Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
On Sun, 4 Oct 2020 15:41:52 +0330 Rudi C wrote: > I use Wireguard to circumvent Iran's censorship. A major problem with > it is that it's very hard to selectively proxy specific domains/apps > through Wireguard, while leaving others alone. This is an essential > feature for Iran's internet, as: > 1. The connection is terrible, so avoiding using the proxy for > uncensored sites helps a lot. > 2. International traffic is 2x more expensive, so avoiding the proxy > for internal traffic is very beneficial. > 3. Some internal sites ban international IPs and need Iranian IPs. > > The easiest way to solve this program, as far as I understand, is to > add the ability to expose the tunnel as a socks5 proxy on the client > side. This is the approach that shadowsocks, v2ray, etc have adopted. > There are mature solutions to selectively routing traffic through a > socks proxy. > > I searched around, and there are docker containers that already do > this wireguard-to-socks thing; But running docker is expensive on a > non-Linux machine, so it'd be much appreciated if you could support > exposing socks and HTTP proxy servers natively. If you tunnel to a VPS abroad, just install a SOCKS proxy on the remote end. A good one is [1]. Then set the remote end's in-VPN IP and proxy port in your apps to use. [1] https://socks-relay.sourceforge.io/ To separate which sites use which proxy (or no proxy) SwitchSharp for Chrome and FoxyProxy for Firefox, but you probably already know about those. In case you meant connecting to commercial "VPN" services, then yes it becomes a bit more complex, but you can try srelay on the local machine and use the "-J" option, "outbound interface name". But I'm not sure if that would just work on its own, or also needs some help from ip(6)tables or ip-rule. -- With respect, Roman
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
> On Fri, Oct 9, 2020 at 4:52 PM Roman Mamedov wrote: > just install a SOCKS proxy These simple solutions get blocked by the DPI. (I do have my own VPS.) > you can try srelay on the local machine and use the "-J" option, "outbound interface name". But I'm not sure if that would just work on its own, or also needs some help from ip(6)tables or ip-rule. Can you give me some pointers to what I should study to grok these? I know the basic TCP/IP theoretical stuff, but I have almost no experience in practical networking.
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
On Fri, 9 Oct 2020 17:00:31 +0330 Rudi C wrote: > > On Fri, Oct 9, 2020 at 4:52 PM Roman Mamedov wrote: > > just install a SOCKS proxy > > These simple solutions get blocked by the DPI. (I do have my own VPS.) Seems like you misunderstand what I mean. If you use the in-VPN (internal) IP of your VPS, all communication with the SOCKS proxy installed on the VPS will happen via the WireGuard tunnel. No DPI can look into that. -- With respect, Roman
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
> On Fri, Oct 9, 2020 at 5:04 PM Roman Mamedov wrote: > Seems like you misunderstand what I mean. If you use the in-VPN (internal) IP > of your VPS, all communication with the SOCKS proxy installed on the VPS will > happen via the WireGuard tunnel. No DPI can look into that. You're right! Some questions: 1. What should I do client-side so that wireguard only covers my VPS's IP (and does not otherwise route traffic)? Will `AllowedIPs = SERVER_IP/32` do it? 2. How do I get the in-VPN IP of the server? Is it `Address` in `[Interface]`? 3. I use ufw for the firewall on the server. Will ufw block my local machine? If not, with what IP should I set ufw rules? (My local machine doesn't have a static IP.) Of course, I could alternatively expose the socks proxy to the world with a password; How secure will that be?
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
On Fri, 9 Oct 2020 17:16:18 +0330 Rudi C wrote: > > On Fri, Oct 9, 2020 at 5:04 PM Roman Mamedov wrote: > > Seems like you misunderstand what I mean. If you use the in-VPN (internal) > > IP > > of your VPS, all communication with the SOCKS proxy installed on the VPS > > will > > happen via the WireGuard tunnel. No DPI can look into that. > > You're right! Some questions: > 1. What should I do client-side so that wireguard only covers my VPS's > IP (and does not otherwise route traffic)? Will `AllowedIPs = > SERVER_IP/32` do it? SERVER_IP should be the in-VPN IP here, otherwise yes, and remove .0.0.0/0 and ::/0 from AllowedIPs. > 2. How do I get the in-VPN IP of the server? Is it `Address` in `[Interface]`? Yes. You can confirm via "ip addr list dev wgX" on the server. > 3. I use ufw for the firewall on the server. Will ufw block my local > machine? If not, with what IP should I set ufw rules? (My local > machine doesn't have a static IP.) Of course, I could alternatively > expose the socks proxy to the world with a password; How secure will > that be? Sorry, not familiar with ufw; generally you need to allow only connections from the WG interface, or from the internal IP range (or just the "Address =" of the client), and block all others. -- With respect, Roman
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
