udp proxying

client/src/connections/tcp_connection.rs

@@ -1,10 +1,12 @@
-use netrunner_core::protocol::codec::socks::{SocksRequest, TargetAddress};
+use std::time::Duration;
+
+use bytes::Bytes;
+use netrunner_core::protocol::codec::frame::FrameType;
+use netrunner_core::protocol::codec::socks::TargetAddress;
+use netrunner_core::proxy::connection::muxer::{MuxMessage, Muxer};
 use smoltcp::iface::SocketHandle;
 use smoltcp::socket::tcp;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
 use tokio::sync::{mpsc, oneshot};
-use tokio_util::sync::CancellationToken;
 
 pub enum ConnectionState {
     Established,
@@ -19,63 +21,79 @@ pub struct TcpConnection {
     tx: mpsc::UnboundedSender<Vec<u8>>,
     rx: mpsc::UnboundedReceiver<Vec<u8>>,
     pending_data: Vec<u8>,
-    token: CancellationToken,
     handshake_rx: Option<oneshot::Receiver<()>>,
 }
 
-const MAX_PENDING: usize = 256 * 1024;
+const MAX_PENDING: usize = 2 * 1024 * 1024;
 
 impl TcpConnection {
-    pub fn new(handle: SocketHandle, proxy_addr: String, target_addr: TargetAddress) -> Self {
-        let (tx_to_proxy, mut rx_from_smol) = mpsc::unbounded_channel::<Vec<u8>>();
+    pub fn new(handle: SocketHandle, target_addr: TargetAddress, muxer: Muxer) -> Self {
+        let (tx_to_mux, mut rx_from_smol) = mpsc::unbounded_channel::<Vec<u8>>();
         let (tx_to_smol, rx_from_proxy) = mpsc::unbounded_channel::<Vec<u8>>();
         let (handshake_tx, handshake_rx) = oneshot::channel();
 
-        let token = CancellationToken::new();
-        let task_token = token.clone();
+        let stream_id = muxer.next_id();
 
         tokio::spawn(async move {
-            let mut stream = match TcpStream::connect(&proxy_addr).await {
-                Ok(s) => {
-                    netrunner_logger::debug!(%handle, "Connected to proxy successfully");
-                    s
-                }
-                Err(e) => {
-                    netrunner_logger::debug!(%handle, error = %e, "Failed to connect to proxy");
-                    return;
-                }
-            };
+            // 1. Регистрируем виртуальный стрим
+            let (v_tx, mut v_rx) = mpsc::channel(1024);
+            muxer.register_stream(stream_id, v_tx).await;
 
-            if let Err(e) = SocksRequest::perform_client_handshake(&mut stream, &target_addr).await
+            // 2. Отправляем запрос на соединение на удаленный сервер
+            let connect_payload = target_addr.to_string();
+            if muxer
+                .send_to_netwrok(MuxMessage {
+                    stream_id,
+                    frame_type: FrameType::Connect,
+                    data: Bytes::from(connect_payload),
+                })
+                .await
+                .is_err()
             {
-                netrunner_logger::debug!(%handle, error = %e, "SOCKS handshake failed");
+                muxer.remove_stream(stream_id).await;
                 return;
             }
 
-            let _ = handshake_tx.send(());
-
-            netrunner_logger::debug!(%handle, "SOCKS handshake successful, starting data bridge");
-
-            let (mut reader, mut writer) = stream.into_split();
+            let first_payload = tokio::time::timeout(Duration::from_secs(10), v_rx.recv()).await;
+            match first_payload {
+                Ok(Some(data)) => {
+                    // Успешный SOCKS-ответ сервера имеет код 0x00 во втором байте
+                    if data.len() >= 2 && data[1] == 0x00 {
+                        let _ = handshake_tx.send(()); // Даем отмашку smoltcp, что можно слать данные
+                    } else {
+                        netrunner_logger::warn!(stream_id, "Server rejected TCP connection");
+                        muxer.remove_stream(stream_id).await;
+                        return;
+                    }
+                }
+                _ => {
+                    netrunner_logger::error!(stream_id, "Timeout waiting for proxy response");
+                    muxer.remove_stream(stream_id).await;
+                    return;
+                }
+            }
 
