Tutorial "Obfuscating WireGuard using Wstunnel"

[wpdevelopment11]

I have written a tutorial, which you may find useful.

Markdown source is here.

[erebe]

Thank you, it is very well made and contains a lot détails/steps.

I am going to add it in the readme :)

[wpdevelopment11]

Thank you for your kind words.

[wpdevelopment11]

I updated tutorial:

• Add a note about Termux, as an alternative to TermOne Plus.
• Use a separate unprivileged user for the wstunnel systemd service.

[alaky2]

Hi,
I configured my Wiregurd (server is Ubuntu and client is Windows 10) acording to very usefull and step by step tutorial of @wpdevelopment11. My wireguard works fine with the wstunnel, but if I do not uncheck the "kill-switch" on the Wireguard client (Windows 10), it doesn't work. It cannot initiate the Handshaking. here are the 2 lines of log that repeats for ever:
2025-01-04 17:12:54.602: [TUN] [me91] Sending handshake initiation to peer 1 (127.0.0.1:58496)
2025-01-04 17:12:59.699: [TUN] [me91] Handshake for peer 1 (127.0.0.1:58496) did not complete after 5 seconds, retrying (try 2)

But if I uncheck the "kill-switch" it works without any problem. The kill switch is very important for me. Please, is there anything I can do to have the kill-switch active?

[wpdevelopment11]

For Wstunnel to work you need to have a static route to the remote server. I don't think it's possible to have "kill-switch" enabled and static route to the server working at the same time.

[alaky2]

Thank you for your concern.
I delete a route in PostUp (which in fact kills all traffic) and add it again in PostDown:
PostUp = route delete 0.0.0.0 mask 0.0.0.0 192.168.100.1 && route add 203.0.113.1 mask 255.255.255.255 192.168.1.1 && start "" wstunnel ...
PostDown = route add 0.0.0.0 mask 0.0.0.0 192.168.100.1 IF 2 && route delete 203.0.113.1 mask 255.255.255.255 192.168.1.1 && powershell ...

I found the number 2, my Interface number, by running the netstat /r on Powershell.
Of course this is not a perfect "kill-switch" but it is better than nothing.
By the way, when I connect to another server without wstunnel and come back to the server obfuscated with wstunnel, sometimes the speed is very low, but after disabling and enabling my wireless modem, speed is good again. In fact using wstunnel doesn't noticeably reduce the VPN speed. Thank you again.

[sincomil]

Here is some templates for creating connection profile configurations for Windows and Linux systems. With this you can simply set connection ON/OFF and profile integrated one-liner scripts do the magic

Linux:

[Interface]
    Address = 10.1.2.X/32
    # Put this as PublicKey on server side: ${user_pubkey}
    PrivateKey = ${user_privkey}
    MTU = 1300
    PreUp = ip ro add ${ws_server_ip} via ${lan_gw_ip} && nohup /opt/bin/wstunnel -v --udp --udpTimeoutSec=-1 -L 127.0.0.1:${wstunnel_port}:127.0.0.1:${wireguard_port} --websocketPingFrequencySec=5 --upgradePathPrefix=${ws_connection_upgrade_string} wss://${ws_server_fqdn} > /dev/null &
    PreDown = pkill wstunnel ; ip ro del ${ws_server_ip} via ${lan_gw_ip}

[Peer]
    PublicKey = ${server_pubkey}
    Endpoint = 127.0.0.1:${wstunnel_port}
    AllowedIPs = 10.1.2.0/24
    PersistentKeepalive = 25

Windows:

[Interface]
    Address = 10.1.2.X/32
    # Put this as PublicKey on server side: ${user_pubkey}
    PrivateKey = ${user_privkey}
    MTU = 1300
    PreUp = route add ${ws_server_ip} mask 255.255.255.255 ${lan_gw_ip} & start "WebSocket" "wstunnel.exe" -v --udp --udpTimeoutSec=-1 -L 127.0.0.1:${wstunnel_port}:127.0.0.1:${wireguard_port} --websocketPingFrequencySec=5 --upgradePathPrefix=${ws_connection_upgrade_string} wss://${ws_server_fqdn}
    PreDown = FOR /F "tokens=4" %i IN ('netstat -aon ^| findstr 2080') DO taskkill /pid %i /f &  route delete ${ws_server_ip} mask 255.255.255.255 ${lan_gw_ip}

[Peer]
    PublicKey = ${server_pubkey}
    Endpoint = 127.0.0.1:${wstunnel_port}
    AllowedIPs = 10.1.2.0/24
    PersistentKeepalive = 25

[finn1199]

I'v got:

• wstunnel 10.1.9 + Wireguard on Debian 12 (Server)
• wstunnel 10.1.9 + Wireguard on Arch Linux (Client)

It took some time to configure all things to work...

What I'v noticed for now...
It doesn't work if You use localhost in configs' code! (on my Arch Linux like that...)
So, I used 127.0.0.1 (replaced localhost) everywhere instead.
One more thing - if you use ListenPort = 12345 line in wg0.conf on your Client, wstunnel + WG doesn't work as well!

My absolutely working configs are:

• wstunnel Systemd-unit on Debian 12 (Server)

[Unit]
Description=Wstunnel for WireGuard
After=network-online.target
Wants=network-online.target

[Service]
User=wstunnel
Type=exec
ExecStart=/usr/local/bin/wstunnel server --restrict-to 127.0.0.1:12345 wss://0.0.0.0:123
Restart=on-failure

[Install]
WantedBy=multi-user.target

• wg0.conf on Arch Linux (Client)

[Interface]
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
Address = 10.10.10.2/32
DNS = 8.8.8.8
PostUp = ip route add 123.456.789.101/32 via 192.168.0.1 dev eth0
PostUp = wstunnel client -L "udp://12345:127.0.0.1:12345?timeout_sec=0" wss://123.456.789.101:123 > /dev/null 2>&1 &
PostDown = ip route del 123.456.789.101/32 via 192.168.0.1 dev eth0
PostDown = killall wstunnel
MTU = 1500

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = 127.0.0.1:12345
PersistentKeepalive = 25

Where:
12345 - port on which the WireGuard server/client listens
123.456.789.101 - Public IP of your server
192.168.0.1 - your router IP address
123 - wss (wstunnel server) port
eth0 - your interface name

# replace eth0 (interface) and 192.168.0.1 (router gateway) by the one given by `ip route get 123.456.789.1011`

Replace all by yours...

!!! Important thing !!!
If you want change default Wireguard port 51820 like I did and use another port (12345 for example), you gotta do that in main Wireguard config wg-quick as well in:
/usr/bin/wg-quick config-file

Open it:
sudo nano /usr/bin/wg-quick

Find (Ctrl+W) table=51820

Replace 51820 by your port 12345

Save it (Ctrl+O + Enter).

Exit from nano (Ctrl+X).

Start Wireguard + wstunnel in Teminal (Ctrl+Alt+T) by:
wg-quick up wg0

Profit...

To stop it:
wg-quick down wg0

!!! Warnings !!!
It's not possible to import modified wg0.conf Wireguard Client-config file with lines:

PostUp =
PostDown =

to Network Manager to be used in due to there's no support for them (lines) in one.
So, Wireguard + wstunnel won't work through it...