onetun

There's also onetun. https://github.com/aramperes/onetun

If you haven't seen it, Cloudflare also has an implementation of Wireguard in userspace, called Boringtun [0], written in Rust and successfully deployed to millions of iOS and Android devices running the 1.1.1.1 app. For reference, another Rust project that depends on Boringtun is Onetun [1], which uses it to encrypt packets sent over a virtual smoltcp interface. I imagine you could follow a similar approach to integrating rust-9p with Boringtun, and you wouldn't need to leave the Rust ecosystem (whereas you might face more obstacles integrating it with Tailscale's wgengine, which is written in Go). [0] https://github.com/cloudflare/boringtun [1] https://github.com/aramperes/onetun

Sure, essentially it's a TCP and UDP server that: - receives connections and assigns a random internal port for it - wraps the data packets in a transport(TCP/UDP) packet that's routed from the internal port to the remote - wraps the transport in an IP packet that's routed from the address assigned the the proxy, and to the remote WireGuard address - wraps that with WireGuard's protocol (encryption) - sends off the encrypted packet to the public WireGuard UDP endpoint The packet-wrapping and TCP state machine is implemented using smoltcp in Rust, which is similar to netstack in Go The WireGuard encapsulation and state machine is implemented with boringtun, Cloudflare's implementation of the WireGuard client in Rust. I do have a more thorough architecture explanation in the Readme: https://github.com/aramperes/onetun#architecture

Plug for my own similar project: https://github.com/aramperes/onetun Though admittedly, mine doesn't have SOCKS support, and the code is not as lean as yours!