wstunnel VS udp2raw

wstunnel - Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Rust with executables provided.

Shameless plug, there is also wstunnel (i am its author) https://github.com/erebe/wstunnel/, hope you enjoy.

If you want to tunnel UDP (WireGuard) or TCP (SSH) over WebSocket protocol, check out https://github.com/erebe/wstunnel

While working in an environment where VPN connections were pretty much all blocked⁰ a friend of mine had success using https://guacamole.apache.org/ to access a remote machine¹. Not quite the same as a direct VPN connection but worth a try if nothing else functions, it looks enough like normal HTTPS traffic that he got away with it.

To keep your wireguard setup more as-is, you could try https://kirill888.github.io/notes/wireguard-via-websocket/ to tunnel that via a web server. In fact https://github.com/erebe/wstunnel which that uses could be used just as well with any other UDP based VPN.

I once tinkered with https://github.com/yarrick/iodine and successfully connected to resources over the wireless on a train, bypassing its traffic capture and sign-up requirement, so that might be an option, though I think fully blocking external DNS is more common now so this is less likely to work²³.

--

[0] practically only HTTP(S) permitted, not even SSH, DPI in use that detected just using SSH or OpenVPN over port 443

[1] NOTE: be careful breaching restrictions like this, you are at risk of an insta-sacking if discovered, or worse if operating in some securiry environments!

[2] and the latency when it does work is significant!

[3] and that much traffic over port 53 might get noticed by the heuristics of data exfiltration scanner, encouraging sysadmins to notice and implement a way to block it

You can try with this project, https://github.com/erebe/wstunnel.

There are projects out there (like this) which run wireguard traffic through websocket.

Maybe udp2raw https://github.com/wangyu-/udp2raw

For that, I was going to setup UDP2RAW on my laptop to convert Wireguard's UDP traffic to TCP, send that TCP traffic to my server via port 22, to pretend it's SSH traffic, in the server setup UDP2RAW to convert that TCP back to UDP and send it to the Wireguard interface.

I've been doing some research and apparently, there's there are methods to obfuscate the VPN connection but everything I've looked at until now requires a special config on the server side of the VPN as well as the client side, and I haven't found anything related to Windscribes configuration for obfuscated servers via OpenVPN Scramble, Shadowsocks, obfsproxy, UDP2RAW, etc.

I read lots about this, e.g. the howto here. What I try to achieve is similiar to this setup here but the udp2raw server and client position should be switched. Is this possible somehow?

It's fair, though I would consider using tools like (for example) udp2raw for both OpenVPN and Wireguard if you need to bypass firewalls. Running OpenVPN in TCP mode is an awful experience.

Try to use udp2raw to hide the protocol https://github.com/wangyu-/udp2raw

check various ports with netcat as other mentioned. When you find a port you think may be open try it out. Additionally... this is all UDP and is EASILY blocked with deep packet inspection... you don't even need to go that deep into the packet... You could try a different VPN, or you could try to wrap your WireGuard into a TCP stream : https://github.com/wangyu-/udp2raw