Commenters heavily criticize the project's security claims, arguing that wrapping WireGuard in a custom transport increases attack surface and that 'stealth' capabilities are easily defeated by modern deep packet inspection. Conversely, other voices defend the approach as a pragmatic solution for circumventing censorship and argue that layering transports does not inherently compromise the underlying protocol's security.
77 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4erebe
wstunnel
Rust2019–2025
erebe / wstunnel
wstunnel
Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available
11Distinct people
19Mentions
1Explicit recommenders
7.2KGitHub stars
What to know before exploring
What it is
Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
Recently on a cruise ship I found my SSH access blocked. And HTTP proxies were blocked too. So I used a WebSocket proxy and that worked great. I highly recommend wstunnel.…
paulddraper used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- bfix/tor-dns · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
Mentions over time
HN mentions by year19 dated mentions
Observed mentions: 2019-10-30 02:55:05 UTC to 2025-08-29 04:07:55 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 9 | 1 | 8 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
What Hacker News says
19 sources0X0xbadcafebee·Aug 29, 2025
Wireguard or OpenVPN might work, if someone has a server set up, set up your client to connect.
If those don't work you can try something like wssocks (https://github.com/genshen/wssocks) or wstunnel (https://github.com/erebe/wstunnel). It tunnels connections through WebSockets, so you can make the connection look like a regular HTTPS connection. Another option would just be a regular-old HTTPS proxy (Nginx, Apache2, etc). Set up an HTTPS proxy somewhere on the internet, connect through it, but configure it to return a regular web page if someone tries to make a non-proxy connection through it. Another tool that may help setting up is chisel (https://github.com/jpillora/chisel). Those HTTPS ones may work if, when authorities connect to the host, it returns pages that look like some kind of private video server. (Maybe run an actual video
Read the rest
server, in addition to the proxy...) Also, try to enforce TLS 1.3 for the HTTPS server.
And another option, if all else fails, is to run a straight-up SOCKS proxy over the internet, on a weird port. It might be so obvious they aren't looking for it.
To mask your DNS requests with the SOCKS proxy, use something like Tor-DNS (https://github.com/bfix/Tor-DNS), or set up a VPN through the SOCKS proxy and use DNS through that route. Another option is DNS-over-HTTPS.
We've had success using wireguard over wstunnel in places where wireguard is blocked.
https://github.com/erebe/wstunnel
In Ask HN: The government of my country blocked VPN access. What should I use?If you need decent speed, than could also try this:
https://www.stunnel.org/downloads.html
with the optional:
https://github.com/bfix/Tor-DNS.git
or go with the more modern:
https://github.com/erebe/wstunnel
Best regards, =3
In Malaysia started mandating ISPs to redirect DNS queries to local serversShameless plug, you can use wstunnel which disguise your traffic as websocket to tunnel any traffic you want. I had most success with it, as it uses TCP, than with QUIC/HTTP3 as usually UDP is more heavily restricted.
It works behind GFW and let you use your wireguard for example...
I had also good feedback from people in Turkey and Iran
wstunnel: https://github.com/erebe/wstunnel
In VPN ban is strangling communication in MyanmarWsTunnel – Tunnel Your Traffic over WebSocket or HTTP2 – Bypass Firewalls/DPI
3 points · Open discussionWsTunnel improved a lot since last shared/communicated version, with the addition of:
- Reverse tunneling \o/
- Added support of unix socket, transparent proxy/ip, UDP for socks5
- Support of mTLS
- Config file to restrict the allowed tunnels
- Cerfificate and config auto-reload
- Added http2 as transport protocol (websocket is more performant)
- Complete rewrite fron Haskell to Rust
Hope you enjoy and find it useful :-)
https://github.com/erebe/wstunnel?tab=readme-ov-file#underst...
In WsTunnel – Tunnel Your Traffic over WebSocket or HTTP2 – Bypass Firewalls/DPINice project :)
HTTP3 may not be suitable for all environments, as UDP is pretty commonly filtered.
If you are in such scenario, you may want to take a look at wstunnel, it allows you to do the same (and more) over websocket or HTTP2.
https://github.com/erebe/wstunnel
In Reverst: Reverse Tunnels in Go over HTTP/3 and QUICYou can easily setup a reverse tunnel with something like websockets or HTTP/2 (TCP). For example with wstunnel[1].
[1] https://github.com/erebe/wstunnel
In Reverst: Reverse Tunnels in Go over HTTP/3 and QUICShameless plug, there is also wstunnel (i am its author) https://github.com/erebe/wstunnel/, hope you enjoy.
In Tell HN: Russia has started blocking OpenVPN/WireGuard connectionsYou can use wstunnel to bypass firewall. I had many feedbacks from chinese/turkish/iranian people using it with success.
Easy to setup also with static binaries.
https://github.com/erebe/wstunnel/
In Tell HN: Russia has started blocking OpenVPN/WireGuard connectionsIf you want to tunnel UDP (WireGuard) or TCP (SSH) over the WebSocket protocol, check out https://github.com/erebe/wstunnel
In SSH3: SSHv2 using HTTP/3 and QUICTunnel all your traffic over WebSocket protocol
2 points · Open discussionWhile working in an environment where VPN connections were pretty much all blocked⁰ a friend of mine had success using https://guacamole.apache.org/ to access a remote machine¹. Not quite the same as a direct VPN connection but worth a try if nothing else functions, it looks enough like normal HTTPS traffic that he got away with it.
To keep your wireguard setup more as-is, you could try https://kirill888.github.io/notes/wireguard-via-websocket/ to tunnel that via a web server. In fact https://github.com/erebe/wstunnel which that uses could be used just as well with any other UDP based VPN.
I once tinkered with https://github.com/yarrick/iodine and successfully connected to resources over the wireless on a train, bypassing its traffic capture and sign-up requirement, so that might be an option, though I think fully blocking external DNS is
Read the rest
more common now so this is less likely to work²³.
--
[0] practically only HTTP(S) permitted, not even SSH, DPI in use that detected just using SSH or OpenVPN over port 443
[1] NOTE: be careful breaching restrictions like this, you are at risk of an insta-sacking if discovered, or worse if operating in some securiry environments!
[2] and the latency when it does work is significant!
[3] and that much traffic over port 53 might get noticed by the heuristics of data exfiltration scanner, encouraging sysadmins to notice and implement a way to block it
If you have a server/cheap vpc outside the blocking zone, you can use websocket tunneling.
https://github.com/erebe/wstunnel (linux + mac + windows)
In GoodbyeDPI: Deep Packet Inspection circumvention utilityShowing the 15 most recent of 19 sources. Enable JavaScript to search and browse every indexed mention.