What about UDP?
What about it? WireGuard uses UDP. You don't need privileges to open up a UDP socket.
Does this SOCKS5 tunnel support UDP?
A userspace WireGuard client that exposes itself as a proxy
21–30 of 91 posts
Re: A userspace WireGuard client that exposes itself as a proxy
#22Excellent. I've been wanting something like this for a while to use with Mullvad, but had to resort to docker containers instead. This plays well with proxychains to make proxy-naive programs use SOCKS5 proxies.
Mullvad exposes socks proxies over wireguard.
Mullvad's SOCKS proxies are only accessible if you've got the VPN active; they're an additional layer, not an alternative.
Re: A userspace WireGuard client that exposes itself as a proxy
#23Plug for my own similar project: https://github.com/aramperes/onetun
Though admittedly, mine doesn't have SOCKS support, and the code is not as lean as yours!
Re: A userspace WireGuard client that exposes itself as a proxy
#24Re: A userspace WireGuard client that exposes itself as a proxy
#25Plug for my own similar project: https://github.com/aramperes/onetun Though admittedly, mine doesn't have SOCKS support, and the code is not as lean as yours!
Neat! How does yours work? The Go version of this is easy to write, because wireguard-go has helpers to drive Netstack, which is also written in Go. But yours is in Rust. (I could have dug in, but I'm being lazy).
Re: A userspace WireGuard client that exposes itself as a proxy
#26Do I understand correctly that this assumes that there's only one wireguard peer?
Re: A userspace WireGuard client that exposes itself as a proxy
#27Earlier quoted context omitted.
You are running tailscale on an SFP???
I had to look it up: https://en.m.wikipedia.org/wiki/Small_form-factor_pluggable_...
Yes that is what they are, But what SFP actually has the ability to be programmable to the degree that is needed to support Wireguard??
Re: A userspace WireGuard client that exposes itself as a proxy
#28Earlier quoted context omitted.
I had to look it up: https://en.m.wikipedia.org/wiki/Small_form-factor_pluggable_...
Yes that is what they are, But what SFP actually has the ability to be programmable to the degree that is needed to support Wireguard??
https://blog.benjojo.co.uk/post/smart-sfp-linux-inside
This SFP has an embedded ARM processor running Linux. It’s pretty meta, but one could imagine a wireguard control network for these. The article even describes using wireguard-go on the embedded side.
Re: A userspace WireGuard client that exposes itself as a proxy
#29Plug for my own similar project: https://github.com/aramperes/onetun Though admittedly, mine doesn't have SOCKS support, and the code is not as lean as yours!
Neat! How does yours work? The Go version of this is easy to write, because wireguard-go has helpers to drive Netstack, which is also written in Go. But yours is in Rust. (I could have dug in, but I'm being lazy).
Sure, essentially it's a TCP and UDP server that:
- receives connections and assigns a random internal port for it
- wraps the data packets in a transport(TCP/UDP) packet that's routed from the internal port to the remote
- wraps the transport in an IP packet that's routed from the address assigned the the proxy, and to the remote WireGuard address
- wraps that with WireGuard's protocol (encryption)
- sends off the encrypted packet to the public WireGuard UDP endpoint
The packet-wrapping and TCP state machine is implemented using smoltcp in Rust, which is similar to netstack in Go
The WireGuard encapsulation and state machine is implemented with boringtun, Cloudflare's implementation of the WireGuard client in Rust.
I do have a more thorough architecture explanation in the Readme: https://github.com/aramperes/onetun#architecture
Re: A userspace WireGuard client that exposes itself as a proxy
#30Why wouldn’t you just run ssh -D to the remote machine? The effect is the same and you don’t need wire guard or wire proxy.
One simple reason is that the serverside might not want to expose a shell to its clients, and instead just provide network connectivity; you can configure something like that with SSH, but it's a pain, and WireGuard is approximately as simple to set up as SSH, which is the primary reason it's so popular.
And it's crypto is "very good" (so I've heard, not an expert)
And it's fast/low overhead.
And yea, surprisingly easy, "just works"
I lurk their maillist, seems a nice group.