wireguard-go

Yes; also see: https://github.com/WireGuard/wireguard-go/blob/12269c2761734...

Would you accept https://github.com/WireGuard/wireguard-go/blob/master/tun/ne... as a solution? =) Edit: also i personally find TUN very convenient.

Upstream WireGuard (golang) has had this capability for a few years now: https://github.com/WireGuard/wireguard-go/tree/master/tun/ne...

Maybe https://github.com/cloudflare/boringtun or https://github.com/WireGuard/wireguard-go ?

It's likely just `tailscale serve https / <upstream>`. https://github.com/tailscale/tailscale/blob/main/ipn/serve.g... And they also support direct embedding: https://tailscale.dev/blog/embedded-funnel I think this is built on the wireguard-go + gvisor mashup, that allows you to do this with just Wireguard: https://github.com/WireGuard/wireguard-go/tree/master/tun/ne... One of my favorite applications of this is this little tool that turns Wireguard VPNs into SOCKS5 proxies (which you can selectively enable in your browser) https://github.com/octeep/wireproxy

Vanilla WireGuard doesn't provide a way to run a peer in userspace that can proxy traffic between another peer and an endpoint such as a web server because you need to be privileged to do things like work with raw packets. However, https://github.com/WireGuard/wireguard-go is a userspace implementation of WireGuard and has recently incorporated Google's userspace networking stack. This project uses these two userspace tools to "fake" a privileged WireGuard peer that proxies TCP, UDP, and (a small subset of) ICMP. It was written as a pentesting/red team utility for my team but it can also serve as a general makeshift VPN when you don't have privileges on a box you want to proxy through. Edit: typo

A note: wireguard-go (the official userspace impl in golang) can do this since several months back. It uses gVisor's netstack as a tcp/udp provider to forward connections to its peer (compared to whitequark's smoltcp in case of onetun). Here's a demonstration of both a http-client and a http-server running over wireguard (a poor man's QUIC, if you will): https://github.com/WireGuard/wireguard-go/tree/master/tun/ne... fly.io wrote about such a setup not long ago too: https://news.ycombinator.com/item?id=26315695 And tailscale.com similarly uses wireguard with netstack to impl functionality unavailable on non-Linux/xBSD platforms: https://news.ycombinator.com/item?id=28261683

> The story begins in April 2019 with 89476f8cb5 in which David Crawshaw, aware of all these problems, created an IP type like: It's in a PR here: https://github.com/WireGuard/wireguard-go/pull/11/files Which mentions: > Typically throughout WireGuard, we've used [4]byte for v4 and [16]byte for v6, considering the Go standard library's choice of v6-mapped-v4 to be a mistake. It actually looks useful, there's something similar in wgtypes, and I wanted to use it recently [0] but that package unfortunately doesn't expose a way to write it out to a string/buffer, so I ended up almost replicating it. [0] https://github.com/OJFord/terraform-provider-wireguard/blob/... (There's a lot of ways of presenting/parsing/constructing the same config options there! I'm sure if I were more fluent in Go there's some more succinct way.)

Why is in-kernel Wireguard a priority? I'm happily using https://github.com/WireGuard/wireguard-go with no issues to speak of, on FreeBSD.

Unless I'm mistaken, wireguard-go[0] only runs the WireGuard protocol code in userspace rather than the kernel. It still requires configuring network interfaces which requires root. [0]: https://github.com/WireGuard/wireguard-go

There is a go implementation of WireGuard with a fairly hefty warning at the top. [0] There's also official documentation for how a userspace implementation should behave. [1] The android version of WireGuard has a userspace implementation for devices without WireGuard in the kernel, which at the moment is pretty much all. [0] https://github.com/WireGuard/wireguard-go [1] https://www.wireguard.com/xplatform/

There is also an official user space implementation. The performance is not bad at all. [1] https://github.com/WireGuard/wireguard-go.