NetchX

A Windows x64 proxy client with process-based, virtual-adapter, and network-sharing traffic modes.

Quick start · 1.9.7 → 2.0.0

The current release line is 2.0.3. It retains NetchX's core proxy behavior while modernizing the runtime, high-DPI UI, native forwarding reliability, and concurrent data plane.

Version 2.0.0 is more than a version-number refresh. It addresses long-standing lifecycle, concurrency, and Windows network-I/O issues while upgrading the runtime and TUN data-plane dependencies.

• NetFilter callbacks do not perform SOCKS handshakes, DNS resolution, disk I/O, or long waits.
• Connection setup, UDP, DNS, and delayed ICMP work use bounded queues or context limits to prevent connection storms from becoming unbounded thread or memory growth.
• TCP, UDP, and DNS shutdown paths cancel pending I/O and wait for workers to finish before releasing their state.

The local loopback test suite covers 128 concurrent TCP connections with strict byte validation, SOCKS UDP, and the NetFilter path. Those results validate implementation behavior and local throughput trends only; they are not a public-network, long-distance, or encrypted-proxy performance guarantee.

• SOCKS5
• Shadowsocks
• SSH (sing-box)
• AnyTLS (sing-box)
• Hysteria and Hysteria2 (sing-box)
• TUIC (sing-box)
• NaiveProxy (sing-box)
• ShadowTLS over Shadowsocks (sing-box)
• HTTP and HTTPS CONNECT proxy
• WireGuard
• Trojan
• VMess
• VLESS

Xray-core remains the bundled runtime for SOCKS5, Shadowsocks, Trojan, VMess, VLESS, WireGuard, and HTTP/HTTPS proxy profiles. sing-box provides SSH plus AnyTLS, Hysteria, Hysteria2, TUIC, NaiveProxy, and ShadowTLS. ShadowsocksR is no longer supported; migrate SSR servers to standard Shadowsocks or another current protocol.

VLESS and VMess editors expose Xray's current raw, xhttp, mkcp, grpc, websocket, httpupgrade, and hysteria transports. VLESS also exposes the XTLS Vision flows. REALITY profiles require a server name, public key, fingerprint, and optional short ID and SpiderX; Xray permits REALITY only with RAW, XHTTP, or gRPC. Vision requires VLESS over RAW with TLS or REALITY.

Saved profiles using tcp, kcp, or ws are mapped to Xray's current transport names. Legacy HTTP/2, QUIC, and standalone xtls security have been removed by Xray-core, so NetchX asks users to migrate those profiles to XHTTP, Hysteria, or TLS/REALITY with Vision as appropriate.

1. Download NetchX-2.0.3-win-x64.7z from Releases, or the .zip fallback when 7-Zip packaging was unavailable.
2. Extract the entire archive to a writable directory. bin, i18n, and mode alongside NetchX.exe are required at runtime.
3. Run NetchX.exe as an administrator, add or import a server, select a mode, and start it.

ProcessMode requires NetFilter driver privileges. TunMode creates and configures a virtual adapter and routes. ShareMode requires an available Npcap/WinPcap-compatible interface. Save the configuration of other VPN or proxy tools first: running multiple tools that modify routes and DNS simultaneously can produce unexpected results.

• Windows x64
• .NET 10 SDK
• Visual Studio with MSBuild and the C++ x64 toolchain (verified with Visual Studio 2026)
• Go, only when rebuilding optional external components

.\build.ps1 -Configuration Release

The script recreates release\, publishes the main application, builds Redirector and RouteHelper, stages external components, and verifies critical package files. It also creates one distributable archive beside the unpacked layout: release\NetchX-<version>-win-x64.7z when 7-Zip is available and passes verification, otherwise release\NetchX-<version>-win-x64.zip. Both formats contain a top-level NetchX\ directory, including NetchX\NetchX.exe.

The Xray staging script uses the checked-out sibling release at ..\xray-core\release by default. When that directory is absent—such as on GitHub Actions—it downloads the pinned Xray 26.3.27 Windows archive and verifies both the archive and its extracted runtime files. Set NETCHX_XRAY_RELEASE to another extracted, hash-pinned Xray release directory when building elsewhere.

dotnet test .\Tests\Tests.csproj --configuration Release --framework net10.0-windows

The current work has been validated with .NET 10 Release builds, managed regression tests, core native builds, release-package checks, and local SOCKS5/NetFilter TCP and UDP loopback tests.

Before a production release, validate the following in the target network environment:

• ProcessMode, TunMode, and ShareMode startup, shutdown, and rollback against a real remote SOCKS5 server.
• IPv6, authentication, high RTT, packet loss, and high-concurrency scenarios.
• Layout at 100%, 150%, and 200% DPI, including moves between monitors.
• The SOCKS UDP TCP control/keepalive connection is still per endpoint; moving it to a shared event-driven model remains future performance work.

NetchX is distributed under the GPL-3.0 license.