How do you mask Wireguard traffic? (lemmy.world)

submitted 10 months ago* (last edited 10 months ago) by MigratingtoLemmy@lemmy.world to c/selfhosted@lemmy.world

26 comments fedilink hide all child comments

ChatGPT led me to tunsafe however the project seems to be abandoned?

I'm trying to find ways to convert wireguard traffic into plain HTTPS so as to not trigger some advanced DPI. So far, I have come across udp2raw and updtunnel which convert the traffic to TCP, but AFAIK the SSL used in Wireguard triggers DPIs.

Does anyone have a workaround? Thanks!

Everyone, there seems to be a way go achieve this:

Wireguard (change port to 443) + udp2raw or udptunnel to convert packets to TCP + stunnel (configured on both client and server - used by OpenVPN to encapsulate traffic in TLS).

This is basically what OpenVPN does, and theoretically this should do OK. I haven't tested it however, so if you have, please let us know!

you are viewing a single comment's thread
view the rest of the comments

[-] possiblylinux127@lemmy.zip -1 points 10 months ago

OpenVPN? You can literally set it to run on port 443 tcp

[-] vzq@lemmy.blahaj.zone 3 points 10 months ago

I agree. It sounds like this Rube Goldberg contraption would basically sacrifice all advantages of WireGuard.

At that point you might as well fall back to OpenVPN and at least get the reliability of a proven mature solution.

[-] MigratingtoLemmy@lemmy.world 3 points 10 months ago

True, but I just figured that it is possible to run Wireguard with stunnel, the latter is used by OpenVPN to wrap packets in TLS and masquerade as HTTPS traffic. If I can do that, and convert UDP packets to TCP with the software I mentioned in the post (changing the port is trivial), then I could achieve what I want!

[-] Jason2357@lemmy.ca 2 points 10 months ago

I used stunnel years ago to tunnel both openVPN and SSH traffic and it worked flawlessly. Looks just like https web traffic to dpi software. Beware though, that long open connections can also set off flags, so don't keep connection's open permanently.

[-] MigratingtoLemmy@lemmy.world 1 points 10 months ago

Hey, can I ask which DPI software were you using, and how did you get access to it?

[-] MigratingtoLemmy@lemmy.world 1 points 10 months ago

I see. Thanks, good to know. I'll see if I can automate opening and closing connections. However, I do think that a lot of applications (especially chat/video applications) maintain fairly long connections these days: long livestreams on YT, discord client, lemmy, Instagram etc. Basically, if you're consuming content online, there's a good chance that your device might keep the connection going.

With that said, it's important to blend in: I wonder if I can automate the disconnect-connect process on Android

this post was submitted on 30 Oct 2023

53 points (96.5% liked)

Selfhosted

39150 readers

271 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz