient | Multiplexes many logical lines over shared transport connections. | Paired with MuxServer. |
MuxServer | Demultiplexes logical lines from MuxClient. | Paired with MuxClient. |
ObfuscatorClient | Client-side lightweight payload obfuscation. | Paired with ObfuscatorServer. |
ObfuscatorServer | Server-side deobfuscation/obfuscation counterpart. | Paired with ObfuscatorClient. |
PacketReceiver | Receives packet traffic for source-IP discovery in restricted environments. | Packet/IP discovery chains. |
PacketSender | Sends packet traffic for source-IP discovery or packet-path tests. | Packet/IP discovery chains. |
PacketSplitStream | Splits mixed packet/stream behavior across packet and stream sides. | Packet/stream boundary chains. |
PacketsToConnection | Converts packet traffic through lwIP into normal WaterWall connection lines. | Packet-to-stream bridge. |
PacketsToStream | Carries raw IPv4 packet boundaries over a stream-facing line. | Paired with StreamToPackets. |
PingClient | Encapsulates packet payload into IPv4 ICMP-style traffic. | Packet chains, paired with PingServer. |
PingServer | Decapsulates the packet payload from the Ping tunnel direction. | Packet chains, paired with PingClient. |
RawSocket | Sends and receives raw IP packets. | Packet edge. |
RealityClient | Performs a visitor TLS handshake, then sends Reality-authenticated payload in TLS-like records. | Client side, before a transport to RealityServer. |
RealityServer | Routes ordinary visitor traffic to a destination and switches authenticated Reality clients to protected next. | Server side after a listener. |
ReverseClient | Builds the client side of a reverse tunnel for NAT/firewall traversal. | Paired with ReverseServer. |
ReverseServer | Server side of reverse tunnel coordination. | Paired with ReverseClient. |
Router | Routes lines by context, filters, or rule branches. | Middle of complex chains. |
SniffRouter | Routes by sniffed traffic metadata. | Middle of sniffing/routing chains. |
Socks5Client | Speaks to an upstream SOCKS5 server. | Before a transport/proxy destination. |
Socks5Server | Accepts SOCKS5 client requests and forwards accepted traffic. | After a listener or TLS/protocol wrapper. |
SoftIpLimiter | Limits how many source IPs may concurrently use the same early VLESS UUID or Trojan SHA224 identity. | Before VlessServer or TrojanServer, after any TLS/protocol wrapper. |
SpeedLimit | Applies throughput limiting. | Middle of a chain. |
SpeedTestClient | Generates speed-test traffic. | Test chains, paired with SpeedTestServer. |
SpeedTestServer | Responds to speed-test traffic. | Test chains, paired with SpeedTestClient. |
StreamToPackets | Reconstructs IPv4 packets from a stream-facing line. | Paired with PacketsToStream. |
TcpConnector | Opens outbound TCP connections. | Chain end. |
TcpListener | Accepts inbound TCP connections and creates normal lines. | Chain head. |
TcpOverUdpClient | Carries stream-like TCP data over UDP-style packet transport. | Paired with TcpOverUdpServer. |
TcpOverUdpServer | Server side of TCP-over-UDP handling. | Paired with TcpOverUdpClient. |
TcpUdpConnector | Combines TCP and UDP connector behavior behind one node. | Chain end for mixed TCP/UDP routing. |
TcpUdpListener | Combines TCP and UDP listener behavior behind one node. | Chain head for mixed TCP/UDP entry. |
TesterClient | Generates deterministic validation traffic and verifies responses. | Test chain head. |
TesterServer | Responds to deterministic tester traffic. | Test chain end. |
TlsClient | Performs real client-side TLS and carries encrypted TLS records. | Before TcpConnector or another transport. |
TlsServer | Performs real server-side TLS termination. | After TcpListener and before cleartext protocol nodes. |
TrojanClient | Writes Trojan client request/auth framing. | Paired with TrojanServer, usually inside TLS. |
TrojanServer | Parses and authenticates Trojan client traffic. | Paired with TrojanClient, usually inside TLS. |
TunDevice | Reads and writes packets through an operating-system TUN device. | Packet edge. |
UdpConnector | Sends outbound UDP traffic, with optional destination selection/resolution. | Chain end. |
UdpListener | Accepts UDP peers and creates stateful lines per peer. | Chain head. |
UdpOverTcpClient | Carries UDP-style packets over stream transport. | Paired with UdpOverTcpServer. |
UdpOverTcpServer | Server side of UDP-over-TCP handling. | Paired with UdpOverTcpClient. |
UdpStatelessSocket | Sends/receives UDP datagrams using routing context instead of per-peer lines. | UDP packet edge, often with WireGuardDevice. |
UserController | Advanced support node that enforces authenticated-user limits through AuthenticationClient. | Usually created internally by authenticated server nodes. |
VlessClient | Writes plain VLESS v0 client request framing. | Paired with VlessServer, often inside TLS/Reality transport. |
VlessServer | Parses and authenticates plain VLESS v0 traffic. | Paired with VlessClient. |
WireGuardDevice | Implements in-chain WireGuard crypto, peer state, and allowed-IP routing. | Between packet side and UdpStatelessSocket. |
Scaffold Node Type
This node type exists in source but is not a normal user-facing tunnel doc:
| Node | Role |
|---|---|
Template | Developer scaffold for creating new tunnels. |
Choosing A Starting Chain
- Simple TCP proxy:
TcpListener -> ... -> TcpConnector - Stateful UDP proxy:
UdpListener -> ... -> UdpConnector - Stateless UDP packet edge:
UdpStatelessSocket -> ... - Full IP tunnel:
TunDevice -> ... -> TunDevice - WireGuard-style packet transport:
TunDevice -> WireGuardDevice -> UdpStatelessSocket - Packet over stream bridge:
PacketsToStreamon one side andStreamToPacketson the other - Multiplexed stream transport:
MuxClienton one side andMuxServeron the other - HTTPS-looking transport:
HttpClient -> TlsClient -> TcpConnector, withTlsServer -> HttpServeron the server side - Reality-style visitor/protected split:
RealityClienttowardRealityServer, withRealityServer.settings.destinationpointing to the visitor branch