olcRTC: TCP-over-WebRTC Tunnel via Whitelisted Services

olcRTC (OpenLibreCommunity RTC) is an encrypted TCP-over-WebRTC tunnel that disguises your network traffic as an ordinary video call. Instead of connecting directly to a VPS or proxy IP — which may be blocked — olcRTC routes all TCP traffic through allowed WebRTC/SFU services such as Jitsi Meet, Yandex Telemost, or WbStream. To any network observer, the connection looks like normal participation in a video call. Inside the tunnel, all payload is additionally protected with a shared XChaCha20-Poly1305 key and multiplexed with smux. olcRTC runs on Linux, macOS, Windows, and Android (via gomobile) and can be embedded as a Go library.

olcRTC is currently in Beta. For issues and community support, visit t.me/openlibrecommunity.

Tunnel Flow

Traffic flows from your application through a local SOCKS5 proxy, into the olcRTC client (cnc), across a WebRTC/SFU service, and out through the olcRTC server (srv) to the internet:

app
  -> SOCKS5 127.0.0.1:8808
   -> olcrtc cnc
    -> WebRTC/SFU service
     -> olcrtc srv
       -> internet

Inside the tunnel, the layering is:

SOCKS CONNECT
  -> smux stream
   -> XChaCha20-Poly1305
    -> transport
     -> engine
      -> WebRTC/SFU

Modes

olcRTC accepts a single YAML configuration file and runs in one of three modes:

olcrtc server.yaml
olcrtc client.yaml

Mode	Purpose
`srv`	Server side — accepts tunnel streams and dials TCP connections to target addresses on behalf of the client
`cnc`	Client side — listens on a local SOCKS5 port; browsers, curl, sing-box, and other apps connect to it as an ordinary proxy
`gen`	Creates Room IDs for providers that support room creation

Auth Providers

The auth.provider field selects the service and the credential flow used to join a room. The term carrier still appears in internal logs and the public API as a historical alias.

Provider	Engine	Notes
`jitsi`	`jitsi`	Jitsi Meet room URL; no registration required; easy to self-host. Public instances are listed in `docs/examples/jitsi.instances.yaml`.
`telemost`	`goolom`	Credentials obtained via the Yandex Telemost API; separate registration required. Telemost removed datachannel support.
`wbstream`	`livekit`	Credentials obtained via the WbStream API; separate registration required.
`none`	set via `engine.name`	Direct engine mode with a manual `engine.url` and `engine.token`.

Recommended combination: jitsi + datachannel. No registration, stable data path, lowest latency. Alternative: wbstream + vp8channel.

Transports

net.transport defines how tunnel bytes are packed into a WebRTC primitive.

Transport	How data is carried	Main scenario
`datachannel`	Native byte/data path of the engine	Simplest and fastest; stable with Jitsi
`vp8channel`	KCP over VP8-like video frames	Main video path for WbStream and Telemost
`seichannel`	Payload in H264 SEI NAL units with ACK/retry	Fallback for WbStream / Jitsi
`videochannel`	QR/tile frames via ffmpeg with ACK/retry	Experimental visual transport

Encryption

internal/crypto uses XChaCha20-Poly1305. The shared key is configured as a 64-character hex string and must be identical on both the server and the client:

openssl rand -hex 32
# d823fa01cb3e0609b67322f7cf984c4ee2e294936fc24ef38c9e59f4799...

smux runs on top of the encrypted muxconn. The first smux stream is reserved for the handshake and the control protocol.

Handshake Protocol

After the WebRTC connection is established, olcRTC performs a lightweight handshake:

CLIENT_HELLO -> SERVER_WELCOME
CONTROL_PING <-> CONTROL_PONG

If CONTROL_PONG does not arrive several times in a row, the runtime either rebuilds the smux session or hands control to the failover supervisor. The failover supervisor (internal/supervisor) supports multiple profiles[] in the YAML config — for example, wbstream + vp8channel first, then jitsi + datachannel. Active smux streams do not migrate when the profile changes; new connections pick up on the next profile.

Repository Structure

Path	Contents
`cmd/olcrtc`	CLI entrypoint
`cmd/olcrtc-cgo`	c-shared entrypoint
`pkg/olcrtc`	Embeddable client/engine API
`pkg/olcrtc/tunnel`	Embeddable server tunnel API
`mobile`	gomobile bindings for Android
`internal/config`	YAML parsing, `crypto.key_file`
`internal/app/session`	Defaults, validation, routing into `srv`/`cnc`/`gen`
`internal/auth`	Provider-specific credential flows
`internal/engine`	SFU/signaling implementations
`internal/transport`	datachannel/vp8/sei/video transports
`internal/server`	Server-side smux, handshake, TCP dial
`internal/client`	SOCKS5 listener, client-side smux
`internal/control`	Liveness ping/pong
`internal/supervisor`	Failover profiles
`docs`	Documentation and YAML examples

Public API

pkg/olcrtc returns a net.Conn-like object on top of the auth/engine stack:

sess, err := olcrtc.New(ctx, olcrtc.Config{
    Auth:   "jitsi",
    // Instances: see docs/examples/jitsi.instances.yaml
    RoomID: "https://meet.example.org/myroom",
})
if err != nil {
    return err
}
conn, err := sess.Dial(ctx)

pkg/olcrtc/tunnel embeds the server side and exposes hooks:

srv := tunnel.New(tunnel.Config{
    Transport: "datachannel",
    Carrier:   "jitsi",
    // Instances: see docs/examples/jitsi.instances.yaml
    RoomURL:   "https://meet.example.org/myroom",
    KeyHex:    "<64-char hex>",
    DNSServer: "8.8.8.8:53",
})
err := srv.Run(ctx)

The Carrier field in this API is kept for compatibility with existing integrations; semantically it maps to the auth.provider name.

Ready-Made Clients

Client	Platform	Notes
owenewans/owenclave	Android (fork of exclave)	Main client. Supports all common protocols plus `olcrtc`, the `olcrtc://` URI format, and subscriptions
venterum/veil	Android (fork of v2rayNG), Material 3	VMess, VLESS, Shadowsocks, Trojan, SOCKS, WireGuard, Hysteria2 + `olcrtc`
alananisimov/olcbox	Android, iOS, macOS, Windows, Linux	All providers, all transports, split tunneling, TUN/proxy modes

Navigate the Docs

Script Quickstart

Get running in minutes with srv.sh and cnc.sh — Podman-based scripts that build and launch server and client automatically.

Manual Build

Build the olcRTC binary natively with Go 1.26+ and mage. Covers all distros, all mage targets, and running server and client from YAML configs.

Get Started

Configuration

Reference

Integrations

olcRTC: TCP-over-WebRTC Tunnel via Whitelisted Services

Tunnel Flow

Modes

Auth Providers

Transports

Encryption

Handshake Protocol

Repository Structure

Public API

Ready-Made Clients

Navigate the Docs

Script Quickstart

Manual Build

Build docs developers (and LLMs) love

Get Started

Configuration

Reference

Integrations

Documentation Index

​Tunnel Flow

​Modes

​Auth Providers

​Transports

​Encryption

​Handshake Protocol

​Repository Structure

​Public API

​Ready-Made Clients

​Navigate the Docs

Script Quickstart

Manual Build

Build docs developers (and LLMs) love

Tunnel Flow

Modes

Auth Providers

Transports

Encryption

Handshake Protocol

Repository Structure

Public API

Ready-Made Clients

Navigate the Docs