Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxy
github.com
github.com
I use it to selectively proxy Firefox tabs using multi-account containers to a home router that speaks Wireguard (but no application-layer proxying protocol or SSH).
I had a socks server running in docker that turned Forticlient, the worst corporate vpn solution ever, into socks so then I could use access the internal urls in one container, still have fast internet elsewhere, and not expose my computer's entire network traffic to Forticrap.
1. You click the Multi-Account Containers extension icon
2. Select "Manage Containers"
3. Select the container that you want to use for this purpose
4. Click "Advanced proxy settings"
5. Enter the address. For example, `socks://us-nyc-wg-socks5-301.relays.mullvad.net:1080` if I'm using one of Mullvad's NYC servers
This supposes you're already connected to one of Mullvad's wireguard servers.
You can also use the FoxyProxy extension [0] for finer-control or extend this behavior across all tabs.
[0]: https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-sta...
Am I correct in thinking it needs a separate extension to set that up, like this one? https://addons.mozilla.org/en-GB/firefox/addon/container-pro...
Edit: I was not correct, which is apparently grounds for downvotes now.
Somebody has the detailed steps in a sibling comment.
They do advertise their own service, but there’s an option to use a custom proxy instead.
I used to do a similar thing using a Docker container on a Raspberry Pi, but being able to run this on any OS and with a guarantee that it won’t accidentally mess up the host’s routing table makes the user space solution a much better choice in my view.
Now I also wanted to re-use this interface for some websites I visited, and the easy way to do that was to configure rules in foxyproxy to use a socks proxy for that, which is where soks come into play.
I don't doubt that wireproxy is useful to many!
(was there a question in it?)
It uses a userspace TCP/IP stack by Google, as far as I understand.
It uses gVisor for that.
With that, you can replace a Dialer in Go that connects sockets, effectively wrapping sockets with Wireguard. Since it does that in userspace, you get no tun/tap. This is all open-sourced by @dpeckett
With those things, he also built a userspace wireguard gateway that includes DNS resolution. https://github.com/noisysockets/gateway
One of the recent feature divergences from upstream is support for network exit nodes / gateways.
Somewhat related tool: pproxy, can, among many other things, "convert" different tunnel protocols into each other. Also features routing capabilities. I used it to turn an SSH SOCKS5 into an HTTP proxy. https://github.com/moreati/pproxy
- [sing-box](https://github.com/SagerNet/sing-box)
- [clash-meta](https://github.com/muink/Clash.Meta) and other clash-based clients
- [xray](https://github.com/xtls/xray-core)
For me, SOCKS over SSH has always been pretty performant, unlike e.g. OpenSSH's TUN mode (since that ends up doing TCP over TCP).
It does multiplex multiple TCP sockets over a single underlying connection though, which can cause increased latency depending on how SSH schedules sends for each individual buffer. (Too fine-grained and you waste a lot of overhead on headers and framing; too coarse and you get head-of-line blocking.)
There are also TCP fairness concerns: In a bottleneck, like a congested home Internet connection's uplink serving n total TCP connections, traffic generally splits equally across TCP flows; if you're multiplexing m SOCKS connections over one SSH connection, all those together seize only 1/n of the bottleneck capacity, i.e. each individual one gets 1/(m*n). An (UDP-based) VPN though would get 1/n of the bandwidth per tunneled TCP flow, i.e. m/n in total.
In a way, `ssh -D` is a bit like HTTP/2 that way, while this tool is more like HTTP/3 / QUIC.
SOCKS existed before SSH did, and there are SOCKS server implementations that don't rely on SSH.
If you slap that into a container image and expose the socks port tailscale listens on, bada bing, bada proxy!
If you want something like this specifically for Mullvad VPN, I've had a good experience with https://github.com/imiric/mullvad-proxy (not my project, just forked it for some updates). What I like is that it embeds the Mullvad CLI tool, so switching servers is trivial, and it's all isolated from the host machine. It's also "just" nginx and some scripts, so it should have good SOCKS5 support.
https://mullvad.net/en/blog/wireguard-configuration-tool-has...
Added to that their official client has heaps of functionality I have no use for, and wireproxy does everything I want for this usecase with a comparatively tiny amount of code(5MB vs 400MB built). I started the evening with a wg-quick generated config that required root, and ended it using a simple unprivileged daemon that I can toggle easily.
If you must, the very last protocol you should use is HTTP/HTTP3.
1. Privacy 2. Security 3. Anonymity
Wireguard covers everything except your endpoints (anonymity).
Adding any more wrapper of a non-routing protocol will leak even more info: I can safely say this as one who creates filters for IDS/IPS/NDS/XNS.
If you want to cover the last vestige of your endpoints and not lose any more info, you would use a routing-type protocol, encrypted or not, onion-layer or not.
Otherwise you may be able to use SSH's SOCKS proxy mode if you can directly SSH, e.g. ssh -D 3128 user@host .. will listen on port 3128 as a SOCKS proxy.
One is a connection allowing you access to a private network for whatever purposes, which is what this feature enables.
The other is routing ALL your networking through it to disguise where you're located.
Confusing and confounding the two leads to disaster.