+            // 4. Запускаем мост данных
             let to_proxy = async {
                 while let Some(data) = rx_from_smol.recv().await {
-                    if writer.write_all(&data).await.is_err() {
+                    let msg = MuxMessage {
+                        stream_id,
+                        frame_type: FrameType::Data, // Для TCP используем обычный Data
+                        data: Bytes::from(data),
+                    };
+                    if muxer.send_to_netwrok(msg).await.is_err() {
                         break;
                     }
                 }
             };
 
             let from_proxy = async {
-                let mut buf = [0u8; 65536];
-                loop {
-                    match reader.read(&mut buf).await {
-                        Ok(0) | Err(_) => break,
-                        Ok(n) => {
-                            if tx_to_smol.send(buf[..n].to_vec()).is_err() {
-                                break;
-                            }
-                        }
+                while let Some(data) = v_rx.recv().await {
+                    if data.is_empty() {
+                        break;
+                    } // EOF
+                    if tx_to_smol.send(data.to_vec()).is_err() {
+                        break;
                     }
                 }
             };
@@ -83,21 +101,28 @@ impl TcpConnection {
             tokio::select! {
                 _ = to_proxy => {}
                 _ = from_proxy => {}
-                _ = task_token.cancelled() => { netrunner_logger::debug!(%handle, "Task cancelled by Manager"); }
             }
+
+            // 5. Корректно закрываем стрим на сервере
+            let _ = muxer
+                .send_to_netwrok(MuxMessage {
+                    stream_id,
+                    frame_type: FrameType::Close,
+                    data: Bytes::new(),
+                })
+                .await;
+            muxer.remove_stream(stream_id).await;
         });
 
         Self {
             handle,
-            state: ConnectionState::Active,
-            tx: tx_to_proxy,
+            state: ConnectionState::Handshaking, // Начинаем с ожидания handshake_tx
+            tx: tx_to_mux,
             rx: rx_from_proxy,
             pending_data: vec![],
-            token,
             handshake_rx: Some(handshake_rx),
         }
     }
-
     pub fn tick(&mut self, socket: &mut tcp::Socket) -> bool {
         let state = socket.state();
 
@@ -157,43 +182,48 @@ impl TcpConnection {
     }
 
     fn poll_and_process(&mut self, socket: &mut tcp::Socket) {
+        // 1. Читаем ИЗ виртуального сокета -> В прокси-сервер
         if socket.can_recv() {
+            let mut total_read = 0;
             let _ = socket.recv(|data| {
-                let len = data.len();
-                if len > 0 {
-                    let _ = self.tx.send(data.to_vec());
+                if !data.is_empty() {
+                    if self.tx.send(data.to_vec()).is_ok() {
+                        total_read = data.len();
+                    }
                 }
-                (len, ())
+                (total_read, ())
             });
         }
 
-        if !self.pending_data.is_empty() {
-            if self.pending_data.len() > MAX_PENDING {
-                netrunner_logger::warn!(%self.handle, "Buffer overflow! Aborting connection.");
-                socket.abort();
-                self.token.cancel();
-                return;
-            }
+        // 2. Проверка лимита буфера перед тем, как брать новые данные
+        if self.pending_data.len() > MAX_PENDING {
+            netrunner_logger::error!(%self.handle, "TCP Buffer overflow ({} bytes). Dropping connection.", self.pending_data.len());
+            socket.abort();
+            self.state = ConnectionState::Closed;
+            return;
+        }
 
+        // 3. Сбрасываем то, что накопилось в pending_data
+        if !self.pending_data.is_empty() && socket.can_send() {
             match socket.send_slice(&self.pending_data) {
                 Ok(n) => {
-                    self.pending_data.drain(0..n);
+                    self.pending_data.drain(..n);
                 }
                 Err(_) => {}
             }
         }
 
