Show HN: Wiretap – Transparent WireGuard proxy server without root
1–10 of 19 posts
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#2The focus here is on the fact that it runs in userspace. Tailscale in userspace does something similar where it receives packet "meta-data" and then just creates the packet that came through the tunnel and sends it out the lan interface. Is this what happens here? I do like the docker option ;)
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#3The focus here is on the fact that it runs in userspace. Tailscale in userspace does something similar where it receives packet "meta-data" and then just creates the packet that came through the tunnel and sends it out the lan interface. Is this what happens here? I do like the docker option ;)
Yes! It’s very similar to what Tailscale does in userspace mode, written as more of a standalone utility
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#4Hilarious name for an open source project released by a government lab.
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#5Wireproxy can do similar stuff: https://github.com/octeep/wireproxy
(Disclaimer: I am a contributor to Wireproxy)
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#6The focus here is on the fact that it runs in userspace. Tailscale in userspace does something similar where it receives packet "meta-data" and then just creates the packet that came through the tunnel and sends it out the lan interface. Is this what happens here? I do like the docker option ;)
Yes! It’s very similar to what Tailscale does in userspace mode, written as more of a standalone utility
Thanks! That's pretty cool. I will definitely have to try that. I could think of some sweet applications. Especially in a secured Kubernetes cluster.
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#7I’m not sure to understand what makes it different from WireGuard. Could someone eli5 ?
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#8Wire this to Lightning and profit.
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#9I’m not sure to understand what makes it different from WireGuard. Could someone eli5 ?
Userspace capability. Especially when running inside containers.
Re: Show HN: Wiretap – Transparent WireGuard proxy server without root
#10I’m not sure to understand what makes it different from WireGuard. Could someone eli5 ?
Vanilla WireGuard doesn't provide a way to run a peer in userspace that can proxy traffic between another peer and an endpoint such as a web server because you need to be privileged to do things like work with raw packets. However, https://github.com/WireGuard/wireguard-go is a userspace implementation of WireGuard and has recently incorporated Google's userspace networking stack. This project uses these two userspace tools to "fake" a privileged WireGuard peer that proxies TCP, UDP, and (a small subset of) ICMP. It was written as a pentesting/red team utility for my team but it can also serve as a general makeshift VPN when you don't have privileges on a box you want to proxy through.
Edit: typo