Tunnel existing applications

Aggligator combines the available network links between two machines into one bonded connection. It distributes traffic across them and can keep the connection alive as links fail, reconnect or the device changes networks. agg-tunnel is a standalone command-line tool for Linux, macOS and Windows that brings this to existing TCP applications: the server permits targets, the client exposes local ports, and neither application needs modification.

Install agg-tunnel

Release archives contain agg-tunnel and a speed test utility called agg-speed. The Linux binaries are statically linked and should work on any recent Linux system.

Linux x86-64 Linux ARM64 macOS Windows x86-64
cargo install aggligator-util

Quick start

This example forwards SSH on port 22 from server.example to port 2222 on the client. The tunnel itself listens on port 5000.

On the server

agg-tunnel server --tcp 5000 --port 22

On the client

agg-tunnel client --tcp server.example:5000 --port 22:2222

Connect through the tunnel

ssh -p 2222 localhost

Run agg-tunnel client --help or agg-tunnel server --help for options available in the installed build.

Port mappings

The server lists permitted targets. The client selects one of those server ports and chooses where to expose it locally. Both options can be repeated. This is classical port forwarding, as known from ssh -L, but carried over multiple links at once.

Side Option Meaning
server --port 22 allow forwarding to local port 22
--port db.internal:5432 allow forwarding to port 5432 on another host
client --port 22:2222 expose server port 22 as local port 2222

Adding links

The TCP transport tries the usable combinations of local interfaces and resolved server addresses. Repeat --tcp for additional targets. Depending on the build and platform, clients can also add links through SOCKS5 proxies, USB or Bluetooth.

Link monitor

When attached to a terminal, agg-tunnel displays the connection, active port forwards and statistics for each link. Use --no-monitor for plain log output. 

Tunneling ports of server.example:5000 (remote->local): 22->2222
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
                                     TX speed    RX speed      TXed      RXed
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Connection 4f2a91c7        12s        2.8 MB/s    6.7 MB/s     18.4 MB   42.1 MB
TX:  avail  128.0 MB   unack   12.2 MB   uncsmable      0 B    uncsmed    8.0 KB
RX:                                                            uncsmed   16.0 KB
127.0.0.1:43812: 22->2222

  0. eth0  -> [2001:db8:1::20]:5000                                         eth0
     connected       12s
      18 ms    6.0 MB /   8.0 MB      1.2 MB/s    2.8 MB/s      8.1 MB   19.7 MB

  1. wlan0 -> [2001:db8:1::20]:5000                                         eth0
     connected       12s
      31 ms    1.4 MB /   2.0 MB    420.0 KB/s    1.1 MB/s      3.2 MB    8.4 MB

  2. eth0  -> [2001:db8:2::20]:5000                                        wlan0
     connected       12s
      24 ms    4.0 MB /   6.0 MB    870.0 KB/s    2.2 MB/s      5.6 MB   10.9 MB

  3. wlan0 -> [2001:db8:2::20]:5000                                        wlan0
     connected       12s
      42 ms  768.0 KB /   1.0 MB    290.0 KB/s  640.0 KB/s      1.5 MB    3.1 MB

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Press 0-9 to toggle a link, q to quit.

In this example, both endpoints have Ethernet and Wi-Fi interfaces named eth0 and wlan0. The server's Ethernet address is 2001:db8:1::20 and its Wi-Fi address is 2001:db8:2::20. Aggligator has established all four combinations of the client's two interfaces and the server's two addresses; the server interface used by each link appears at the right.

The Connection row shows the logical connection's short ID 4f2a91c7 and age, its combined transmit and receive rates, and the total bytes transferred. The following TX and RX rows show available buffer space and data that is unacknowledged or waiting to be consumed.

The forwarding row identifies the local TCP application and the 22-to-2222 mapping it is using. Each numbered block is one Aggligator link, identified by its local interface, remote address and remote interface. It reports its connected state and age, round-trip time, unacknowledged data and current limit, current rates, and cumulative traffic. Pressing its number temporarily disables that link, which also provides a quick way to test failover.

Questions

How is this different from SSH port forwarding?

ssh -L forwards a port over one TCP connection, which is limited to one network path and breaks when that path does. agg-tunnel forwards over all links between the two machines at once, giving the tunnel their combined bandwidth and letting it continue when individual links fail. It does not encrypt the payload itself, so the two are also complementary: SSH through agg-tunnel gives an encrypted session that survives network changes.

Do I need to change my applications?

No. The client application connects to a local port and the server application receives an ordinary TCP connection. Both are unaware of the tunnel.

Can it combine two internet connections?

Yes. All usable paths between the two machines running agg-tunnel become links of one bonded connection. Like all link aggregation, this works between the two endpoints; it cannot speed up connections to services that do not run agg-tunnel.

Does the tunnel survive switching networks?

Yes. Links are re-established automatically while the logical connection stays open, so the tunnel continues when a machine moves between Wi-Fi, mobile data and Ethernet, even with an IP address change.

Is the traffic encrypted?

Links joining a connection are authenticated, but the forwarded payload is not encrypted. Use a protocol that encrypts itself, such as SSH or TLS, when the links are not trusted.