How do you mask Wireguard traffic?

Selfhosted@lemmy.world – 53 points – 1 years ago

ChatGPT led me to tunsafe however the project seems to be abandoned?

I'm trying to find ways to convert wireguard traffic into plain HTTPS so as to not trigger some advanced DPI. So far, I have come across udp2raw and updtunnel which convert the traffic to TCP, but AFAIK the SSL used in Wireguard triggers DPIs.

Does anyone have a workaround? Thanks!

Everyone, there seems to be a way go achieve this:

Wireguard (change port to 443) + udp2raw or udptunnel to convert packets to TCP + stunnel (configured on both client and server - used by OpenVPN to encapsulate traffic in TLS).

This is basically what OpenVPN does, and theoretically this should do OK. I haven't tested it however, so if you have, please let us know!

You are viewing a single comment

View all comments Show the parent comment

I used stunnel years ago to tunnel both openVPN and SSH traffic and it worked flawlessly. Looks just like https web traffic to dpi software. Beware though, that long open connections can also set off flags, so don't keep connection's open permanently.

I see. Thanks, good to know. I'll see if I can automate opening and closing connections. However, I do think that a lot of applications (especially chat/video applications) maintain fairly long connections these days: long livestreams on YT, discord client, lemmy, Instagram etc. Basically, if you're consuming content online, there's a good chance that your device might keep the connection going.

With that said, it's important to blend in: I wonder if I can automate the disconnect-connect process on Android

Hey, can I ask which DPI software were you using, and how did you get access to it?