7 ms·
A userspace WireGuard client that exposes itself as a proxy
- tptacek 4y agoThis is good stuff. There should be, ideally, one really good tool for doing plugboard-y stunnel-y type stuff with user-mode WireGuard, where you don't need root to set up the tunnels, and this could be that.
- mosselman 4y agoThis is cool! I was looking for something to integrate into an automated downloading setup. I had already setup a docker container that connected to wireguard and then the other containers would connect to the internet through that one, but doing it with socks is a lot easier and more of an out-of-the-box config. Decreasing complexity. Very nice!
- hansel_der 4y agomake it run on windows with a simple gui, subtly ask for donations and you're golden
- amogoLP17 4y agoVery cool! It's very useful! Thanks for sharing!=]
- AviationAtom 4y agoThis sounds pretty useful for gaining access to resources on your network, from a machine without elevated privs.
- flatiron 4y agoOr a new drop bear for yah know…shenanigans.
- metadat 4y agoThis sounds neat, I wonder if some people might intentionally open their network to the public via this tool as some kind of experiment. Could be fun. (The below is meant to be tongue-in-cheek:) >>> APT for your network... in a box! Market now ripe for someone to use this to deliver APT4UaaS.
- AdamJacobMuller 4y agotailscale supports something similar. I use it, inside CI runner jobs, to enable network access to things behind firewalls/nat. Really great solution.
- mistrial9 4y ago"things" ?
- AdamJacobMuller 4y agoThings. I have tailscale running on a lot of devices. Servers, workstations, raspberry pi, various other appliances, SFPs.
- UnlockedSecrets 4y agoYou are running tailscale on an SFP???
- AdamJacobMuller 4y agoYeah I'm a bit crazy, as someone else pointed out, it's a https://plumspace.com/ https://plumspace.com/ smart SFP.
- chrisweekly 4y agoI had to look it up: https://en.m.wikipedia.org/wiki/Small_form-factor_pluggable_transceiver https://en.m.wikipedia.org/wiki/Small_form-factor_pluggable_...
- UnlockedSecrets 4y agoYes that is what they are, But what SFP actually has the ability to be programmable to the degree that is needed to support Wireguard??
- 4y ago
- Scaevolus 4y agoExcellent. I've been wanting something like this for a while to use with Mullvad, but had to resort to docker containers instead. This plays well with proxychains to make proxy-naive programs use SOCKS5 proxies.
- RL_Quine 4y agoMullvad exposes socks proxies over wireguard.
- MallocVoidstar 4y agoMullvad's SOCKS proxies are only accessible if you've got the VPN active; they're an additional layer, not an alternative.
- RL_Quine 4y agoThat is not true. You can route only traffic to the SOCKS proxies if you choose and nothing else.
- novok 4y agoWhat do you mean by that? Mullvad doesn't have a generally accessible socks proxy like PIA does, that works with or without having the VPN on. The proxy is a localhost one for the most part so you can prevent an app from going online without having your vpn client on first.
- MallocVoidstar 4y agoDo you have a source for this? Every page on Mullvad I've seen says you need to have the VPN active: https://mullvad.net/en/help/socks5-proxy/ https://mullvad.net/en/help/socks5-proxy/ > If you configure your browser, for example, to use the SOCKS5 proxy, it will direct all of your internet access via the proxy which is only accessible through Mullvad. So if you haven't turned on the app, your browser will prevent all internet access and therefore won't leak any information.
- nonrandomstring 4y agoVery useful. Config looks easy to set up. Will explore. Thanks.
- TedDoesntTalk 4y agoWhy wouldn’t you just run ssh -D to the remote machine? The effect is the same and you don’t need wire guard or wire proxy.
- deleted 4y ago[deleted]
- octeep 4y agoI made it because my friends and I use wireguard to have a private network, and they don't feel comfortable running a ssh server on their machines. It can also be used with a vpn provider like Mullvad without setting up a new nic or requiring special privs.
- ignoramous 4y agoI want to point out a caveat to others: Proxifier != VPN wireproxy's wg only forwards TCP and UDP. I am not sure how ICMP is handled. Other transports, though rarely used, won't be tunneled (and may leak, if not dropped).
- octeep 4y agoTo clarify, UDP is not currently supported, but I intend to support it in the future. Incoming ICMP should be completely dropped, and outgoing ICMP is not supported.
- chockchocschoir 4y agoMost importantly missing: DNS, which usually is handled over UDP (changing slowly now with DNS-over-HTTPS and some TCP resolvers). Without handling DNS requests via your proxy, you're still leaking information about yourself to the resolver you're using.
- TedDoesntTalk 4y agoSOCKS5 supports DNS queries. Not sure if this project implements it though.
- warner_of_doom 4y agoWhat about UDP?
- octeep 4y agoNot yet unfortunately. I'll add it in the future, but I'm preoccupied with homework right now.
- warner_of_doom 4y agoThanks.
- hansel_der 4y agoi have yet to encounter a case where a udp-tunnel has a practical advantage over tcp; on the other hand, corporate/hotel/coffeeshop firewalls that block anything not tcp/443 are super commom.
- tptacek 4y agoWhat about it? WireGuard uses UDP. You don't need privileges to open up a UDP socket.
- warner_of_doom 4y agoDoes this SOCKS5 tunnel support UDP?
