Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

github.com

Post reply on HN
Print view View original

11–20 of 67 posts

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#11

Post by lxgr »

yjftsjthsd-h wrote: post #9
vbezhenar wrote: post #6

Is there completely userspace server implementation? Without tun/tap devices, etc. I guess some kind of userspace IP stack is necessary for that, although not sure.

Maybe https://github.com/cloudflare/boringtun or https://github.com/WireGuard/wireguard-go ?

I believe it uses the latter, but the missing piece is a userspace TCP/IP stack, since otherwise you'd need TUN device permissions to bridge over the impendence mismatch of sockets and IP packets containing TCP/UDP segments/datagrams.

It uses gVisor for that.

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#12

Post by yjftsjthsd-h »

lxgr wrote: post #10
yjftsjthsd-h wrote: post #7

How's the performance? My memory is that "vanilla" SOCKS is really easy to do (just run ssh with the right option and tell your application to use it) but really slow. I suspect this is mostly for cases where you don't have a normal SOCKS/ssh server, but I'm curious if it offers a benefit there too.

What do you mean by "vanilla" SOCKS, i.e. as opposed to what other type of SOCKS implementation? For me, SOCKS over SSH has always been pretty performant, unlike e.g. OpenSSH's TUN mode (since that ends up doing TCP over TCP).

By vanilla, I mean `ssh -D`, as opposed to anything else that can offer a SOCKS port without actually transporting over ssh (ex. this project). Last time I compared, that was noticeably slower than wireguard, which yeah I attributed to TCP over TCP being kinda awful.

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#14

Post by yjftsjthsd-h »

lxgr wrote: post #11
yjftsjthsd-h wrote: post #9

Earlier quoted context omitted.

Maybe https://github.com/cloudflare/boringtun or https://github.com/WireGuard/wireguard-go ?

I believe it uses the latter, but the missing piece is a userspace TCP/IP stack, since otherwise you'd need TUN device permissions to bridge over the impendence mismatch of sockets and IP packets containing TCP/UDP segments/datagrams. It uses gVisor for that.

Ugh, now this is driving me crazy. So I'm 99% sure that that exists, but I cannot for the life of me find the link. There's a CDN / edge compute company that gets published on HN semi-regularly that has this sweet client that... does a lot of things, but among them is connecting to your serverless containers by actually instantiating an entire TCP/IP stack in the application that's hooked up to the remote end over a wireguard proxy that's also in-application...

Edit: FLY! https://news.ycombinator.com/item?id=30275905

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#15

Post by lxgr »

yjftsjthsd-h wrote: post #12
lxgr wrote: post #10

Earlier quoted context omitted.

What do you mean by "vanilla" SOCKS, i.e. as opposed to what other type of SOCKS implementation? For me, SOCKS over SSH has always been pretty performant, unlike e.g. OpenSSH's TUN mode (since that ends up doing TCP over TCP).

By vanilla, I mean `ssh -D`, as opposed to anything else that can offer a SOCKS port without actually transporting over ssh (ex. this project). Last time I compared, that was noticeably slower than wireguard, which yeah I attributed to TCP over TCP being kinda awful.

`ssh -D` isn't TCP over TCP, though!

It does multiplex multiple TCP sockets over a single underlying connection though, which can cause increased latency depending on how SSH schedules sends for each individual buffer. (Too fine-grained and you waste a lot of overhead on headers and framing; too coarse and you get head-of-line blocking.)

There are also TCP fairness concerns: In a bottleneck, like a congested home Internet connection's uplink serving n total TCP connections, traffic generally splits equally across TCP flows; if you're multiplexing m SOCKS connections over one SSH connection, all those together seize only 1/n of the bottleneck capacity, i.e. each individual one gets 1/(m*n). An (UDP-based) VPN though would get 1/n of the bandwidth per tunneled TCP flow, i.e. m/n in total.

In a way, `ssh -D` is a bit like HTTP/2 that way, while this tool is more like HTTP/3 / QUIC.

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#16

Post by eclark »

vbezhenar wrote: post #6

Is there completely userspace server implementation? Without tun/tap devices, etc. I guess some kind of userspace IP stack is necessary for that, although not sure.

https://github.com/noisysockets/noisysockets

With that, you can replace a Dialer in Go that connects sockets, effectively wrapping sockets with Wireguard. Since it does that in userspace, you get no tun/tap. This is all open-sourced by @dpeckett

With those things, he also built a userspace wireguard gateway that includes DNS resolution. https://github.com/noisysockets/gateway

https://news.ycombinator.com/user?id=dpeckett

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#18

Post by nunez »

poorman wrote: post #17

Nice! I was just thinking it would be sweet to have something like this to proxy all my Thunderbird email connections through my Tailscale exit node, without having to direct all my traffic through the exit node.

You can use the tailscale cli as a socks proxy. https://tailscale.com/kb/1113/aws-lambda

If you slap that into a container image and expose the socks port tailscale listens on, bada bing, bada proxy!

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#19

Post by poorman »

nunez wrote: post #18
poorman wrote: post #17

Nice! I was just thinking it would be sweet to have something like this to proxy all my Thunderbird email connections through my Tailscale exit node, without having to direct all my traffic through the exit node.

You can use the tailscale cli as a socks proxy. https://tailscale.com/kb/1113/aws-lambda If you slap that into a container image and expose the socks port tailscale listens on, bada bing, bada proxy!

Oh I'll have to try that thanks!

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#20

Post by jaimehrubiks »

yjftsjthsd-h wrote: post #7

How's the performance? My memory is that "vanilla" SOCKS is really easy to do (just run ssh with the right option and tell your application to use it) but really slow. I suspect this is mostly for cases where you don't have a normal SOCKS/ssh server, but I'm curious if it offers a benefit there too.

It would be great to compare both. Currently I connect to WireGuard and then create a socks proxy using SSH. And it works surprisingly well. But I'm very interested in this solution.
Post reply on HN