-        if socket.can_send() {
-            while let Ok(data) = self.rx.try_recv() {
+        // 4. Читаем новые данные из прокси, ТОЛЬКО если старые ушли
+        if self.pending_data.is_empty() && socket.can_send() {
+            if let Ok(data) = self.rx.try_recv() {
                 match socket.send_slice(&data) {
                     Ok(n) if n < data.len() => {
-                        self.pending_data = data[n..].to_vec();
-                        break;
+                        self.pending_data.extend_from_slice(&data[n..]);
                     }
                     Ok(_) => {}
                     Err(_) => {
+                        // Если сокет внезапно отказал, сохраняем всё в буфер
                         self.pending_data = data;
-                        break;
                     }
                 }
             }

client/src/connections/udp_connection.rs

@@ -1,27 +1,143 @@
-use crate::connections::dns::DnsHandler;
-use crate::connections::ip_store::FakeIpStore;
+use smoltcp::iface::SocketHandle;
 use smoltcp::socket::udp;
+use smoltcp::wire::IpEndpoint;
+use std::time::{Duration, Instant};
+use tokio::sync::mpsc;
+use tokio_util::sync::CancellationToken;
 
-pub struct UdpConnection;
+use bytes::Bytes;
+use netrunner_core::{
+    protocol::codec::{frame::FrameType, socks::TargetAddress},
+    proxy::connection::muxer::{MuxMessage, Muxer},
+};
+
+pub struct UdpConnection {
+    pub handle: SocketHandle,
+    stream_id: u32,
+    tx_to_net: mpsc::Sender<MuxMessage>, // Прямой канал кадров
+    rx_from_net: mpsc::Receiver<Bytes>,  // Прямое чтение из муксера
+    client_endpoint: Option<IpEndpoint>,
+    last_activity: Instant,
+    token: CancellationToken,
+}
+
+const UDP_TIMEOUT: Duration = Duration::from_secs(60);
+// Ограничиваем очередь: для UDP дроп пакета при перегрузке — это норма
+const CHANNEL_CAPACITY: usize = 1024;
 
 impl UdpConnection {
-    pub fn process_incoming(
-        socket: &mut udp::Socket,
-        store: &mut FakeIpStore,
-        dns_handler: &DnsHandler,
-    ) {
-        while socket.can_recv() {
-            let (data, metadata) = match socket.recv() {
-                Ok(res) => res,
-                Err(_) => break,
+    pub fn new(handle: SocketHandle, target_addr: TargetAddress, muxer: Muxer) -> Self {
+        let stream_id = muxer.next_id();
+        let token = CancellationToken::new();
+        let task_token = token.clone();
+
+        // Канал из tick в асинхронную таску (сразу в формате MuxMessage)
+        let (tx_to_net, mut rx_from_smol) = mpsc::channel::<MuxMessage>(CHANNEL_CAPACITY);
+
+        // Канал из муксера напрямую в tick
+        let (v_tx, v_rx) = mpsc::channel::<Bytes>(CHANNEL_CAPACITY);
+
+        let m_clone = muxer.clone();
+
+        tokio::spawn(async move {
+            m_clone.register_stream(stream_id, v_tx).await;
+
+            // 1. Устанавливаем соединение
+            let _ = m_clone
+                .send_to_netwrok(MuxMessage {
+                    stream_id,
+                    frame_type: FrameType::UdpConnect,
+                    data: Bytes::from(target_addr.to_string()),
+                })
+                .await;
+
+            // 2. Слушаем только один канал (на отправку в сеть)
+            let to_proxy = async {
+                while let Some(msg) = rx_from_smol.recv().await {
+                    if m_clone.send_to_netwrok(msg).await.is_err() {
+                        break;
+                    }
+                }
             };
 
