README
¶
swgp-go
🐉 Simple WireGuard proxy with minimal overhead for WireGuard traffic.
Proxy Modes
1. Zero overhead
The first 16 bytes of all packets are encrypted using an AES block cipher. The remainder of handshake packets (message type 1, 2, 3) are also randomly padded and encrypted using XChaCha20-Poly1305 to blend into normal traffic.
2. Paranoid
Pad all types of packets without exceeding MTU, then encrypt the whole packet using XChaCha20-Poly1305. We pad data packets because:
- The length of a WireGuard data packet is always a multiple of 16.
- Many IPv6 websites cap their outgoing MTU to 1280 for maximum compatibility.
Configuration Examples
All configuration examples and systemd unit files can be found in the docs directory.
swgp-go uses the same PSK format as WireGuard. A PSK can be generated using wg genpsk or openssl rand -base64 32.
Make sure to use the right MTU for both server and client. To encourage correct use, swgp-go disables IP fragmentation and drops packets that are bigger than expected.
1. Server
In this example, swgp-go runs a proxy server instance on port 20220. Decrypted WireGuard packets are forwarded to [::1]:20221.
{
"servers": [
{
"name": "server",
"proxyListen": ":20220",
"proxyMode": "zero-overhead",
"proxyPSK": "sAe5RvzLJ3Q0Ll88QRM1N01dYk83Q4y0rXMP1i4rDmI=",
"proxyFwmark": 0,
"wgEndpoint": "[::1]:20221",
"wgFwmark": 0,
"mtu": 1500
}
]
}
2. Client
In this example, swgp-go runs a proxy client instance on port 20222. Encrypted proxy packets are sent to the proxy server at [2001:db8:1f74:3c86:aef9:a75:5d2a:425e]:20220.
{
"clients": [
{
"name": "client",
"wgListen": ":20222",
"wgFwmark": 0,
"proxyEndpoint": "[2001:db8:1f74:3c86:aef9:a75:5d2a:425e]:20220",
"proxyMode": "zero-overhead",
"proxyPSK": "sAe5RvzLJ3Q0Ll88QRM1N01dYk83Q4y0rXMP1i4rDmI=",
"proxyFwmark": 0,
"mtu": 1500
}
]
}
License
Documentation
¶
Overview ¶
Package swgp implements a simple proxy protocol with minimal overhead for WireGuard traffic.
There are currently 2 proxy modes:
1. Zero overhead: Simply AES encrypt the first 16 bytes of all packets. Handshake packets (message type 1, 2, 3) are also randomly padded to look like normal traffic.
2. Paranoid: Pad all types of packets without exceeding MTU, then XChaCha20-Poly1305 encrypt the whole packet. We pad data packets because:
- The length of a WireGuard data packet is always a multiple of 16.
- Many IPv6 websites cap their outgoing MTU to 1280 for maximum compatibility.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
Package packet contains types and methods that transform WireGuard packets.
|
Package packet contains types and methods that transform WireGuard packets. |
|
Package service consists of encapsulations that utilize packet handlers to provide swgp service over a connection or other abstractions.
|
Package service consists of encapsulations that utilize packet handlers to provide swgp service over a connection or other abstractions. |