Brook

A cross-platform programmable network tool.

Sponsor

❤️ Shiliew - China Optimized Network App

Getting Started

Server

bash <(curl https://bash.ooo/nami.sh)
nami install brook
brook server -l :9999 -p hello

GUI Client

iOS Android Mac Windows Linux OpenWrt
Windows OpenWrt
/ / App Mode How How How

CLI Client

brook client -s 1.2.3.4:9999 -p hello --socks5 127.0.0.1:1080

GUI Documentation

Software for which this article applies

Programmable

Brook GUI will pass different global variables to the script at different times, and the script only needs to assign the processing result to the global variable out

Introduction to incoming variables

variable type condition timing description out type
in_brooklinks map / Before connecting Predefine multiple brook links, and then programmatically specify which one to connect to map
in_dnsquery map FakeDNS: On When a DNS query occurs Script can decide how to handle this request map
in_address map / When connecting to an address script can decide how to connect map
in_httprequest map / When an HTTP(S) request comes in the script can decide how to handle this request map
in_httprequest,in_httpresponse map / when an HTTP(S) response comes in the script can decide how to handle this response map
Key Type Description Example
_ bool meaningless true

out, ignored if not of type map

Key Type Description Example
... ... ... ...
custom name string brook link brook://...
... ... ... ...

in_dnsquery

Key Type Description Example
domain string domain name google.com
type string query type A
appid string App ID or path com.google.Chrome.helper
interface string network interface. Mac only en0

out, if it is error type will be recorded in the log. Ignored if not of type map

Key Type Description Example
block bool Whether Block, default false false
ip string Specify IP directly, only valid when type is A/AAAA 1.2.3.4
system bool Resolve by System DNS, default false false
bypass bool Resolve by Bypass DNS, default false false
brooklinkkey string When need to connect the Server,instead, connect to the Server specified by the key in_brooklinks custom name

in_address

Key Type Description Example
network string Network type, the value tcp/udp tcp
ipaddress string IP type address. There is only of ipaddress and domainaddress. Note that there is no relationship between these two 1.2.3.4:443
domainaddress string Domain type address, because of FakeDNS we can get the domain name address here google.com:443
appid string App ID or path com.google.Chrome.helper
interface string network interface. Mac only en0

out, if it is error type will be recorded in the log. Ignored if not of type map

Key Type Description Example
block bool Whether Block, default false false
ipaddress string IP type address, rewrite destination 1.2.3.4:443
ipaddressfrombypassdns string Use Bypass DNS to obtain A or AAAA IP and rewrite the destination, only valid when domainaddress exists, the value A/AAAA A
bypass bool Bypass, default false. If true and domainaddress, then ipaddress or ipaddressfrombypassdns must be specified false
mitm bool Whether to perform MITM, default false. Only valid when network is tcp. Need to install CA, see below false
mitmprotocol string MITM protocol needs to be specified explicitly, the value is http/https https
mitmcertdomain string The MITM certificate domain name, which is taken from domainaddress by default. If ipaddress and mitm is true and mitmprotocol is https then must be must be specified explicitly example.com
mitmwithbody bool Whether to manipulate the http body, default false. will read the body of the request and response into the memory and interact with the script. iOS 50M total memory limit may kill process false
mitmautohandlecompress bool Whether to automatically decompress the http body when interacting with the script, default false false
mitmclienttimeout int Timeout for MITM talk to server, second, default 0 0
mitmserverreadtimeout int Timeout for MITM read from client, second, default 0 0
mitmserverwritetimeout int Timeout for MITM write to client, second, default 0 0
brooklinkkey string When need to connect the Server,instead, connect to the Server specified by the key in_brooklinks custom name

in_httprequest

Key Type Description Example
URL string URL https://example.com/hello
Method string HTTP method GET
Body bytes HTTP request body /
... string other fields are HTTP headers /

out, must be set to a request or response

in_httpresponse

Key Type Description Example
StatusCode int HTTP status code 200
Body bytes HTTP response body /
... string other fields are HTTP headers /

out, must be set to a response

Write script

Tengo Language Syntax

Library

Debug script

It is recommended to use tun2brook on desktop to debug with fmt.println

Install CA

https://txthinking.github.io/ca/ca.pem

OS How
iOS https://www.youtube.com/watch?v=HSGPC2vpDGk
Android Android has user CA and system CA, must be installed in the system CA after ROOT
macOS nami install mad ca.txthinking, sudo mad install --ca ~/.nami/bin/ca.pem
Windows nami install mad ca.txthinking, Admin: mad install --ca ~/.nami/bin/ca.pem

Some software may not read the system CA,you can use curl --cacert ~/.nami/bin/ca.pem to debug