-            let endpoint = metadata.endpoint;
-
-            if let Some(response) = dns_handler.handle_query(&data, store) {
-                netrunner_logger::debug!(to = %endpoint, "Sending DNS response (filtered)");
-                let _ = socket.send_slice(&response, metadata);
+            tokio::select! {
+                _ = to_proxy => {}
+                _ = task_token.cancelled() => {}
             }
+
+            // 3. Закрываем стрим
+            let _ = m_clone
+                .send_to_netwrok(MuxMessage {
+                    stream_id,
+                    frame_type: FrameType::Close,
+                    data: Bytes::new(),
+                })
+                .await;
+            m_clone.remove_stream(stream_id).await;
+        });
+
+        Self {
+            handle,
+            stream_id,
+            tx_to_net,
+            rx_from_net: v_rx, // Сохраняем Receiver напрямую
+            client_endpoint: None,
+            last_activity: Instant::now(),
+            token,
         }
     }
+
+    pub fn tick(&mut self, socket: &mut udp::Socket) -> bool {
+        if self.last_activity.elapsed() > UDP_TIMEOUT {
+            netrunner_logger::debug!(%self.handle, "UDP Session closed due to timeout");
+            self.token.cancel();
+            socket.close();
+            return false;
+        }
+
+        // 1. Читаем из TUN (приложение -> прокси)
+        if socket.can_recv() {
+            while let Ok((data, metadata)) = socket.recv() {
+                self.client_endpoint = Some(metadata.endpoint);
+
+                // Избегаем двойной аллокации, сразу копируем в Bytes
+                let msg = MuxMessage {
+                    stream_id: self.stream_id,
+                    frame_type: FrameType::UdpData,
+                    data: Bytes::copy_from_slice(data),
+                };
+
+                // try_send не блокирует цикл. Если буфер забит - пакет отбрасывается.
+                // QUIC мгновенно поймет потерю и адаптирует битрейт видео.
+                if self.tx_to_net.try_send(msg).is_ok() {
+                    self.last_activity = Instant::now();
+                }
+            }
+        }
+
+        // 2. Пишем в TUN (прокси -> приложение)
+        if socket.can_send() {
+            if let Some(endpoint) = self.client_endpoint {
+                // Читаем напрямую из канала муксера, минуя промежуточные таски
+                while let Ok(data) = self.rx_from_net.try_recv() {
+                    if data.is_empty() {
+                        self.token.cancel(); // Сервер прислал сигнал закрытия
+                        break;
+                    }
+
+                    match socket.send_slice(&data, endpoint) {
+                        Ok(_) => {
+                            self.last_activity = Instant::now();
+                        }
+                        Err(_) => {
+                            // Буфер smoltcp переполнен
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        true
+    }
 }

client/src/main.rs

@@ -39,26 +39,35 @@ async fn main() -> anyhow::Result<()> {
 
     let config = Config::new(smoltcp::wire::HardwareAddress::Ip);
     let mut caps = DeviceCapabilities::default();
-    caps.max_transmission_unit = 1280;
+    caps.max_transmission_unit = 1350;
     caps.medium = smoltcp::phy::Medium::Ip;
 
     let network = Network::new(
-        "0.0.0.0".into(),
+        "127.0.0.1".into(),
         8080,
         ConnectionRole::Client,
         Some(remote_address.clone()),
     );
 
-    let proxy_ip = network.get_self_local_address();
-
     let network_token = CancellationToken::new();
     let net_token_for_spawn = network_token.clone();
-    tokio::spawn(async move {
-        info!("Network thread started");
-        network.run(net_token_for_spawn).await;
-    });
 
