# USBnet tunnels TCP over USB HID to bypass device restrictions on CH32V467

> **Key takeaway:** USBnet uses a RISC-V CH32V467 MCU to tunnel internet connectivity between two computers over USB, encapsulating traffic inside HID protocol to evade USB lockdown policies that whitelist only keyboards and mice.

**Published:** 2026-11-12T18:00:58+00:00 
**Source:** Adafruit Electronics 
**Category:** open-hardware 
**Canonical URL:** https://fosswire.org/news/usbnet-tunnels-tcp-over-usb-hid-to-bypass-device-restriction.html 

## Summary
Developer Ismael has released USBnet, an open-source firmware project for the WCH CH32V467WEU6 RISC-V microcontroller that creates a TCP tunnel between two computers over a single USB connection. The board plugs into both machines simultaneously, presenting a local HTTP proxy at 127.0.0.1:8080 on the client side while the server side handles upstream internet connections. To circumvent environments that restrict USB devices to approved classes, USBnet encapsulates its network packets within the HID protocol, masquerading as a mouse device.

The firmware supports two operational modes, relay and custom, with configuration accessible by holding the USER button during reset to enter a special configuration mode exposing the device as USBnet Configuration (1a86:fe53). Settings are stored in flash memory and editable through this interface. The project is built using WCH's RISC-V toolchain from MounRiver, and the repository includes a hardware test image that sequences through four LEDs on reset to verify board functionality.

## CH32V467 architecture and HID tunneling mechanics
- **MCU platform:** The firmware targets the WCH CH32V467WEU6, a RISC-V-based microcontroller with dual USB OTG interfaces that enable simultaneous host and device connections to two separate computers.
- **HID encapsulation:** Network packets are wrapped in HID report structures to bypass USB security policies that block composite or CDC-ACM devices while permitting keyboards and mice, with client and server endpoints performing the protocol translation.
- **Proxy architecture:** The client exposes a local HTTP proxy at 127.0.0.1:8080, while the server terminates TCP connections to internet destinations, creating a split-stack tunnel that does not require driver installation on restricted hosts.
- **Configuration mechanism:** Holding the USER button during reset enters a dedicated configuration mode with USB VID/PID 1a86:fe53, allowing profile editing of stored flash settings without reflashing firmware.
- **Build toolchain:** Firmware compilation requires WCH's RISC-V toolchain distributed through MounRiver, and the repository provides a hardware validation image that exercises LED1 through LED4 to confirm proper board operation.

## Why it matters
USBnet addresses a genuine operational security and connectivity challenge for embedded developers, security researchers, and users in locked-down enterprise or kiosk environments where USB policy enforcement blocks standard networking gadgets. By leveraging the open-source CH32V467 RISC-V ecosystem and publishing complete firmware, the project advances practical open hardware for circumvention-resistant connectivity and may inspire similar protocol-obfuscation techniques in other low-cost MCU applications.