8 ms·
A userspace WireGuard client that exposes itself as a proxy
- AviationAtom 5y agoThis sounds pretty useful for gaining access to resources on your network, from a machine without elevated privs.
- flatiron 5y agoOr a new drop bear for yah know…shenanigans.
- metadat 5y agoThis sounds neat, I wonder if some people might intentionally open their network to the public via this tool as some kind of experiment. Could be fun. (The below is meant to be tongue-in-cheek:) >>> APT for your network... in a box! Market now ripe for someone to use this to deliver APT4UaaS.
- AdamJacobMuller 5y agotailscale supports something similar. I use it, inside CI runner jobs, to enable network access to things behind firewalls/nat. Really great solution.
- mistrial9 5y ago"things" ?
- AdamJacobMuller 5y agoThings. I have tailscale running on a lot of devices. Servers, workstations, raspberry pi, various other appliances, SFPs.
- UnlockedSecrets 5y agoYou are running tailscale on an SFP???
- chrisweekly 5y agoI had to look it up: https://en.m.wikipedia.org/wiki/Small_form-factor_pluggable_transceiver https://en.m.wikipedia.org/wiki/Small_form-factor_pluggable_...
- UnlockedSecrets 5y agoYes that is what they are, But what SFP actually has the ability to be programmable to the degree that is needed to support Wireguard??
- mbreese 5y agohttps://blog.benjojo.co.uk/post/smart-sfp-linux-inside https://blog.benjojo.co.uk/post/smart-sfp-linux-inside This SFP has an embedded ARM processor running Linux. It’s pretty meta, but one could imagine a wireguard control network for these. The article even describes using wireguard-go on the embedded side.
- AdamJacobMuller 4y agoYeah I'm a bit crazy, as someone else pointed out, it's a https://plumspace.com/ https://plumspace.com/ smart SFP.
- Scaevolus 5y agoExcellent. I've been wanting something like this for a while to use with Mullvad, but had to resort to docker containers instead. This plays well with proxychains to make proxy-naive programs use SOCKS5 proxies.
- RL_Quine 5y agoMullvad exposes socks proxies over wireguard.
- MallocVoidstar 5y agoMullvad's SOCKS proxies are only accessible if you've got the VPN active; they're an additional layer, not an alternative.
- RL_Quine 5y agoThat is not true. You can route only traffic to the SOCKS proxies if you choose and nothing else.
- novok 5y agoWhat do you mean by that? Mullvad doesn't have a generally accessible socks proxy like PIA does, that works with or without having the VPN on. The proxy is a localhost one for the most part so you can prevent an app from going online without having your vpn client on first.
- MallocVoidstar 5y agoDo you have a source for this? Every page on Mullvad I've seen says you need to have the VPN active: https://mullvad.net/en/help/socks5-proxy/ https://mullvad.net/en/help/socks5-proxy/ > If you configure your browser, for example, to use the SOCKS5 proxy, it will direct all of your internet access via the proxy which is only accessible through Mullvad. So if you haven't turned on the app, your browser will prevent all internet access and therefore won't leak any information.
- nonrandomstring 5y agoVery useful. Config looks easy to set up. Will explore. Thanks.
- tptacek 5y agoThis is good stuff. There should be, ideally, one really good tool for doing plugboard-y stunnel-y type stuff with user-mode WireGuard, where you don't need root to set up the tunnels, and this could be that.
- TedDoesntTalk 5y agoWhy wouldn’t you just run ssh -D to the remote machine? The effect is the same and you don’t need wire guard or wire proxy.
- hotpotamus 5y agoPresumably you'd use it on a machine that doesn't expose SSH. That said, I really like sshuttle for this use case when SSH is available.
- octeep 5y agoI made it because my friends and I use wireguard to have a private network, and they don't feel comfortable running a ssh server on their machines. It can also be used with a vpn provider like Mullvad without setting up a new nic or requiring special privs.
- ignoramous 5y agoI want to point out a caveat to others: Proxifier != VPN wireproxy's wg only forwards TCP and UDP. I am not sure how ICMP is handled. Other transports, though rarely used, won't be tunneled (and may leak, if not dropped).
- octeep 5y agoTo clarify, UDP is not currently supported, but I intend to support it in the future. Incoming ICMP should be completely dropped, and outgoing ICMP is not supported.
- chockchocschoir 5y agoMost importantly missing: DNS, which usually is handled over UDP (changing slowly now with DNS-over-HTTPS and some TCP resolvers). Without handling DNS requests via your proxy, you're still leaking information about yourself to the resolver you're using.
- TedDoesntTalk 5y ago
- warner_of_doom 5y agoWhat about UDP?
- tptacek 5y agoWhat about it? WireGuard uses UDP. You don't need privileges to open up a UDP socket.
- warner_of_doom 5y agoDoes this SOCKS5 tunnel support UDP?
- tptacek 5y agoOh! I don't think so; at least, I don't think go-socks5 does.
- jeltz 5y agoSOCKS5 supports UDP, but yeah it does not look like go-socks5 does.
- warner_of_doom 5y agoDoes Rust support it?
- tptacek 5y agoThe Rust user-mode WireGuard proxy mentioned upthread does UDP. Netstack does UDP as well; it's just that this particular tool doesn't, yet.
- octeep 5y agoNot yet unfortunately. I'll add it in the future, but I'm preoccupied with homework right now.
- momothereal 5y agoPlug for my own similar project: https://github.com/aramperes/onetun https://github.com/aramperes/onetun Though admittedly, mine doesn't have SOCKS support, and the code is not as lean as yours!