-    let mut engine = Engine::new(config, caps, proxy_ip, dns_handler);
+    info!("Establishing secure tunnel to proxy server...");
+    let muxer = match network.initialize_client_tunnel(net_token_for_spawn).await {
+        Ok(m) => m,
+        Err(e) => {
+            error!("Failed to establish secure tunnel: {}", e);
+            // Восстанавливаем роутинг перед выходом
+            let _ = reset_platform_routing(Some(
+                &remote_address.split(':').next().unwrap().to_string(),
+            ));
+            return Err(anyhow::anyhow!("Tunnel initialization failed: {}", e));
+        }
+    };
+    info!("Secure tunnel established, Muxer is ready.");
+
+    // Передаем Muxer в Engine
+    let mut engine = Engine::new(config, caps, dns_handler, muxer);
     engine.set_any_ip(true);
     engine.set_transparent_mode();
     engine.set_default_gateway(Ipv4Addr::new(10, 0, 0, 2));
@@ -69,6 +78,7 @@ async fn main() -> anyhow::Result<()> {
 
     let ctrl_c = tokio::signal::ctrl_c();
     tokio::select! {
+        // Запускаем главный цикл обработки пакетов
         res = engine.run(tun_device) => {
             error!("Engine loop error: {:?}", res);
         },
@@ -77,7 +87,9 @@ async fn main() -> anyhow::Result<()> {
         }
     }
 
+    // Отменяем токен, что завершит фоновые задачи мультиплексора (TunnelEngine)
     network_token.cancel();
+
     info!("Restoring system routing...");
     let addr: std::net::SocketAddr = remote_address.parse().expect("Invalid address format");
     let p_ip = addr.ip().to_string();

client/src/session/mod.rs

@@ -86,7 +86,7 @@ impl SessionManager {
                             .tun_name("netr0")
                             .address((10, 0, 0, 1))
                             .netmask((255, 255, 255, 0))
-                            .mtu(1280)
+                            .mtu(1350)
                             .up();
                     })
                     .expect("Failed to init TUN")
@@ -104,7 +104,7 @@ impl SessionManager {
 
             let config = Config::new(smoltcp::wire::HardwareAddress::Ip);
             let mut caps = DeviceCapabilities::default();
-            caps.max_transmission_unit = 1280;
+            caps.max_transmission_unit = 1350;
             caps.medium = smoltcp::phy::Medium::Ip;
 
             let network = Network::new(
@@ -113,18 +113,22 @@ impl SessionManager {
                 ConnectionRole::Client,
                 Some(remote_address.clone()),
             );
-            let proxy_ip = network.get_self_local_address();
 
-            tokio::spawn(async move {
-                network.run(net_token).await;
-            });
+            let muxer = match network.initialize_client_tunnel(net_token).await {
+                Ok(m) => m,
+                Err(e) => {
+                    error!("Failed to establish secure tunnel to server: {}", e);
+                    return;
+                }
+            };
 
-            let mut engine = Engine::new(config, caps, proxy_ip, dns_handler);
+            info!("Secure tunnel established, Muxer is ready.");
+
+            let mut engine = Engine::new(config, caps, dns_handler, muxer);
             engine.set_any_ip(true);
             engine.set_transparent_mode();
             engine.set_default_gateway(Ipv4Addr::new(10, 0, 0, 2));
             engine.activate();
-
             let cancel_token_for_engine = cancel_token.clone();
 
             tokio::spawn(async move {

client/src/tun/connection_manager.rs

@@ -1,9 +1,9 @@
-use netrunner_core::protocol::codec::socks::TargetAddress;
+use netrunner_core::{protocol::codec::socks::TargetAddress, proxy::connection::muxer::Muxer};
 use netrunner_logger::{debug, info, warn};
 use smoltcp::{
     iface::{SocketHandle, SocketSet},
     socket::{AnySocket, icmp, tcp, udp},
-    wire::{IpListenEndpoint, IpProtocol, Ipv4Packet, TcpPacket},
+    wire::{IpListenEndpoint, IpProtocol, Ipv4Packet, TcpPacket, UdpPacket},
 };
 use std::{collections::HashMap, time::Instant as StdInstant};
 
