slopfront
Reddit, read-only. No JavaScript. No cookies. No tracking.
preferences
Saved in links, not cookies.

tutuicmptunnel-kmod: A high-performance UDP-over-ICMP tunnel

31 points · submitted Dec 2025 by u/hrimfaxi_zg

Hello everyone,

I've developed tutuicmptunnel-kmod, a Linux kernel module (based on nftables) designed to tunnel UDP traffic over ICMP. It effectively serves as a drop-in, high-performance replacement for udp2raw's ICMP mode.

The project is built to help bypass strict UDP QoS throttling or packet loss policies often imposed by ISPs or firewalls. It works perfectly as a transport layer for tools like WireGuard, Hysteria, or KCPTun.

Why use this over existing tools?
The key difference is performance. Since tutuicmptunnel-kmod runs entirely in kernel space, it eliminates the expensive context switching overhead found in user-space solutions. In my benchmarks, it achieves ~10x the throughput of udp2raw under the same CPU load, while consuming significantly fewer resources.

It supports IPv4/IPv6 and includes a userspace tool (ktuctl) for managing rules and syncing configurations securely.

The project is open-source and I am looking for feedback regarding stability and performance in different network environments.

The project can be found here: https://github.com/hrimfaxi/tutuicmptunnel-kmod

Thanks!

tutuicmptunnel-kmod: A high-performance UDP-over-ICMP tunnel

13 comments · 93% upvoted · other discussions

comments

Read-only. Use the arrows to collapse threads.

hrimfaxi_zg [OP] 7 points · Dec 2025

If you prefer a solution based on tc-bpf (eBPF) instead of a kernel module, I also maintain a sibling project with identical functionality:
https://github.com/hrimfaxi/tutuicmptunnel

However, the kmod version (this post) is generally recommended for maximum performance on compatible kernels.

jhaar 3 points · Dec 2025

What's the performance difference between your kernel module and ebpf? Ebpf in general  is getting hyped alot recently and it's interesting to hear you imply there's a non-trivial penalty to pay (hopefully not putting words in your mouth;-)

hrimfaxi_zg [OP] 4 points · Dec 2025

Benchmark in my test environment:
In the transmit direction, tutuicmptunnel-kmod reached 5.51 Gbits/sec—1.25× the 4.42 Gbits/sec achieved by tutuicmptunnel.
In the receive direction, it hit 5.27 Gbits/sec—1.19× the 4.43 Gbits/sec of tutuicmptunnel.

To me, the real gem of tutuicmptunnel-kmod is that it runs on OpenWrt out-of-the-box, whereas the eBPF version still obliges you to recompile the entire kernel image.

Serialtorrenter 1 points · Dec 2025

  1. Does this mean I could connect a rooted Android phone using the userspace implementation with a Linux-based server using the kernel module?

  2. If running the server behind NAT, do I have to create a DNAT rule on the router? If so, what types of ICMP messages need to be DNAT-ed?

  3. Doesn't ICMPv6 have built-in rate-limiting?

hrimfaxi_zg [OP] 1 points · Dec 2025
  1. Theoretically, yes — tutuicmptunnel supports cross-platform deployment. Both sides communicate over ICMP, so this hybrid setup is architecturally feasible.

(Note: This is a theoretical analysis; I haven’t personally tested it.)

  1. Yes, if the server sits behind NAT you must add a DNAT rule on the router. The rule looks like the usual TCP/UDP DNAT:

bash iptables -t nat -A PREROUTING -d <public-IP> -p icmp \ -j DNAT --to-destination <internal-server-IP>

  1. Kernel ICMPv6 rate-limiting does not have anything to do with tutuicmptunnel. The sending rate is solely decided by your UDP applications, such as wireguard etc.
AspectSpiritual9143 3 points · Dec 2025

please see if you can add sysfs based configuration, and have you checked if it works correctly within containers? i run openwrt on incus, which means kmod has to be loaded on the host os. if i can configure the tunnel from sysfs within openwrt container, it will be easier to manage

hrimfaxi_zg [OP] 1 points · Dec 2025

Can you check whether commit f6d7bf9 works on your setup?
tutuicmptunnel-kmod used to communicate via a device file, but it recently switched to Netlink.
If you want, you can try an older version first.

AspectSpiritual9143 1 points · Dec 2025

i'll test this afterwork. i use nixos so i need to package your stuff first

edthesmokebeard 2 points · Dec 2025

Neat, what ICMP type and code does it use?

"The project is built to help bypass strict UDP QoS throttling or packet loss policies often imposed by ISPs or firewalls."

Wouldn't those same conditions impact ICMP traffic?

UncrushedTolerant 1 points · Dec 2025

So, a server and client install the same thing or is there different client software???
"tutuicmptunnel-kmod consists of two parts: a server and a client"

hrimfaxi_zg [OP] 1 points · Dec 2025

It’s one binary (and one kernel module) for both ends. Install the same package everywhere; afterward ktuctl lets you flag the host as server or client, no separate software to download.

CauaLMF -1 points · Dec 2025

It was supposed to support Ubuntu 18.04 with iptables.