Wireproxy

https://github.com/windtf/wireproxy
Admin
Wireproxy is a userspace WireGuard client that connects to a WireGuard peer and exposes itself as a...
Tokens:12,344
Snippets:90
Trust Score:7
License:ISC
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install wireproxy with go install

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Install wireproxy using go install. Specify a version tag or use @latest.

```bash
go install github.com/windtf/wireproxy/cmd/wireproxy@v1.1.2 # or @latest
```

--------------------------------

### Download wireproxy.service with cURL

Source: https://github.com/windtf/wireproxy/blob/master/systemd/README.md

Downloads the wireproxy.service unit file from the repository and installs it to /etc/systemd/system/.

```bash
curl https://raw.githubusercontent.com/windtf/wireproxy/master/systemd/wireproxy.service | sudo tee /etc/systemd/system/wireproxy.service
```

--------------------------------

### Wireproxy configuration for incoming peer connections

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Configuration example showing how to allow peers to connect to the Wireproxy instance. The [Interface] sets a ListenPort, and the [Peer] section omits an Endpoint, indicating that the peer initiates the connection.

```ini
[Interface]
ListenPort = 5400
...

[Peer]
PublicKey = YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY=
AllowedIPs = 10.254.254.100/32
# Note there is no Endpoint defined here.
```

--------------------------------

### Full wireproxy configuration example

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Complete sample configuration for wireproxy. Includes [Interface] and [Peer] sections with WireGuard settings, and tunnel sections: [TCPClientTunnel], [TCPServerTunnel], [STDIOTunnel], [Socks5], [http], and [SNI]. Optional settings like MTU, PresharedKey, PersistentKeepalive, authentication, and domain whitelisting are shown as comments.

```ini
# The [Interface] and [Peer] configurations follow the same semantics and meaning
# of a wg-quick configuration. To understand what these fields mean, please refer to:
# https://wiki.archlinux.org/title/WireGuard#Persistent_configuration
# https://www.wireguard.com/#simple-network-interface
[Interface]
Address = 10.200.200.2/32 # The subnet should be /32 and /128 for IPv4 and v6 respectively
# MTU = 1420 (optional)
PrivateKey = uCTIK+56CPyCvwJxmU5dBfuyJvPuSXAq1FzHdnIxe1Q=
# PrivateKey = $MY_WIREGUARD_PRIVATE_KEY # Alternatively, reference environment variables
DNS = 10.200.200.1

[Peer]
PublicKey = QP+A67Z2UBrMgvNIdHv8gPel5URWNLS4B3ZQ2hQIZlg=
# PresharedKey = UItQuvLsyh50ucXHfjF0bbR4IIpVBd74lwKc8uIPXXs= (optional)
Endpoint = my.ddns.example.com:51820
# PersistentKeepalive = 25 (optional)

# TCPClientTunnel is a tunnel listening on your machine,
# and it forwards any TCP traffic received to the specified target via wireguard.
# Flow:
# <an app on your LAN> --> localhost:25565 --(wireguard)--> play.cubecraft.net:25565
[TCPClientTunnel]
BindAddress = 127.0.0.1:25565
Target = play.cubecraft.net:25565

# TCPServerTunnel is a tunnel listening on wireguard,
# and it forwards any TCP traffic received to the specified target via local network.
# Flow:
# <an app on your wireguard network> --(wireguard)--> 172.16.31.2:3422 --> localhost:25545
[TCPServerTunnel]
ListenPort = 3422
Target = localhost:25545

# STDIOTunnel is a tunnel connecting the standard input and output of the wireproxy
# process to the specified TCP target via wireguard.
# This is especially useful to use wireproxy as a ProxyCommand parameter in openssh
# For example:
#    ssh -o ProxyCommand='wireproxy -c myconfig.conf' ssh.myserver.net
# Flow:
# Piped command -->(wireguard)--> ssh.myserver.net:22
[STDIOTunnel]
Target = ssh.myserver.net:22

# Socks5 creates a socks5 proxy on your LAN, and all traffic would be routed via wireguard.
[Socks5]
BindAddress = 127.0.0.1:25344

# Socks5 authentication parameters, specifying username and password enables
# proxy authentication.
#Username = ...
# Avoid using spaces in the password field
#Password = ...

# Domain whitelist routing (optional). When TunnelDomains is set, only connections
# whose destination host matches one of the patterns are routed through wireguard;
# every other connection is dialed directly over your normal network. When
# TunnelDomains is unset, all traffic is routed through wireguard (default).
# Each TunnelDomains line is a single, full Go regular expression (RE2). Repeat
# the key for multiple patterns; do NOT comma-separate (so quantifiers like {2,4}
# keep working). Matching is case-insensitive and a trailing dot is ignored.
#TunnelDomains = ^(.*\.)?example\.com$
#TunnelDomains = ^ipinfo\.io$
# Set LogDomains = true to log every connection's destination host and whether it
# was routed to the TUNNEL or DIRECT. Useful for discovering which domains your
# apps reach before writing TunnelDomains. Off by default.
#LogDomains = true

# http creates a http proxy on your LAN, and all traffic would be routed via wireguard.
[http]
BindAddress = 127.0.0.1:25345

# HTTP authentication parameters, specifying username and password enables
# proxy authentication.
#Username = ...
# Avoid using spaces in the password field
#Password = ...

# Specifying certificate and key enables HTTPS
#CertFile = ...
#KeyFile = ...

# TunnelDomains / LogDomains work here too (same semantics as [Socks5] above).
#TunnelDomains = ^(.*\.)?example\.com$
#LogDomains = true

# SNI creates a transparent TLS proxy on your LAN, and all traffic would be routed via wireguard,
# using Server Name Indication as routing destination.
[SNI]
BindAddress = 0.0.0.0:443

# TunnelDomains / LogDomains work here too, matched against the TLS SNI hostname.
#TunnelDomains = ^(.*\.)?example\.com$
#LogDomains = true
```