Do you have a linux-based gateway you can manage yourself? And that gateway has dnsmasq and iptables/netfilter available? If yes then you can selectively route traffic over a wireguard interface and leave the rest to go to default. Warning... this is expert stuff... in dnsmasq.static set list of all the domains you want to send over wireguard... ipset=/example.com/VPN_LIST_IPV4,VPN_LIST_IPV6 ipset=/example.org/VPN_LIST_IPV4,VPN_LIST_IPV6 Export some environment variables... VPN2IF="wg2" VPN2IP="10.11.12.13" VPN2DNS="8.8.8.8" INTIF="eth1" INTIP="192.168.0.1" And execute the following to create the wireguard interface, setup the network routing and iptables rules, etc... Note that your system may use just "iptables" for IPv4 rather than "ip4tables" and that your firewall netfilter chains might be named differently from mine. But if you are familiar enough with iptables/netfilter then you should be able to figure it out... # = # Route traffic to select domains over $VPN2IF # Start by creating a wireguard VPN interface if ! ip link show dev $VPN2IF >/dev/null 2>&1; then ip link add dev $VPN2IF type wireguard ip address add dev $VPN2IF $VPN2IP/32 wg setconf $VPN2IF /etc/wireguard/$VPN2IF.conf ip link set up dev $VPN2IF fi # route DNS IP address over the VPN in default routing table ip route add $VPN2DNS dev $VPN2IF # create a new routing table (400) with default route to VPN interface # and send all packets marked with 0x8 bit to that table ip route add default dev $VPN2IF table 400 ip rule add from $INTIP/24 fwmark 0x8/0x8 table 400 priority 2000 # create an ipset hash which dnsmasq will save all IP addresses for the domains # and add the 0x8 firewall mark to all traffic going to those destinations ipset -exist create VPN_LIST_IPV4 hash:ip family inet ip4tables -t mangle -A PREROUTING -i $INTIF -m set --match-set VPN_LIST_IPV4 dst -j MARK --set-xmark 0x8/0x8 # make sure traffic from my internal interface is permitted to forward to/from the VPN interface ip4tables -A FORWARD_CHAIN -i $INTIF -o $VPN2IF -j ACCEPT ip4tables -A FORWARD_CHAIN -i $VPN2IF -o $INTIF -j ACCEPT # and NAT traffic over the VPN ip4tables -t nat -A NAT_POSTROUTING_CHAIN -s $INTIP/24 ! -d $INTIP/24 -o $VPN2IF -j MASQUERADE # the VPN does not support IPv6 so drop all attempts to connect by IPv6 ipset -exist create VPN_LIST_IPV6 hash:ip family inet6 ip6tables -I FORWARD_CHAIN -i $INTIF -m set --match-set VPN_LIST_IPV6 dst -j DROP On Fri, Oct 9, 2020 at 10:05 AM Roman Mamedov wrote: > > On Fri, 9 Oct 2020 17:16:18 +0330 > Rudi C wrote: > > > > On Fri, Oct 9, 2020 at 5:04 PM Roman Mamedov wrote: > > > Seems like you misunderstand what I mean. If you use the in-VPN > > > (internal) IP > > > of your VPS, all communication with the SOCKS proxy installed on the VPS > > > will > > > happen via the WireGuard tunnel. No DPI can look into that. > > > > You're right! Some questions: > > 1. What should I do client-side so that wireguard only covers my VPS's > > IP (and does not otherwise route traffic)? Will `AllowedIPs = > > SERVER_IP/32` do it? > > SERVER_IP should be the in-VPN IP here, otherwise yes, and remove .0.0.0/0 > and ::/0 from AllowedIPs. > > > 2. How do I get the in-VPN IP of the server? Is it `Address` in > > `[Interface]`? > > Yes. You can confirm via "ip addr list dev wgX" on the server. > > > 3. I use ufw for the firewall on the server. Will ufw block my local > > machine? If not, with what IP should I set ufw rules? (My local > > machine doesn't have a static IP.) Of course, I could alternatively > > expose the socks proxy to the world with a password; How secure will > > that be? > > Sorry, not familiar with ufw; generally you need to allow only connections > from the WG interface, or from the internal IP range (or just the "Address =" > of the client), and block all others. > > -- > With respect, > Roman
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
Maybe I oversimplify your problem, but from what I read, your standard route will be using the Iranian net. And - I guess - it is only a limited numer of IP addresses, that you would like to reach through the tunnel. I don't know your OS, but simply adding ip routes pointing to the tunnel for the desired destinations would do the job. Chris On 09/10/2020 15:22, Roman Mamedov wrote: On Sun, 4 Oct 2020 15:41:52 +0330 Rudi C wrote: I use Wireguard to circumvent Iran's censorship. A major problem with it is that it's very hard to selectively proxy specific domains/apps through Wireguard, while leaving others alone. This is an essential feature for Iran's internet, as: 1. The connection is terrible, so avoiding using the proxy for uncensored sites helps a lot. 2. International traffic is 2x more expensive, so avoiding the proxy for internal traffic is very beneficial. 3. Some internal sites ban international IPs and need Iranian IPs. The easiest way to solve this program, as far as I understand, is to add the ability to expose the tunnel as a socks5 proxy on the client side. This is the approach that shadowsocks, v2ray, etc have adopted. There are mature solutions to selectively routing traffic through a socks proxy. I searched around, and there are docker containers that already do this wireguard-to-socks thing; But running docker is expensive on a non-Linux machine, so it'd be much appreciated if you could support exposing socks and HTTP proxy servers natively. If you tunnel to a VPS abroad, just install a SOCKS proxy on the remote end. A good one is [1]. Then set the remote end's in-VPN IP and proxy port in your apps to use. [1] https://socks-relay.sourceforge.io/ To separate which sites use which proxy (or no proxy) SwitchSharp for Chrome and FoxyProxy for Firefox, but you probably already know about those. In case you meant connecting to commercial "VPN" services, then yes it becomes a bit more complex, but you can try srelay on the local machine and use the "-J" option, "outbound interface name". But I'm not sure if that would just work on its own, or also needs some help from ip(6)tables or ip-rule.