@@ -14,25 +14,25 @@ use crate::connections::{
 pub struct ConnectionManager {
     last_activity: HashMap<SocketHandle, StdInstant>,
     active_tcp_sessions: HashMap<SocketHandle, TcpConnection>,
-    _active_udp_sessions: HashMap<SocketHandle, UdpConnection>,
+    active_udp_sessions: HashMap<SocketHandle, UdpConnection>,
     dns_handler: DnsHandler,
     fake_ip_store: FakeIpStore,
-    proxy_ip: String,
     failed_until: HashMap<SocketHandle, StdInstant>,
     sockets_to_remove: Vec<SocketHandle>,
+    muxer: Muxer,
 }
 
 impl ConnectionManager {
-    pub fn new(ip: String, dns_handler: DnsHandler) -> Self {
+    pub fn new(dns_handler: DnsHandler, muxer: Muxer) -> Self {
         Self {
             last_activity: HashMap::new(),
             active_tcp_sessions: HashMap::new(),
-            _active_udp_sessions: HashMap::new(),
-            proxy_ip: ip,
+            active_udp_sessions: HashMap::new(),
             fake_ip_store: FakeIpStore::new(),
             failed_until: HashMap::new(),
             dns_handler,
             sockets_to_remove: Vec::new(),
+            muxer,
         }
     }
     pub fn start_listening(&mut self, socket_set: &mut SocketSet) {
@@ -134,7 +134,7 @@ impl ConnectionManager {
             }
 
             info!(%handle, "New TCP session established for target: {:?}", target);
-            let conn = TcpConnection::new(handle, self.proxy_ip.clone(), target);
+            let conn = TcpConnection::new(handle, target, self.muxer.clone());
             self.active_tcp_sessions.insert(handle, conn);
         }
 
@@ -152,7 +152,54 @@ impl ConnectionManager {
     fn handle_udp(&mut self, handle: SocketHandle, socket: &mut udp::Socket) {
         self.last_activity.insert(handle, StdInstant::now());
 
-        UdpConnection::process_incoming(socket, &mut self.fake_ip_store, &self.dns_handler);
+        let local_port = socket.endpoint().port;
+
+        // 1. ЛОКАЛЬНЫЙ DNS РЕЗОЛВЕР (FakeIP)
+        if local_port == 53 {
+            while socket.can_recv() {
+                let (data, meta) = match socket.recv() {
+                    Ok(res) => res,
+                    Err(_) => break,
+                };
+
+                // Передаем запрос в наш Fake DNS
+                if let Some(response) = self.dns_handler.handle_query(data, &mut self.fake_ip_store)
+                {
+                    netrunner_logger::debug!(to = %meta.endpoint, "Sending DNS response (FakeIP/Filtered)");
+                    let _ = socket.send_slice(&response, meta);
+                }
+            }
+            return; // Дальше не идем, для DNS сессии не нужны
+        }
+
+        // 2. ПРОКСИРУЕМЫЙ UDP (Игры, звонки и т.д.)
+        if socket.is_open() && !self.active_udp_sessions.contains_key(&handle) {
+            let endpoint = socket.endpoint();
+            let target = match endpoint.addr {
+                Some(smoltcp::wire::IpAddress::Ipv4(ipv4_addr)) => {
+                    TargetAddress::Ipv4(std::net::Ipv4Addr::from(ipv4_addr), endpoint.port)
+                }
+                Some(smoltcp::wire::IpAddress::Ipv6(ipv6_addr)) => {
+                    TargetAddress::Ipv6(std::net::Ipv6Addr::from(ipv6_addr), endpoint.port)
+                }
+                None => {
+                    netrunner_logger::warn!(%handle, "UDP socket endpoint has no IP address bound");
+                    return;
+                }
+            };
+
+            netrunner_logger::info!(%handle, target = %target, "New UDP proxied session established");
+
+            let conn = UdpConnection::new(handle, target, self.muxer.clone());
+            self.active_udp_sessions.insert(handle, conn);
+        }
+
+        if let Some(conn) = self.active_udp_sessions.get_mut(&handle) {
+            if !conn.tick(socket) {
+                self.sockets_to_remove.push(handle);
+                self.active_udp_sessions.remove(&handle);
+            }
+        }
     }
 
