Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

github.com

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#21

Post by chazeon »

Several multi-protocol proxy clients support this functionality, some notable open-source examples include:

  - [sing-box](https://github.com/SagerNet/sing-box)
  - [clash-meta](https://github.com/muink/Clash.Meta) and other clash-based clients
  - [xray](https://github.com/xtls/xray-core)
Close-sourced client include [Surge Mac/iOS](https://nssurge.com/).

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#22

Post by rahimnathwani »

yjftsjthsd-h wrote: post #12
lxgr wrote: post #10

Earlier quoted context omitted.

What do you mean by "vanilla" SOCKS, i.e. as opposed to what other type of SOCKS implementation? For me, SOCKS over SSH has always been pretty performant, unlike e.g. OpenSSH's TUN mode (since that ends up doing TCP over TCP).

By vanilla, I mean `ssh -D`, as opposed to anything else that can offer a SOCKS port without actually transporting over ssh (ex. this project). Last time I compared, that was noticeably slower than wireguard, which yeah I attributed to TCP over TCP being kinda awful.

I'm curious why you refer to 'ssh -D' as 'vanilla SOCKS'?

SOCKS existed before SSH did, and there are SOCKS server implementations that don't rely on SSH.

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#23

Post by omgitsu »

poorman wrote: post #17

Nice! I was just thinking it would be sweet to have something like this to proxy all my Thunderbird email connections through my Tailscale exit node, without having to direct all my traffic through the exit node.

You can also install 3proxy or squid proxy on the machine running the exit node and any machine that is on the tailnet can see use it

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#25

Post by yjftsjthsd-h »

rahimnathwani wrote: post #22
yjftsjthsd-h wrote: post #12

Earlier quoted context omitted.

By vanilla, I mean `ssh -D`, as opposed to anything else that can offer a SOCKS port without actually transporting over ssh (ex. this project). Last time I compared, that was noticeably slower than wireguard, which yeah I attributed to TCP over TCP being kinda awful.

I'm curious why you refer to 'ssh -D' as 'vanilla SOCKS'? SOCKS existed before SSH did, and there are SOCKS server implementations that don't rely on SSH.

Ah, well that's quite simple: I'm dumb:) Or ignorant rather. But seriously, until reading your comment it never once occurred to me that it wasn't invented by (open)ssh; I assumed one of the "S"s stood for SSH (probably "SOCKets over Ssh"). And better yet, because that made sense, it never crossed my mind to question it. So, uh, thanks:)

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#27

Post by sjy »

Scarbutt wrote: post #26

Isn't this already easily achievable with ssh? with 'ssh -D[port] foo@somehost' ssh will act as a SOCKS server.

That's fine if you control the endpoint and want to expose ssh on it, but WireGuard endpoints are also commonly available from VPN providers who don't provide shell access.

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#28

Post by JNRowe »

sjy wrote: post #27
Scarbutt wrote: post #26

Isn't this already easily achievable with ssh? with 'ssh -D[port] foo@somehost' ssh will act as a SOCKS server.

That's fine if you control the endpoint and want to expose ssh on it, but WireGuard endpoints are also commonly available from VPN providers who don't provide shell access.

That is the situation that lead to me to wireproxy; I had a need to use Cloudflare Warp, and no desire to entrust their apt repository with updates to my system.

Added to that their official client has heaps of functionality I have no use for, and wireproxy does everything I want for this usecase with a comparatively tiny amount of code(5MB vs 400MB built). I started the evening with a wg-quick generated config that required root, and ended it using a simple unprivileged daemon that I can toggle easily.

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#29

Post by riedel »

chazeon wrote: post #21

Several multi-protocol proxy clients support this functionality, some notable open-source examples include: - [sing-box](https://github.com/SagerNet/sing-box) - [clash-meta](https://github.com/muink/Clash.Meta) and other clash-based clients - [xray](https://github.com/xtls/xray-core) Close-sourced client include [Surge Mac/iOS]( https://nssurge.com/ ).

Was about to say this. Those multiprotocol proxies (presumably build to climb the Great Firewall) are an interesting microcosm. Tons of possibilities for obscure traffic routing. Also have android implementations. Used them just to open up a hotspot on a non hotspot SIM and non-rooted android a time ago. I am always wondering how trustworthy they are because they are packing tons of code taken from all over the net and have a quite interesting developer community for obvious reasons.

Re: Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy

#30

Post by fransje26 »

lxgr wrote: post #5

Great little tool! I use it to selectively proxy Firefox tabs using multi-account containers to a home router that speaks Wireguard (but no application-layer proxying protocol or SSH).

Would you happen to have any good resources explaining how such a setup could be configured?
Post reply on HN