- momothereal 4y agoPlug for my own similar project: https://github.com/aramperes/onetun https://github.com/aramperes/onetun Though admittedly, mine doesn't have SOCKS support, and the code is not as lean as yours!
- tptacek 4y agoNeat! How does yours work? The Go version of this is easy to write, because wireguard-go has helpers to drive Netstack, which is also written in Go. But yours is in Rust. (I could have dug in, but I'm being lazy).
- momothereal 4y agoSure, essentially it's a TCP and UDP server that: - receives connections and assigns a random internal port for it - wraps the data packets in a transport(TCP/UDP) packet that's routed from the internal port to the remote - wraps the transport in an IP packet that's routed from the address assigned the the proxy, and to the remote WireGuard address - wraps that with WireGuard's protocol (encryption) - sends off the encrypted packet to the public WireGuard UDP endpoint The packet-wrapping and TCP state machine is implemented using smoltcp in Rust, which is similar to netstack in Go The WireGuard encapsulation and state machine is implemented with boringtun, Cloudflare's implementation of the WireGuard client in Rust. I do have a more thorough architecture explanation in the Readme: https://github.com/aramperes/onetun#architecture https://github.com/aramperes/onetun#architecture
- tptacek 4y agosmoltcp! That's what I was looking for. Thanks!
- russdill 4y agoSee also https://github.com/russdill/tunsocks https://github.com/russdill/tunsocks Basically a kitchen sink for this sort of thing using lwIP for it's IP stack
- robryk 4y agoDo I understand correctly that this assumes that there's only one wireguard peer?
- octeep 4y agoYes, and supporting multiple peers isn't really on my todo list. I guess you can host multiple wireproxy instances for each peers.
- CyberRabbi 4y agoI love wireguard but my one gripe with it is that its not a true data link layer. You have to give it routing information through an out of band mechanism “AllowedIPs.” One downside is that you can’t have two peers that act as general routers on the same wireguard network. With Ethernet, you can have multiple nodes in the same subnet acting as generic routers, it’s just a matter of sending IP packets to that host. I hope someday wireguard addresses this issue and makes itself fully transparent as a data link layer.
- mercora 4y agoi just wish i could control the routing via routing tables instead, making dynamic routing decisions possible without specialized software that is able to manipulate it.
- 3np 4y agoYou can. You just need to use the right tools. See my uncle comment.
- mercora 4y agojust so you know, your assumption i am not using the right tools feels almost insulting to me considering i made no claim about any tooling used. i am using systemd-networkd to setup networking anywhere, i never touch wg-quick because it is no fit for my use cases. i have multiple routing tables and do policy routing and i would really like to have the "via" in the routing tables to have a meaning to wireguards crypto routing thing. i.e. i want to be able to set "AllowedIPs" based upon the routing table very similar to reverse path filtering. i know i can setup multiple interfaces with multiple keys to exchange and multiple ports to set and to make sure every client that needs to is kept in sync.... but it would be much nicer if i could handle it like an ip-ip tunnel and make routing decisions with software build for this purpose.
- deleted 4y ago[deleted]
- 4y ago
- tormock 4y agoWireGuard Implementation for ESP-IDF: https://github.com/trombik/esp_wireguard https://github.com/trombik/esp_wireguard
- tenebrisalietum 4y agoIs this reinventing OpenVPN?
- tptacek 4y agoNo. The "userspace" here refers to the TCP/IP stack, not the VPN implementation.
- NabiDev 4y agoIt is inconvenient to rewrite config from original wireguard config file.
- deleted 4y ago[deleted]
- lincw 4y agoBy the way, I wanna if there is any way I can connect wireguard server through a proxy. Thank for answering first.
- captainmuon 4y agoIt would be really cool if you could use something like this in-process to open a "socket" that just happens to route over wireguard or another VPN. E.g. you could easily have a bittorrent client use a certain VPN without routing all your traffic over it, or you could have a tab container in firefox use one connection, and another container another connection.
- Fritsdehacker 4y agoIn Linux you can also use network namespaces for this. Although you can't have your application run in multiple namespaces simultaneously, I think. The websocket approach is a lot easier to configure, so I'm definitely going to look in to this.
- oriettaxx 4y agoI don't get it, can someone explain? (we use a lot wireguard but I don't get it :( ) thanks
- m00dy 4y agouserspace means that the code runs in userspace so, it doesn't require admin privileges. So, it is great if you are not the root. Exposing socks5 is great, so that another userspace process can use it. So, let's say you would like to run a torrent client in a restrictive environment, you can setup this and then through sock5 interface, you might be able to bypass firewall around it.
- oriettaxx 4y agouh, now I've got it, thank! :)
- lxgr 4y agoThis is great, thank you! I used to run OpenVPN in a Docker container together with a SOCKS proxy for this exact use case (using a commercial VPN provider that doesn't offer SOCKS with different endpoints on a per-site/per-tab basis, without wanting to change my default route or non-browser traffic), but this is much more efficient (and safer).
- rixtox 4y agoA Docker solution[1] for the same thing using the official client. Performance can’t be compared with native kernel mode of course, but same technique can be used for other global proxy like OpenVPN.[2] [1] https://hub.docker.com/r/curve25519xsalsa20poly1305/wireguard https://hub.docker.com/r/curve25519xsalsa20poly1305/wireguar... [2] https://hub.docker.com/r/curve25519xsalsa20poly1305/openvpn/ https://hub.docker.com/r/curve25519xsalsa20poly1305/openvpn/