tobaru
tobaru is a port forwarding tool written in Rust. Route TCP and UDP traffic by source IP, inspect TLS SNI and ALPN without decryption, terminate TLS, or forward HTTP requests by hostname and path. YAML configuration combines listeners, allowlists, destinations, and reusable IP groups in one process.
Get started
Section titled “Get started”- Install tobaru and run a first configuration.
- Learn the configuration model or copy a complete example.
- Configure TCP targets, UDP forwarding, and IP groups.
- Export named TCP/Unix services behind NAT with reverse tunnels.
- Set up incoming TLS and outgoing TLS, including certificate authentication.
- Configure HTTP routing, actions, and HTTP/2.
- Review resource limits and deployment contracts before exposing a listener.
Traffic handling
Section titled “Traffic handling”TCP targets can forward opaque streams to TCP or UNIX sockets, with round-robin backend selection. TLS passthrough and termination can share a listener. HTTP targets support HTTP/1 and HTTP/2 independently on ingress and egress, header and path rewriting, static files, and local responses. WebSocket upgrades are supported only on HTTP/1-to-HTTP/1 paths; CONNECT and HTTP/3 are not supported.
Each target’s allowlist grants access to that target, not a global deny rule for other routes. A raw catch-all can receive unmatched or malformed TLS. Read target precedence before combining routes.
Configuration files are watched and reloaded. Invalid replacements retain the last-good configuration; successful reloads stop listeners before rebinding and are not gapless. Use a supervisor and review reload behavior.
This reference describes the source revision in the header. dev documentation is unreleased and may describe behavior absent from the latest release binary.