resumux

At a glance

resumux is a command-line TCP tunnel written in Go. It carries a connection over WebSockets, with a client on your machine and a server next to the target service. Tools like chisel or wstunnel lose the open connection when the WebSocket drops. resumux numbers the data and resends it over a fresh WebSocket, so SSH or a database connection sees a pause and carries on. It is pre-1.0 (release v0.1.0), and its author says it has not yet run in production.

Good fit

People who can reach a server only over HTTP(S), through Cloudflare, nginx or a corporate proxy, and want SSH, a database or a TCP game connection to survive CDN restarts, silently dropped proxy connections and Wi-Fi drops. The -redundant flag sends small frames over two WebSocket paths at once to hide retransmit lag spikes. It targets public game servers where putting every player on a VPN is impractical, and costs a game roughly twice its usual bandwidth.

Consider something else when

You can run WireGuard or Tailscale. The README itself recommends a VPN when one is possible. Also skip it for UDP traffic such as voice chat and many games, which it does not carry, and for adding bandwidth, since extra paths give failover only. Wait if you need a stable protocol, because the wire format may still change before 1.0.

Start here

Create a shared token with openssl rand -hex 32 > token and copy it to both machines. On the server, run resumux server -listen :443 -tls-cert cert.pem -tls-key key.pem -target 127.0.0.1:22 -token-file token. Locally, run resumux client -listen 127.0.0.1:2222 -server wss://example.com/ -token-file token, then ssh -p 2222 user@127.0.0.1. The project's suggested check is to cut the network or restart the proxy and confirm the SSH session is still there. Behind a CDN that handles TLS, leave out the certificate flags.

Cost and requirements

The software is free under Apache-2.0. You need a server you control to run the resumux server beside the target, plus the client on each user's machine. Releases are single static binaries for Linux, macOS and Windows with SHA-256 checksums and verifiable build provenance. Building from source needs Go 1.24 or newer, and a Dockerfile builds a non-root container. Hosting and any CDN plan are separate costs. The README notes that Cloudflare proxies WebSockets on its free plan but restricts serving video and large files.

Limits to know

Sessions live in the server's memory, so restarting the server ends them, and one server forwards to one target. A session with no working path waits up to two minutes (-resume-timeout), then closes. Frames rely on the WebSocket's TLS, so use wss:// across any untrusted network. A token shipped inside a public client is an access key anyone can extract. Per-client limits cap one address, but someone with many addresses can still fill the server, so the docs advise CDN rate limiting too. The published latency figures are single runs on one home connection, not a benchmark. Only the latest release receives security fixes.

Still unclear

• Whether clients and servers from different releases will interoperate while the protocol changes before 1.0, which matters when the client ships to the public.