6

Wireguard is pretty hot these days, deservedly so. I'm also eager to replace OpenVPN by Wireguard.

However, unlike OpenVPN, Wireguard only supports UDP. I like to use TCP port 443 because this port is likely not blocked by a firewall. OpenVPN even has an option to use an HTTP proxy. This is pretty cool, because it enables me to get full, unrestricted internet access in networks that don't have a route to the internet and require users to use a web proxy instead.

How can I achieve the same with wireguard? An HTTPS tunnel that works for UDP?

Let's assume both endpoints are running Linux, I have full root access to both, and of course I have permission by everyone involved to do this.

Improve this question
3
  • Is TLS (the TLS layer around HTTP, without HTTP itself) good enough? A firewall shouldn't be able to tell the difference...
    – A.B
    Aug 19, 2018 at 23:35
  • That would be a good start, but that still does not replace the OpenVPN feature of using a HTTP proxy
    – Volker
    Aug 20, 2018 at 9:51
  • Ok but then you should provide your reverse proxy HTTP server settings. The tag isn't present, and since the "endpoint" method would change, better know before
    – A.B
    Aug 20, 2018 at 12:47

3 Answers 3

Reset to default
3

This seems to do exactly what I want, even though you need cntlm as an additional proxy if the proxy requires NTLM authentication.

Improve this answer
1

The official documentation says why they don't support TCP and DPI [1]

WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation

For TCP tunneling they suggest using udp2raw[2] or udptunnel[3].

Note this only covers TCP tunneling, it wont mask it over HTTP(S) so it won't be protected if your firewall performs Deep packet Inspection or header analysis etc . You would need more a advanced setup for that.

  1. https://www.wireguard.com/known-limitations/
  2. https://github.com/wangyu-/udp2raw
  3. https://github.com/rfc1036/udptunnel
Improve this answer
2
  • I'm aware of the TCP-over-TCP argument. However, OpenVPN over TCP was never really an issue for me, performance-wise. Plus, terrible performance of TCP-over-TCP is better than no performance in case UDP connections are blocked entirely. And as I explained in my question, I sometimes have the use case where a web proxy is the only way to communicate with the outside world.
    – Volker
    Nov 17, 2021 at 8:40
  • I am not saying your requirement is not valid, just that WireGuard project thinks this is to be done by separate abstraction layer as obfuscation is not a project goal for them. udp2raw is a solid project to transmit over TCP over perhaps 443, however it won't be masked as HTTPS traffic if you have DPI based blocks. For something like that you should consider SOCKS + Wireguard . This project github.com/kizzx2/docker-wireguard-socks-proxy may be useful
    – Manquer
    Nov 17, 2021 at 23:32
0

Could run a SSH VPN (using ssh on port 443) and run the Wireguard over the interfaces created.

Probably could also run Wireguard over your existing OpenVPN.

The premise of Wireguard appears to be connectionless by design so I doubt a TCP or HTTP feature is coming soon (sorry).

Improve this answer
1
  • 2
    SSH VPN can't use an HTTP proxy and running wireguard on top of OpenVPN defeats the purpose. I realize this won't be coming as a wireguard feature and I understand why, that's why I think an extra tool for this would be useful.
    – Volker
    Aug 19, 2018 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.