What Is the WaterWall Core?
On this page 7
Alongside well-known names such as Xray and sing-box, another name keeps coming up in the networking community: WaterWall. This core takes a different approach and focuses mainly on tunneling and on chaining network components together.
Note: WaterWall is a fairly specialized project that is still under development. Before using it, be sure to review the project's documentation and the latest official release, because its features and configuration method may have changed.
WaterWall in one sentence
WaterWall is an open-source networking core that lets you build custom tunnels and communication paths by connecting "nodes" (Nodes) to one another.
What does node-based architecture mean?
Instead of a fixed, predefined protocol, in WaterWall you build the connection out of small pieces: an entry node, several middle nodes (for example encryption or processing) and an exit node. These pieces are connected in order and form a "chain", like building a pipeline.
Common use cases
- Building a tunnel between two servers
- Reverse tunnel (Reverse Tunnel): when a server sits behind network restrictions and cannot accept inbound connections
- Combining different layers to reach the architecture you want
- Testing and building custom network topologies
Advantages and limitations
Advantages:
- High flexibility in building custom architectures
- A lightweight approach focused on performance
- Open source, so the code can be reviewed
Limitations:
- It is more complex for a beginner.
- Its client ecosystem and documentation are not as extensive as those of Xray and sing-box.
- It requires technical knowledge to configure correctly and securely.
Quick comparison
| Xray-core | sing-box | WaterWall | |
|---|---|---|---|
| Focus | Proxying and a wide range of transports | A comprehensive proxy platform | Node-based tunneling |
| Best for | Most proxy users | Users who need advanced routing and DNS | Technical users who want a custom tunnel |
| Ease for beginners | Medium | Medium | Lower |
A security note
Whichever core you work with, one rule stays the same: test every new tunnel after you set it up. DNS and IPv6 leaks can happen in any custom architecture.
And BlendIn VPN?
If you have a specific technical requirement, talk to BlendIn VPN's 24-hour support before you buy, so you can be sure the service is compatible with the way you work.