Resources

CLI Description
nami A clean and tidy decentralized package manager
joker Joker can turn process into daemon. Zero-Configuration
nico Nico can work with brook wsserver together
zhen zhen - process and cron manager
tun2brook Proxy all traffic just one line command
mad Generate root CA and derivative certificate for any domains and any IPs
hancock Manage multiple remote servers and execute commands remotely
sshexec A command-line tool to execute remote command through ssh
jb write script in an easier way than bash
bash Many one-click scripts
pacman pacman -S brook
brew brew install brook
docker docker run txthinking/brook
Resources Description
Protocol Brook Protocol
Blog Some articles you should read
YouTube Some videos you should watch
Telegram Ask questions here
Announce All news you should care
GitHub Other useful repos
Socks5 Configurator If you prefer CLI brook client
IPvBar See domain, IP and country in browser
TxThinking SSH A SSH Terminal
Brook Deploy Deploy brook with GUI
brook-manager Brook Manager is a Brook management system for medium to large merchants
TxThinking Everything

CLI Documentation

NAME

Brook - A cross-platform programmable network tool

SYNOPSIS

Brook

brook --help

Usage:

Brook [GLOBAL OPTIONS] command [COMMAND OPTIONS] [ARGUMENTS...]

GLOBAL OPTIONS

COMMANDS

server

Run as brook server, both TCP and UDP

client

Run as brook client, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook client <-> $ brook server <-> dst]

wsserver

Run as brook wsserver, both TCP and UDP, it will start a standard http server and websocket server

wsclient

Run as brook wsclient, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook wsclient <-> $ brook wsserver <-> dst]

wssserver

Run as brook wssserver, both TCP and UDP, it will start a standard https server and websocket server

wssclient

Run as brook wssclient, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook wssclient <-> $ brook wssserver <-> dst]

quicserver

Run as brook quicserver, both TCP and UDP

quicclient

Run as brook quicclient, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook quicclient <-> $ brook quicserver <-> dst]. (Note that the global dial parameter is ignored now)

relayoverbrook

Run as relay over brook, both TCP and UDP, this means access [from address] is equal to [to address], [src <-> from address <-> $ brook server/wsserver/wssserver/quicserver <-> to address]

dnsserveroverbrook

Run as dns server over brook, both TCP and UDP, [src <-> $ brook dnserversoverbrook <-> $ brook server/wsserver/wssserver/quicserver <-> dns] or [src <-> $ brook dnsserveroverbrook <-> dnsForBypass]

Generate brook link

connect

Run as client and connect to brook link, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook connect <-> $ brook server/wsserver/wssserver/quicserver <-> dst]

relay

Run as standalone relay, both TCP and UDP, this means access [from address] is equal to access [to address], [src <-> from address <-> to address]

dnsserver

Run as standalone dns server

dnsclient

Send a dns query

dohserver

Run as standalone doh server

dohclient

Send a dns query

dhcpserver

Run as standalone dhcp server. Note that you need to stop other dhcp servers, if there are.

socks5

Run as standalone standard socks5 server, both TCP and UDP

socks5tohttp

Convert socks5 to http proxy, [src <-> listen address(http proxy) <-> socks5 address <-> dst]

pac

Run as PAC server or save PAC to file

testsocks5

Test UDP and TCP of socks5 server

testbrook

Test UDP and TCP of brook server/wsserver/wssserver/quicserver. (Note that the global dial parameter is ignored now)

echoserver

Echo server, echo UDP and TCP address of routes

echoclient

Connect to echoserver, echo UDP and TCP address of routes

ipcountry

Get country of IP

completion

Generate shell completions

mdpage

Generate markdown page

help, h

Shows a list of commands or help for one command

manpage

Generate man.1 page

help, h

Shows a list of commands or help for one command

Examples

List some examples of common scene commands, pay attention to replace the parameters such as IP, port, password, domain name, certificate path, etc. in the example by yourself

Run brook server

brook server --listen :9999 --password hello

then

or get brook link

brook link --server 1.2.3.4:9999 --password hello --name 'my brook server'

or get brook link with --udpovertcp

brook link --server 1.2.3.4:9999 --password hello --udpovertcp --name 'my brook server'

Run brook wsserver

brook wsserver --listen :9999 --password hello

then

or get brook link

brook link --server ws://1.2.3.4:9999 --password hello --name 'my brook wsserver'

or get brook link with domain, even if that's not your domain

brook link --server ws://hello.com:9999 --password hello --address 1.2.3.4:9999 --name 'my brook wsserver'

Run brook wssserver: automatically certificate

Make sure your domain has been resolved to your server IP successfully. Automatic certificate issuance requires the use of port 80

brook wssserver --domainaddress domain.com:443 --password hello

then

or get brook link

brook link --server wss://domain.com:443 --password hello --name 'my brook wssserver'

Run brook wssserver Use a certificate issued by an existing trust authority

Make sure your domain has been resolved to your server IP successfully

brook wssserver --domainaddress domain.com:443 --password hello --cert /root/cert.pem --certkey /root/certkey.pem

then

or get brook link

brook link --server wss://domain.com:443 --password hello --name 'my brook wssserver'