--------------------------------

### Wireproxy configuration with single CheckAlive IP

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Configuration example with a single CheckAlive IP. This is used to demonstrate a successful /readyz response when a pong is received within the timeout.

```ini
[Interface]
PrivateKey = censored
Address = 10.2.0.2/32
DNS = 10.2.0.1
CheckAlive = 1.1.1.1
```

--------------------------------

### Start and check wireproxy service status

Source: https://github.com/windtf/wireproxy/blob/master/rc.d/README.md

Commands to start the wireproxy service and verify its status using the service command.

```shell
sudo service wireproxy start
sudo service wireproxy status
```

--------------------------------

### Wireproxy configuration with tunnels and resolve strategy

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Example Wireproxy configuration file showing the [Interface], multiple [Peer] sections, [TCPServerTunnel] entries, a [UDPProxyTunnel] with InactivityTimeout, and the [Resolve] section with ResolveStrategy. The ResolveStrategy defaults to 'auto' and can be set to 'ipv4' or 'ipv6'.

```ini
[Interface]
Address = 10.254.254.40/32
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=

[Peer]
Endpoint = 192.168.0.204:51820
PublicKey = YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY=
AllowedIPs = 10.254.254.100/32
PersistentKeepalive = 25

[Peer]
PublicKey = ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
AllowedIPs = 10.254.254.1/32, fdee:1337:c000:d00d::1/128
Endpoint = 172.16.0.185:44044
PersistentKeepalive = 25


[TCPServerTunnel]
ListenPort = 5000
Target = service-one.servicenet:5000

[TCPServerTunnel]
ListenPort = 5001
Target = service-two.servicenet:5001

[TCPServerTunnel]
ListenPort = 5080
Target = service-three.servicenet:80

[UDPProxyTunnel]
BindAddress = 127.0.0.1:53
Target = 1.1.1.1:53
InactivityTimeout = 30 # If its set to 0, it will never timeout

[Resolve]
# Set DNS Resovle Strategy
# `ipv4`: Prioritize A records.
# `ipv6`: Prioritize AAAA records       .
# `auto` (Default): If the WireGuard interface has IPv4 address only, it's equivalent to `ipv4`, otherwise it's equivalent to `ipv6`.
ResolveStrategy = auto 
```

--------------------------------

### HTTP 200 response from /readyz endpoint

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Example HTTP response from the /readyz endpoint when CheckAlive is set to a single IP and a pong has been received. The response is a 200 with a JSON body showing the last pong timestamp.

```text
< HTTP/1.1 200 OK
< Date: Thu, 11 Apr 2024 00:56:21 GMT
< Content-Length: 23
< Content-Type: text/plain; charset=utf-8
<
{"1.1.1.1":1712796979}
```