     fn handle_icmp(&mut self, handle: SocketHandle, socket: &mut icmp::Socket) {
@@ -187,45 +234,77 @@ impl ConnectionManager {
         let Ok(ip_packet) = Ipv4Packet::new_checked(packet) else {
             return;
         };
-        if ip_packet.next_header() != IpProtocol::Tcp {
-            return;
-        };
-        let Ok(tcp_packet) = TcpPacket::new_checked(ip_packet.payload()) else {
-            return;
-        };
 
-        if tcp_packet.syn() && !tcp_packet.ack() {
-            let dst_port = tcp_packet.dst_port();
-            let dst_addr = ip_packet.dst_addr();
-
-            if !self.has_active_session(socket_set, dst_addr.into(), dst_port) {
-                debug!(target: "netrunner", "Dynamic TCP: Creating socket for {}:{}", dst_addr, dst_port);
-
-                let mut socket = Self::create_dynamic_tcp_socket(dst_port);
-                let endpoint = IpListenEndpoint {
-                    addr: Some(dst_addr.into()),
-                    port: dst_port,
+        match ip_packet.next_header() {
+            IpProtocol::Tcp => {
+                let Ok(tcp_packet) = TcpPacket::new_checked(ip_packet.payload()) else {
+                    return;
                 };
 
-                if let Ok(_) = socket.listen(endpoint) {
-                    socket_set.add(socket);
+                if tcp_packet.syn() && !tcp_packet.ack() {
+                    let dst_port = tcp_packet.dst_port();
+                    let dst_addr = ip_packet.dst_addr();
+
+                    if !self.has_active_tcp_session(socket_set, dst_addr.into(), dst_port) {
+                        debug!(target: "netrunner", "Dynamic TCP: Creating socket for {}:{}", dst_addr, dst_port);
+
+                        let mut socket = Self::create_dynamic_tcp_socket(dst_port);
+                        let endpoint = IpListenEndpoint {
+                            addr: Some(dst_addr.into()),
+                            port: dst_port,
+                        };
+
+                        if let Ok(_) = socket.listen(endpoint) {
+                            socket_set.add(socket);
+                        }
+                    }
                 }
             }
+            IpProtocol::Udp => {
+                let Ok(udp_packet) = UdpPacket::new_checked(ip_packet.payload()) else {
+                    return;
+                };
+                let dst_port = udp_packet.dst_port();
+                let dst_addr = ip_packet.dst_addr();
+
+                // Игнорируем широковещательный мусор
+                if dst_port == 0 || dst_port == 137 || dst_port == 138 {
+                    return;
+                }
+
+                if !self.has_active_udp_session(socket_set, dst_addr.into(), dst_port) {
+                    netrunner_logger::debug!(target: "netrunner", "Dynamic UDP: Creating socket for {}:{}", dst_addr, dst_port);
+
+                    let mut socket = Self::create_dynamic_udp_socket(dst_port);
+                    let endpoint = IpListenEndpoint {
+                        addr: Some(dst_addr.into()),
+                        port: dst_port,
+                    };
+
+                    if let Ok(_) = socket.bind(endpoint) {
+                        socket_set.add(socket);
+                    }
+                }
+            }
+            _ => {}
         }
     }
 
