路由与多 WAN

Routing and multi-WAN

多网卡、VLAN、源地址路由；NAT、端口转发和防火墙；VRRP 主备；CAKE 流量整形（带宽和包速率上限、按主机公平）。

Several NICs, VLANs, source routing; NAT, port forwards and a firewall; VRRP failover; CAKE shaping (bandwidth and packet-rate caps, per-host fairness).

IPv6

SLAAC 和稳定隐私地址、IPv6 路由与转发、Hurricane Electric 6in4 隧道客户端；容器默认 ULA 加 NAT66。

SLAAC with stable-privacy addresses, IPv6 routing and forwarding, a Hurricane Electric 6in4 tunnel client; containers get ULA with NAT66 by default.

智能流控

Attack protection

攻击识别与公平限速：SYN cookie 和 SYN 代理、扫描识别（降级、封锁）、每个来源的新建连接和并发上限、出站 25 端口默认封锁；自动模式只在受攻击时启用，几乎不耗转发性能。

SYN cookies and a SYN proxy, scan detection (demote, then block), per-source connection rates and limits, outbound port 25 blocked by default; the automatic mode acts only under attack and costs almost no forwarding performance.

容器

Containers

自己用 Rust 写的容器运行时：Docker 风格的命令、compose 文件、OCI 镜像；也能跑 LXC 云镜像这样的系统容器（每个容器独立 IP，可直接 SSH）。各自的根目录、进程空间、网络和内存/CPU/磁盘配额，端口映射运行中可改。

Our own container runtime in Rust: Docker-style commands, compose files, OCI images; also system containers such as LXC cloud images (an IP of their own, SSH straight in). Own root, process space, network and memory / CPU / disk quotas; port mappings change while they run.

Linux 程序

Linux programs

Linux 兼容层按 man page 和 POSIX 实现：Debian 13 的 bash、apt、dpkg、python3、pip，Go 程序（静态和 cgo）原样运行；文件映射写时复制、多个进程共用，小内存容器里也能装软件。

A Linux compatibility layer built from man pages and POSIX: Debian 13's bash, apt, dpkg, python3 and pip, and Go programs (static and cgo) run unchanged; file mappings are shared and copied on write, so small containers can install software too.

VPN

WireGuard 服务端与客户端（含 WARP 一键注册），L2TP 服务端多实例与拨号客户端。

WireGuard server and client (WARP sign-up built in), L2TP servers per address and dial-out clients.

代理与网站

Proxies and websites

SOCKS5 / HTTP 代理与 AnyTLS；静态站点与反向代理，Let's Encrypt 自动签发——本站就跑在 RustROS 上。

SOCKS5 / HTTP proxies and AnyTLS; static sites and reverse proxying with Let's Encrypt built in — this site runs on RustROS.

存储

Storage

标准 ext4（日志、元数据校验、扩展属性、项目配额），在线扩容和缩小；拿到 Linux 上也能直接读写。配置放在崩溃安全的键值存储里。

Standard ext4 (journal, metadata checksums, extended attributes, project quotas), grown and shrunk online; Linux reads and writes it as it is. Settings live in a crash-safe key-value store.

管理

Management

包管理器 pkg（签名校验）、网页管理、控制台、加密的在线更新；托管主机提供 HTTPS 节点接口（Ed25519 签名请求），供面板统一管理。

A package manager, pkg (signed releases), a web admin, a console, encrypted online updates; hosting nodes offer an HTTPS node API (Ed25519-signed requests) for a central panel.