ChatGPT led me to tunsafe however the project seems to be abandoned?
I’m trying to find ways to convert wireguard traffic into plain HTTPS so as to not trigger some advanced DPI. So far, I have come across udp2raw and updtunnel which convert the traffic to TCP, but AFAIK the SSL used in Wireguard triggers DPIs.
Does anyone have a workaround? Thanks!
Everyone, there seems to be a way go achieve this:
Wireguard (change port to 443) + udp2raw or udptunnel to convert packets to TCP + stunnel (configured on both client and server - used by OpenVPN to encapsulate traffic in TLS).
This is basically what OpenVPN does, and theoretically this should do OK. I haven’t tested it however, so if you have, please let us know!
I’m aware that it is encrypted, however DPIs can pick out Wireguard traffic (due to the behaviour of SSL used in the protocol) and can identify/deny Wireguard traffic. I don’t want that to happen. OpenVPN has a way to mask its traffic, I’m trying to see if anyone has done anything of the sort with Wireguard
That wouldn’t help with deep packet inspection but only those firewalls too lazy to check what’s actually being sent there. Even then I doubt it would work because WireGuard uses UDP, not TCP.
I know it doesn’t do shit against DPI, but you would be amazed at the amount of firewalls in corporate networks, hotels and public places that’ll be able to bypass by just running WG on port 443 or 80.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
Wireguard is e2e encrypted, no middleman can inspect the packets without the private keys.
I’m aware that it is encrypted, however DPIs can pick out Wireguard traffic (due to the behaviour of SSL used in the protocol) and can identify/deny Wireguard traffic. I don’t want that to happen. OpenVPN has a way to mask its traffic, I’m trying to see if anyone has done anything of the sort with Wireguard
shadowsocks seems to be the best way for now.
Thank you. It’s between this and SoftEther now
You can try putting it on pretty 443 or another tls port. It’s not a perfect solution but it could help for your specific setup.
Unfortunately, that is not enough
Yes this is a good way to baypass a lot of commercial firewalls.
That wouldn’t help with deep packet inspection but only those firewalls too lazy to check what’s actually being sent there. Even then I doubt it would work because WireGuard uses UDP, not TCP.
I know it doesn’t do shit against DPI, but you would be amazed at the amount of firewalls in corporate networks, hotels and public places that’ll be able to bypass by just running WG on port 443 or 80.
OP wants to circumvent deep packet inspection.