- tptacek 5y agoNeat! How does yours work? The Go version of this is easy to write, because wireguard-go has helpers to drive Netstack, which is also written in Go. But yours is in Rust. (I could have dug in, but I'm being lazy).
- momothereal 5y agoSure, essentially it's a TCP and UDP server that: - receives connections and assigns a random internal port for it - wraps the data packets in a transport(TCP/UDP) packet that's routed from the internal port to the remote - wraps the transport in an IP packet that's routed from the address assigned the the proxy, and to the remote WireGuard address - wraps that with WireGuard's protocol (encryption) - sends off the encrypted packet to the public WireGuard UDP endpoint The packet-wrapping and TCP state machine is implemented using smoltcp in Rust, which is similar to netstack in Go The WireGuard encapsulation and state machine is implemented with boringtun, Cloudflare's implementation of the WireGuard client in Rust. I do have a more thorough architecture explanation in the Readme: https://github.com/aramperes/onetun#architecture https://github.com/aramperes/onetun#architecture
- tptacek 5y agosmoltcp! That's what I was looking for. Thanks!
- russdill 5y agoSee also https://github.com/russdill/tunsocks https://github.com/russdill/tunsocks Basically a kitchen sink for this sort of thing using lwIP for it's IP stack
- robryk 5y agoDo I understand correctly that this assumes that there's only one wireguard peer?
- octeep 5y agoYes, and supporting multiple peers isn't really on my todo list. I guess you can host multiple wireproxy instances for each peers.
- CyberRabbi 5y agoI love wireguard but my one gripe with it is that its not a true data link layer. You have to give it routing information through an out of band mechanism “AllowedIPs.” One downside is that you can’t have two peers that act as general routers on the same wireguard network. With Ethernet, you can have multiple nodes in the same subnet acting as generic routers, it’s just a matter of sending IP packets to that host. I hope someday wireguard addresses this issue and makes itself fully transparent as a data link layer.
- mercora 5y agoi just wish i could control the routing via routing tables instead, making dynamic routing decisions possible without specialized software that is able to manipulate it.
- 3np 5y agoYou can. You just need to use the right tools. See my uncle comment.
- mercora 5y agojust so you know, your assumption i am not using the right tools feels almost insulting to me considering i made no claim about any tooling used. i am using systemd-networkd to setup networking anywhere, i never touch wg-quick because it is no fit for my use cases. i have multiple routing tables and do policy routing and i would really like to have the "via" in the routing tables to have a meaning to wireguards crypto routing thing. i.e. i want to be able to set "AllowedIPs" based upon the routing table very similar to reverse path filtering. i know i can setup multiple interfaces with multiple keys to exchange and multiple ports to set and to make sure every client that needs to is kept in sync.... but it would be much nicer if i could handle it like an ip-ip tunnel and make routing decisions with software build for this purpose.
- deleted 5y ago[deleted]
- 5y ago
- tormock 5y agoWireGuard Implementation for ESP-IDF: https://github.com/trombik/esp_wireguard https://github.com/trombik/esp_wireguard
- tenebrisalietum 5y agoIs this reinventing OpenVPN?
- tptacek 5y agoNo. The "userspace" here refers to the TCP/IP stack, not the VPN implementation.
- amogoLP17 5y agoVery cool! It's very useful! Thanks for sharing!=]
- NabiDev 5y agoIt is inconvenient to rewrite config from original wireguard config file.
- deleted 5y ago[deleted]
- lincw 5y agoBy the way, I wanna if there is any way I can connect wireguard server through a proxy. Thank for answering first.
- captainmuon 5y agoIt would be really cool if you could use something like this in-process to open a "socket" that just happens to route over wireguard or another VPN. E.g. you could easily have a bittorrent client use a certain VPN without routing all your traffic over it, or you could have a tab container in firefox use one connection, and another container another connection.
- Fritsdehacker 5y agoIn Linux you can also use network namespaces for this. Although you can't have your application run in multiple namespaces simultaneously, I think. The websocket approach is a lot easier to configure, so I'm definitely going to look in to this.
- mosselman 5y agoThis is cool! I was looking for something to integrate into an automated downloading setup. I had already setup a docker container that connected to wireguard and then the other containers would connect to the internet through that one, but doing it with socks is a lot easier and more of an out-of-the-box config. Decreasing complexity. Very nice!
- oriettaxx 5y agoI don't get it, can someone explain? (we use a lot wireguard but I don't get it :( ) thanks
- m00dy 5y agouserspace means that the code runs in userspace so, it doesn't require admin privileges. So, it is great if you are not the root. Exposing socks5 is great, so that another userspace process can use it. So, let's say you would like to run a torrent client in a restrictive environment, you can setup this and then through sock5 interface, you might be able to bypass firewall around it.
- oriettaxx 5y agouh, now I've got it, thank! :)
- hansel_der 5y agomake it run on windows with a simple gui, subtly ask for donations and you're golden
- lxgr 5y agoThis is great, thank you! I used to run OpenVPN in a Docker container together with a SOCKS proxy for this exact use case (using a commercial VPN provider that doesn't offer SOCKS with different endpoints on a per-site/per-tab basis, without wanting to change my default route or non-browser traffic), but this is much more efficient (and safer).
- rixtox 5y agoA Docker solution[1] for the same thing using the official client. Performance can’t be compared with native kernel mode of course, but same technique can be used for other global proxy like OpenVPN.[2] [1] https://hub.docker.com/r/curve25519xsalsa20poly1305/wireguard https://hub.docker.com/r/curve25519xsalsa20poly1305/wireguar... [2] https://hub.docker.com/r/curve25519xsalsa20poly1305/openvpn/ https://hub.docker.com/r/curve25519xsalsa20poly1305/openvpn/