Do I understand correctly that this assumes that there's only one wireguard peer?
Yes, and supporting multiple peers isn't really on my todo list. I guess you can host multiple wireproxy instances for each peers.
A userspace WireGuard client that exposes itself as a proxy
61–70 of 91 posts
Re: A userspace WireGuard client that exposes itself as a proxy
#62It is inconvenient to rewrite config from original wireguard config file.
I think i'm going to write a convert a wireguard config into a wireproxy config file. Hopefully that will make it easier for people to use.
Re: A userspace WireGuard client that exposes itself as a proxy
#63By the way, I wanna if there is any way I can connect wireguard server through a proxy. Thank for answering first.
Re: A userspace WireGuard client that exposes itself as a proxy
#64Earlier quoted context omitted.
You just route 10.64.0.1/24 with wireguard, or 10.124.0.1/24 to access socks proxies on other locations. Then you have socks only mullvad.
if you are routing via wireguard, the VPN is active. Note, people are not talking about the mullvad app here (which is not required at all)
The OP post also needs the "VPN active" (ie: an active connection to the VPN server). Having the VPN active does not mean it's routing all your traffic through it, what traffic is routed through it is controlled by your wireguard config/routing table. Having
AllowedIPs = 10.64.0.1/32
Re: A userspace WireGuard client that exposes itself as a proxy
#65I love wireguard but my one gripe with it is that its not a true data link layer. You have to give it routing information through an out of band mechanism “AllowedIPs.” One downside is that you can’t have two peers that act as general routers on the same wireguard network. With Ethernet, you can have multiple nodes in the same subnet acting as generic routers, it’s just a matter of sending IP packets to that host. I…
Sounds like you’re either already a Zerotier user or would be happy to discover their product.
Re: A userspace WireGuard client that exposes itself as a proxy
#66It would be really cool if you could use something like this in-process to open a "socket" that just happens to route over wireguard or another VPN.
E.g. you could easily have a bittorrent client use a certain VPN without routing all your traffic over it, or you could have a tab container in firefox use one connection, and another container another connection.
Re: A userspace WireGuard client that exposes itself as a proxy
#67It would be really cool if you could use something like this in-process to open a "socket" that just happens to route over wireguard or another VPN. E.g. you could easily have a bittorrent client use a certain VPN without routing all your traffic over it, or you could have a tab container in firefox use one connection, and another container another connection.
In Linux you can also use network namespaces for this. Although you can't have your application run in multiple namespaces simultaneously, I think.
The websocket approach is a lot easier to configure, so I'm definitely going to look in to this.
Re: A userspace WireGuard client that exposes itself as a proxy
#68This is cool! I was looking for something to integrate into an automated downloading setup. I had already setup a docker container that connected to wireguard and then the other containers would connect to the internet through that one, but doing it with socks is a lot easier and more of an out-of-the-box config. Decreasing complexity. Very nice!
Re: A userspace WireGuard client that exposes itself as a proxy
#69I love wireguard but my one gripe with it is that its not a true data link layer. You have to give it routing information through an out of band mechanism “AllowedIPs.” One downside is that you can’t have two peers that act as general routers on the same wireguard network. With Ethernet, you can have multiple nodes in the same subnet acting as generic routers, it’s just a matter of sending IP packets to that host. I…
> You have to give it routing information through an out of band mechanism “AllowedIPs.” One downside is that you can’t have two peers that act as general routers on the same wireguard network This is a common misconception, due to that this is the way wg-quick works (unfortunately IMO; presumably to make it easier, and I guess wg-quick was never meant for people with advanced needs). On a lower level, AllowedIPs is…
I'm not sure how you conclude that AllowedIPs does no routing.
> On a lower level, AllowedIPs is really just "allowed IPs", and does no routing.
This is contrary to what the official documentation says https://www.wireguard.com/#cryptokey-routing
> You can have multiple active peers with overlapping AllowedIPs.
You can, but the most specific CIDR wins route selection, which is exactly what *routing* does.
Re: A userspace WireGuard client that exposes itself as a proxy
#70Earlier quoted context omitted.
if you are routing via wireguard, the VPN is active. Note, people are not talking about the mullvad app here (which is not required at all)
The OP post also needs the "VPN active" (ie: an active connection to the VPN server). Having the VPN active does not mean it's routing all your traffic through it, what traffic is routed through it is controlled by your wireguard config/routing table. Having AllowedIPs = 10.64.0.1/32 in your wireguard config will only forward traffic bound to 10.64.0.1 (the IP Mullvad uses for their SOCKS5 proxies on wireguard connec…
An active connection but not an active system-wide network interface. The point of these tools is that the wireguard client is encapsulated together with the proxy in a simple user-mode process, with no integration into the host network stack.