Run brook wssserver issue untrusted certificates yourself, any domain

Install mad

nami install mad

Generate root ca

mad ca --ca /root/ca.pem --key /root/cakey.pem

Generate domain cert by root ca

mad cert --ca /root/ca.pem --ca_key /root/cakey.pem --cert /root/cert.pem --key /root/certkey.pem --domain domain.com

Run brook

brook wssserver --domainaddress domain.com:443 --password hello --cert /root/cert.pem --certkey /root/certkey.pem

get brook link with --insecure

brook link --server wss://domain.com:443 --password hello --name 'my brook wssserver' --address 1.2.3.4:443 --insecure

or get brook link with --ca

brook link --server wss://domain.com:443 --password hello --name 'my brook wssserver' --address 1.2.3.4:443 --ca /root/ca.pem

withoutBrookProtocol

Better performance, but data is not strongly encrypted using Brook protocol. So please use certificate encryption, and it is not recommended to use --withoutBrookProtocol and --insecure together

withoutBrookProtocol automatically certificate

Make sure your domain has been resolved to your server IP successfully. Automatic certificate issuance requires the use of port 80

brook wssserver --domainaddress domain.com:443 --password hello --withoutBrookProtocol

get brook link

brook link --server wss://domain.com:443 --password hello --withoutBrookProtocol

withoutBrookProtocol Use a certificate issued by an existing trust authority

Make sure your domain has been resolved to your server IP successfully

brook wssserver --domainaddress domain.com:443 --password hello --cert /root/cert.pem --certkey /root/certkey.pem --withoutBrookProtocol

get brook link

brook link --server wss://domain.com:443 --password hello --name 'my brook wssserver' --withoutBrookProtocol

withoutBrookProtocol issue untrusted certificates yourself, any domain

Install mad

nami install mad

Generate root ca

mad ca --ca /root/ca.pem --key /root/cakey.pem

Generate domain cert by root ca

mad cert --ca /root/ca.pem --ca_key /root/cakey.pem --cert /root/cert.pem --key /root/certkey.pem --domain domain.com

Run brook wssserver

brook wssserver --domainaddress domain.com:443 --password hello --cert /root/cert.pem --certkey /root/certkey.pem --withoutBrookProtocol

Get brook link

brook link --server wss://domain.com:443 --password hello --withoutBrookProtocol --address 1.2.3.4:443 --ca /root/ca.pem

Run brook socks5, A stand-alone standard socks5 server

brook socks5 --listen :1080 --socks5ServerIP 1.2.3.4

then

or get brook link

brook link --server socks5://1.2.3.4:1080

Run brook socks5 with username and password. A stand-alone standard socks5 server

brook socks5 --listen :1080 --socks5ServerIP 1.2.3.4 --username hello --password world

then

or get brook link

brook link --server socks5://1.2.3.4:1080 --username hello --password world

brook relayoverbrook can relay a local address to a remote address over brook, both TCP and UDP, it works with brook server wsserver wssserver.

brook relayoverbrook ... --from 127.0.0.1:5353 --to 8.8.8.8:53

brook dnsserveroverbrook can create a encrypted DNS server, both TCP and UDP, it works with brook server wsserver wssserver.

brook dnsserveroverbrook ... --listen 127.0.0.1:53

Brook OpenWRT Router: Perfectly supports IPv4/IPv6/TCP/UDP. Native IPv6

https://www.txthinking.com/talks/articles/brook-openwrt-en.article

Turn macOS into a Gateway with Brook

https://www.txthinking.com/talks/articles/brook-macos-gateway-en.article

Turn Windows into a Gateway with Brook

https://www.txthinking.com/talks/articles/brook-windows-gateway-en.article

Turn Linux into a Gateway with Brook

https://www.txthinking.com/talks/articles/brook-linux-gateway-en.article

brook relay can relay a address to a remote address. It can relay any tcp and udp server

brook relay --from :9999 --to 1.2.3.4:9999

brook socks5tohttp can convert a socks5 to a http proxy

brook socks5tohttp --socks5 127.0.0.1:1080 --listen 127.0.0.1:8010

brook pac creates pac server

brook pac --listen 127.0.0.1:8080 --proxy 'SOCKS5 127.0.0.1:1080; SOCKS 127.0.0.1:1080; DIRECT' --bypassDomainList ...

brook pac creates pac file

brook pac --file proxy.pac --proxy 'SOCKS5 127.0.0.1:1080; SOCKS 127.0.0.1:1080; DIRECT' --bypassDomainList ...

There are countless examples; for more feature suggestions, it's best to look at the commands and parameters in the CLI documentation one by one, and blog, YouTube...

Diagram

Maybe outdated

overview

overview

withoutBrookProtocol

wbp

relayoverbrook

relayoverbrook

dnsserveroverbrook

dnsserveroverbrook

relay

relay

dnsserver

dnsserver

tproxy

tproxy

gui

gui

script

script