wireproxy

> where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that. You can run wireguard in userspace with something like wireproxy which connects to a wireguard peer and acts as a proxy for your subprocess. [1] https://github.com/windtf/wireproxy

> the options to use socks proxies I pair it with wireproxy [0]. This way you can assign any Wireguard-capable VPN for specific containers. It's extremely useful. [0] https://github.com/windtf/wireproxy

Thanks chjj. Yeah it's always LD_PRELOAD. There is wireproxy [1] though that might do what you want? 1. https://github.com/whyvl/wireproxy

> For Firefox, I create a separate profile. Firefox supports per-container (and as such per-tab) SOCKS proxies, which I find really useful. So useful, in fact, that I've come full circle and I am now running a userspace Wireguard to SOCKS proxy [1] in order to have that convenience for a VPN which does not have any host I could SSH to. [1] https://github.com/whyvl/wireproxy

Per-container proxy settings are already supported. I use them for a "home" container that gets routed via my home router's Wireguard VPN independently from all other traffic on my computer (as I don't want to take the performance hit of tunneling everything) using the excellent wireproxy [1]. [1] https://github.com/whyvl/wireproxy

It's likely just `tailscale serve https / <upstream>`. https://github.com/tailscale/tailscale/blob/main/ipn/serve.g... And they also support direct embedding: https://tailscale.dev/blog/embedded-funnel I think this is built on the wireguard-go + gvisor mashup, that allows you to do this with just Wireguard: https://github.com/WireGuard/wireguard-go/tree/master/tun/ne... One of my favorite applications of this is this little tool that turns Wireguard VPNs into SOCKS5 proxies (which you can selectively enable in your browser) https://github.com/octeep/wireproxy

Sure, you can bridge in either direction (using e.g. this [1] excellent Wireguard-to-SOCKS adapter), but in my view, if you have bytestream semantics, you're often better off using a bytestream-oriented proxying protocol (like SOCKS, SSH or HTTP) and vice versa. These bridges/adapters do have their applications though – I have a home router that supports Wireguard natively, but not any of the higher-level protocols; this lets me use my per-tab approach with it. [1] https://github.com/pufferffish/wireproxy

Wireproxy can do similar stuff: https://github.com/octeep/wireproxy (Disclaimer: I am a contributor to Wireproxy)