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
On Fri, 9 Oct 2020 16:19:22 +0200 Chris wrote: > Maybe I oversimplify your problem, but from what I read, your standard route > will be using the Iranian net. > And - I guess - it is only a limited numer of IP addresses, that you would > like > to reach through the tunnel. > > I don't know your OS, but simply adding ip routes pointing to the tunnel for > the > desired destinations would do the job. OK, a desired destination would be *.youtube.com, how would you go about that? You can't add routes to domain names of websites, not to mention to wildcards of domain names; and websites can resolve into a lot of IPs, which will change randomly due to load balancing, or due to sites migrating their hosting over time. So just resolving them right now and using specific IPs likely wouldn't work for long. One solution is the browser extensions that I mentioned coupled with a SOCKS proxy on remote side. Another is what David suggests with dnsmasq and ipset, which seems like it'll be more transparent from the usage standpoint, but also more complex to set up. -- With respect, Roman
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
Another idea would be to install WireGuard in a (tiny) virtual machine or a VPS and then ssh into that machine using ssh -TD9151 u...@example.com This creates a SOCKS5 proxy on port 9151. Then, for example, you could create two Firefox profiles; one without a proxy (for the uncensored websites) and another that utilizes the SOCKS5 proxy on port 9151. The SOCKS5 proxy exposed by ssh will route all traffic over your virtual machine (example.com above), which will in turn route it through WireGuard. Since ssh can now be natively used under Windows, I'd be surprised if its -D option were not available. AFAIR, Putty can also do something similar. Best, Max On 20/10/04 03:41pm, Rudi C wrote: > I use Wireguard to circumvent Iran's censorship. A major problem with > it is that it's very hard to selectively proxy specific domains/apps > through Wireguard, while leaving others alone. This is an essential > feature for Iran's internet, as: > 1. The connection is terrible, so avoiding using the proxy for > uncensored sites helps a lot. > 2. International traffic is 2x more expensive, so avoiding the proxy > for internal traffic is very beneficial. > 3. Some internal sites ban international IPs and need Iranian IPs. > > The easiest way to solve this program, as far as I understand, is to > add the ability to expose the tunnel as a socks5 proxy on the client > side. This is the approach that shadowsocks, v2ray, etc have adopted. > There are mature solutions to selectively routing traffic through a > socks proxy. > > I searched around, and there are docker containers that already do > this wireguard-to-socks thing; But running docker is expensive on a > non-Linux machine, so it'd be much appreciated if you could support > exposing socks and HTTP proxy servers natively. signature.asc Description: PGP signature
Re: [FR] How can I expose the wireguard tunnel as a socks5 proxy on the client?
Maybe this could help: https://github.com/kizzx2/docker-wireguard-socks-proxy > Le 9 oct. 2020 à 15:26, Max R. P. Grossmann a écrit : > > Another idea would be to install WireGuard in a (tiny) virtual machine or a > VPS and then ssh into that machine using > > ssh -TD9151 u...@example.com > > This creates a SOCKS5 proxy on port 9151. > > Then, for example, you could create two Firefox profiles; one without a proxy > (for the uncensored websites) and another that utilizes the SOCKS5 proxy on > port 9151. The SOCKS5 proxy exposed by ssh will route all traffic over your > virtual machine (example.com above), which will in turn route it through > WireGuard. > > Since ssh can now be natively used under Windows, I'd be surprised if its -D > option were not available. AFAIR, Putty can also do something similar. > > Best, > > Max > > On 20/10/04 03:41pm, Rudi C wrote: >> I use Wireguard to circumvent Iran's censorship. A major problem with >> it is that it's very hard to selectively proxy specific domains/apps >> through Wireguard, while leaving others alone. This is an essential >> feature for Iran's internet, as: >> 1. The connection is terrible, so avoiding using the proxy for >> uncensored sites helps a lot. >> 2. International traffic is 2x more expensive, so avoiding the proxy >> for internal traffic is very beneficial. >> 3. Some internal sites ban international IPs and need Iranian IPs. >> >> The easiest way to solve this program, as far as I understand, is to >> add the ability to expose the tunnel as a socks5 proxy on the client >> side. This is the approach that shadowsocks, v2ray, etc have adopted. >> There are mature solutions to selectively routing traffic through a >> socks proxy. >> >> I searched around, and there are docker containers that already do >> this wireguard-to-socks thing; But running docker is expensive on a >> non-Linux machine, so it'd be much appreciated if you could support >> exposing socks and HTTP proxy servers natively.