Submitted 8 months ago by MigratingtoLemmy@lemmy.world to selfhosted@lemmy.world
ChatGPT led me to tunsafe however the project seems to be abandoned?
I’m trying to find ways to convert wireguard traffic into plain HTTPS so as to not trigger some advanced DPI. So far, I have come across udp2raw and updtunnel which convert the traffic to TCP, but AFAIK the SSL used in Wireguard triggers DPIs.
Does anyone have a workaround? Thanks!
I have found 3 different possible solutions to the problem but not sure if anyone in the community has done this yet. Thanks for the link.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| IP | Internet Protocol |
| SSL | Secure Sockets Layer, for transparent encryption |
| TCP | Transmission Control Protocol, most often over IP |
| UDP | User Datagram Protocol, for real-time communications |
| VPN | Virtual Private Network |
[Thread #253 for this sub, first seen 30th Oct 2023, 16:40] [FAQ] [Full list] [Contact] [Source code]
Good bot
OpenVPN? You can literally set it to run on port 443 tcp
True, but I just figured that it is possible to run Wireguard with stunnel, the latter is used by OpenVPN to wrap packets in TLS and masquerade as HTTPS traffic. If I can do that, and convert UDP packets to TCP with the software I mentioned in the post (changing the port is trivial), then I could achieve what I want!
I used stunnel years ago to tunnel both openVPN and SSH traffic and it worked flawlessly. Looks just like https web traffic to dpi software. Beware though, that long open connections can also set off flags, so don’t keep connection’s open permanently.
I agree. It sounds like this Rube Goldberg contraption would basically sacrifice all advantages of WireGuard.
At that point you might as well fall back to OpenVPN and at least get the reliability of a proven mature solution.
Wireguard is e2e encrypted, no middleman can inspect the packets without the private keys.
I’m aware that it is encrypted, however DPIs can pick out Wireguard traffic (due to the behaviour of SSL used in the protocol) and can identify/deny Wireguard traffic. I don’t want that to happen. OpenVPN has a way to mask its traffic, I’m trying to see if anyone has done anything of the sort with Wireguard
shadowsocks seems to be the best way for now.
TheHobbyist@lemmy.zip 8 months ago
I have heard of shadowsocks for this purpose. I have not tried it myself but I recall having read it being used to hide VPN traffic behind the great firewall. A brief intro to it here:
errande.com/obfuscate-wireguard/
MigratingtoLemmy@lemmy.world 8 months ago
Thank you. It’s between this and SoftEther now
lemmyvore@feddit.nl 8 months ago
Keep in mind there’s another very easy method to mess with wg traffic: breaking the connection once every 30 seconds or so. This won’t affect the vast majority of real HTTPS connections but will ruin long lived connections like ssh or streaming.