--------------------------------

### Wireproxy configuration with CheckAlive for health endpoint

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Configuration example for the health endpoint feature. It sets CheckAlive to a list of IPs and CheckAliveInterval to 3 seconds, and includes a [Socks5] section. The /readyz endpoint will respond with a 503 if a pong has not been received within the interval plus 2 seconds leeway.

```ini
[Interface]
PrivateKey = censored
Address = 10.2.0.2/32
DNS = 10.2.0.1
CheckAlive = 1.1.1.1, 3.3.3.3
CheckAliveInterval = 3

[Peer]
PublicKey = censored
AllowedIPs = 0.0.0.0/0
Endpoint = 149.34.244.174:51820

[Socks5]
BindAddress = 127.0.0.1:25344
```

--------------------------------

### HTTP 503 response from /readyz endpoint

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Example HTTP response from the /readyz endpoint when CheckAlive is set to multiple IPs and a pong has not been received from one of them within the timeout. The response is a 503 with a JSON body showing the last pong timestamps.

```text
< HTTP/1.1 503 Service Unavailable
< Date: Thu, 11 Apr 2024 00:54:59 GMT
< Content-Length: 35
< Content-Type: text/plain; charset=utf-8
<
{"1.1.1.1":1712796899,"3.3.3.3":0}
```

--------------------------------

### Build wireproxy from source

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Build wireproxy from source by cloning the repository and running make.

```bash
git clone https://github.com/octeep/wireproxy
cd wireproxy
make
```

--------------------------------

### Enable wireproxy in /etc/rc.conf

Source: https://github.com/windtf/wireproxy/blob/master/rc.d/README.md

Add this line to /etc/rc.conf to enable the wireproxy service at boot.

```shell
wireproxy_enable="YES"
```

--------------------------------

### wireproxy CLI help output

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Command-line help output for wireproxy, listing all available flags and their descriptions. Includes default config paths and the configtest mode.

```bash
usage: wireproxy [-h|--help] [-c|--config "<value>"] [-s|--silent]
                 [-d|--daemon] [-i|--info "<value>"] [-v|--version]
                 [-n|--configtest]

                 Userspace wireguard client for proxying

Arguments:

  -h  --help        Print help information
  -c  --config      Path of configuration file
                    Default paths: /etc/wireproxy/wireproxy.conf, $HOME/.config/wireproxy.conf
  -s  --silent      Silent mode
  -d  --daemon      Make wireproxy run in background
  -i  --info        Specify the address and port for exposing health status
  -v  --version     Print version
  -n  --configtest  Configtest mode. Only check the configuration file for
                    validity.
```

--------------------------------

### Import existing WireGuard config with WGConfig

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Shows how to import an existing WireGuard configuration file using the WGConfig key, then define tunnel sections with the same semantics as above. The ellipsis (...) indicates omitted settings.

```ini
WGConfig = <path to the wireguard config>

# Same semantics as above
[TCPClientTunnel]
...

[TCPServerTunnel]
...

[Socks5]
...
```

--------------------------------

### Reload systemd and enable wireproxy.service

Source: https://github.com/windtf/wireproxy/blob/master/systemd/README.md

Reloads systemd and enables/starts the wireproxy.service unit.

```bash
sudo systemctl daemon-reload
sudo systemctl enable --now wireproxy.service
```

--------------------------------

### Run wireproxy with config path

Source: https://github.com/windtf/wireproxy/blob/master/README.md

Basic command-line invocation of wireproxy. The -c flag specifies the path to the configuration file.

```bash
./wireproxy [-c path to config]
```

--------------------------------

### Customize wireproxy.service unit paths

Source: https://github.com/windtf/wireproxy/blob/master/systemd/README.md

Customizes the systemd unit to point to the wireproxy executable and configuration file. Adjust LoadCredential, ExecStartPre, and ExecStart paths as needed.

```service
LoadCredential=conf:/opt/myfiles/wireproxy.conf
ExecStartPre=/usr/bin/wireproxy -n -c ${CREDENTIALS_DIRECTORY}/conf
ExecStart=/usr/bin/wireproxy -c ${CREDENTIALS_DIRECTORY}/conf
```

--------------------------------

### Wireguard Config File for SOCKS Proxy (WGConfig)

Source: https://github.com/windtf/wireproxy/blob/master/UseWithVPN.md

Use this INI-style config to point wireproxy at a downloaded WireGuard server config and enable proxy authentication. Set a unique port for every separate server; the same user/pass can be reused across all configs.

```ini
# Link to the Downloaded config
WGConfig = /Users/jonny/vpntabs/ProtonUS.adblock.server.conf
```
Tokens:
Raw