-    fn create_udp_socket<'a>() -> udp::Socket<'a> {
-        const BUF_SIZE: usize = 1024 * 64;
-        const PACKET_COUNT: usize = 128;
+    fn create_dynamic_udp_socket<'a>(port: u16) -> udp::Socket<'a> {
+        // Для QUIC (443) выделяем жирный буфер, для остального - умеренный
+        let (buf_size, packet_count) = match port {
+            443 => (1024 * 1024, 512), // 1MB буфер, 512 метаданных для пакетов
+            _ => (128 * 1024, 128),    // 128KB для обычного трафика
+        };
 
         udp::Socket::new(
             udp::PacketBuffer::new(
-                vec![udp::PacketMetadata::EMPTY; PACKET_COUNT],
-                vec![0; BUF_SIZE],
+                vec![udp::PacketMetadata::EMPTY; packet_count],
+                vec![0; buf_size],
             ),
             udp::PacketBuffer::new(
-                vec![udp::PacketMetadata::EMPTY; PACKET_COUNT],
-                vec![0; BUF_SIZE],
+                vec![udp::PacketMetadata::EMPTY; packet_count],
+                vec![0; buf_size],
             ),
         )
     }
@@ -238,7 +317,7 @@ impl ConnectionManager {
         icmp::Socket::new(icmp_rx_buffer, icmp_tx_buffer)
     }
 
-    fn has_active_session(
+    fn has_active_tcp_session(
         &self,
         socket_set: &SocketSet,
         dst_addr: smoltcp::wire::IpAddress,
@@ -256,6 +335,23 @@ impl ConnectionManager {
         false
     }
 
+    fn has_active_udp_session(
+        &self,
+        socket_set: &SocketSet,
+        dst_addr: smoltcp::wire::IpAddress,
+        dst_port: u16,
+    ) -> bool {
+        for (_, socket) in socket_set.iter() {
+            if let Some(udp) = udp::Socket::downcast(socket) {
+                let endpoint = udp.endpoint();
+                if endpoint.addr == Some(dst_addr) && endpoint.port == dst_port {
+                    return true;
+                }
+            }
+        }
+        false
+    }
+
     pub fn cleanup(&mut self, socket_set: &mut SocketSet) {
         for handle in self.sockets_to_remove.drain(..) {
             debug!(%handle, "Memory free: removing socket from set");
@@ -264,12 +360,8 @@ impl ConnectionManager {
             self.failed_until.remove(&handle);
         }
     }
-    pub fn setup_sockets(n_udp: usize, n_icmp: usize) -> SocketSet<'static> {
-        let mut sockets = SocketSet::new(Vec::with_capacity(n_udp + n_icmp + 10));
-
-        for _ in 0..n_udp {
-            sockets.add(Self::create_udp_socket());
-        }
+    pub fn setup_sockets(n_icmp: usize) -> SocketSet<'static> {
+        let mut sockets = SocketSet::new(Vec::with_capacity(256));
 
         for _ in 0..n_icmp {
             sockets.add(Self::create_icmp_socket());

client/src/tun/engine.rs

@@ -1,3 +1,4 @@
+use netrunner_core::proxy::connection::muxer::Muxer;
 use smoltcp::iface::PollResult;
 use smoltcp::time::Instant;
 use smoltcp::wire::{IpAddress, IpCidr};
@@ -31,7 +32,6 @@ pub struct Engine {
     device: VirtTunDevice,
     to_smoltcp_tx: UnboundedSender<TokenBuffer>,
     from_smoltcp_rx: Option<UnboundedReceiver<TokenBuffer>>,
-
     avail: Arc<AtomicBool>,
 }
 
@@ -39,16 +39,16 @@ impl Engine {
     pub fn new(
         config: Config,
         caps: DeviceCapabilities,
-        ip: String,
         dns_handler: DnsHandler,
+        muxer: Muxer,
     ) -> Self {
         let now = Engine::current_time();
 
         let (mut device, to_smoltcp_tx, from_smoltcp_rx, avail) = VirtTunDevice::new(caps);
         let interface = Interface::new(config, &mut device, now);
 
-        let socket_set = ConnectionManager::setup_sockets(64, 4);
-        let manager = ConnectionManager::new(ip, dns_handler);
+        let socket_set = ConnectionManager::setup_sockets(4);
+        let manager = ConnectionManager::new(dns_handler, muxer);
 
         Self {
             interface,