DOCSEARCHbyAlgolia
Submit Docs

wireproxy-awg

repository·master·Indexed 43 days ago

https://github.com/artem-russkikh/wireproxy-awg

A userspace WireGuard client that acts as a SOCKS5/HTTP proxy or provides TCP/UDP tunnels. This is a fork of wireproxy enhanced with support for AmneziaWG obfuscation parameters (versions 1.0 through 3.1), including junk packets, signature packets, and header protection.

Tokens
9K
Snippets
36
Records
51
Agent score
57%

What's inside wireproxy-awg

  1. Configure wireproxy tunnels and proxies

    master

    Wireproxy can expose traffic via several mechanisms defined in the configuration file. You can use a standard WireGuard config file or import one using WGConfig = <path>.

    Available Tunnel/Proxy Types:

    • [Socks5]: Creates a SOCKS5 proxy. Supports BindAddress, Username, and Password.
    • [http]: Creates an HTTP proxy. Supports BindAddress, Username, Password, CertFile, and KeyFile (for HTTPS).
    • [TCPClientTunnel]: Forwards local TCP traffic to a remote target via WireGuard.
    • [TCPServerTunnel]: Listens on WireGuard and forwards traffic to a local target.
    • [STDIOTunnel]: Connects STDIN/STDOUT to a remote TCP target (useful for SSH ProxyCommand).
    • [UDPProxyTunnel]: Forwards UDP traffic to a target. Supports BindAddress, Target, and InactivityTimeout.
    # Example: SOCKS5 Proxy
[Socks5]
BindAddress = 127.0.0.1:25344

# Example: TCP Client Tunnel
[TCPClientTunnel]
BindAddress = 127.0.0.1:25565
Target = play.cubecraft.net:25565

# Example: SSH ProxyCommand usage
# ssh -o ProxyCommand='wireproxy -c myconfig.conf' ssh.myserver.net
[STDIOTunnel]
Target = ssh.myserver.net:22

  2. Obtain AmneziaWG or WireGuard Configs

    master

    This project supports both standard WireGuard configurations and AmneziaWG configurations. AmneziaWG configs include additional obfuscation fields such as Jc, Jmin, Jmax, S1, S2, and H1–H4.

    To obtain a config:

    1. Download it from your VPN provider.
    2. Export it from the Amnezia client app.
    3. Manually configure obfuscation parameters using wg genkey and wg pubkey on your own AmneziaWG server.

    The downloaded config file can be used directly without conversion via the WGConfig parameter in your setup.

  4. Set up a macOS LaunchAgent for wireproxy

    master

    To ensure wireproxy runs automatically at startup on macOS, create a .plist file in $HOME/Library/LaunchAgents/.

    Requirements:

    1. The Label key must match the filename.
    2. The Program key must point to your startup bash script.
    3. Set RunAtLoad and KeepAlive to true to ensure the proxy stays running.

    To enable the agent, use launchctl:

    launchctl load ~/Library/LaunchAgents/com.MyVPN.adblock.plist
launchctl start ~/Library/LaunchAgents/com.MyVPN.adblock.plist
    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.MyVPN.adblock</string>
    <key>Program</key>
    <string>/Users/jonny/vpntabs/MyVPN.adblock.sh</string>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <true/>
</dict>
</plist>

  5. Create a startup script for wireproxy

    master

    A bash script can be used to simplify starting a specific proxy profile. You must provide the absolute path to the wireproxy binary and the absolute path to your custom .conf file (the one containing the [Socks5] section, not the raw VPN provider config).

    Example script structure:

    #!/bin/bash
/path/to/wireproxy -c /path/to/your/proxy_profile.conf
    #!/bin/bash
/Users/jonny/wireproxy/wireproxy -c /Users/jonny/vpntabs/MyVPN.adblock.conf

  6. Customize the wireproxy systemd unit

    master

    If your wireproxy binary or configuration file is located in different paths than the defaults, you must edit the wireproxy.service file. Specifically, update the LoadCredential, ExecStartPre, and ExecStart directives.

    Note that the service uses systemd credentials to pass the configuration file to the process via the ${CREDENTIALS_DIRECTORY} environment variable.

    # Example: Custom paths for binary and config
LoadCredential=conf:/opt/myfiles/wireproxy.conf
ExecStartPre=/usr/bin/wireproxy -n -c ${CREDENTIALS_DIRECTORY}/conf
ExecStart=/usr/bin/wireproxy -c ${CREDENTIALS_DIRECTORY}/conf

  7. Set up wireproxy-awg as a service on rc.d-based systems

    master

    To run wireproxy-awg as a background service on an rc.d-based distribution, follow these steps:

    1. Install the unit file: Copy the wireproxy-awg file from the repository to /usr/local/etc/rc.d.
    2. Customize paths (if needed): Open the unit file and edit the procname, command, and wireproxy_conf variables to ensure they point to your specific wireproxy executable and configuration file paths.
    3. Enable the service: Add wireproxy_enable="YES" to your /etc/rc.conf file.
    4. Manage the service: Use the service command to start and check the status of the daemon.

    Default assumptions in the unit file:

    • Executable location: /bin/wireproxy-awg
    • Configuration file location: /etc/wireproxy-awg.conf
    # Enable the service in /etc/rc.conf
wireproxy_enable="YES"

# Manage the service
sudo service wireproxy-awg start
sudo service wireproxy-awg status

  8. Integrate wireproxy with Firefox Containers

    master

    To use a specific VPN profile within a Firefox container:

    1. Install the Multi Account Container Tabs extension.
    2. Install a proxy management extension (e.g., Sideberry or Container Proxy).
    3. Create a dedicated container for the VPN.
    4. Configure the proxy extension for that container using the BindAddress (IP and port), Username, and Password defined in your wireproxy configuration file.

  9. Install wireproxy-awg

    master

    You can install the wireproxy binary directly using go install. This is the recommended way to get the latest version or a specific version.

    Alternatively, you can build it from source by cloning the repository and running make.

    # Install via Go
go install github.com/artem-russkikh/wireproxy-awg/cmd/wireproxy@v1.0.18

# Or build from source
git clone https://github.com/artem-russkikh/wireproxy-awg
cd wireproxy-awg
make

  10. Install wireproxy as a systemd service

    master

    To run Wireproxy as a background service on systemd-based distributions, you need to install the wireproxy.service unit file. By default, the service expects the wireproxy executable at /opt/wireproxy/wireproxy and the configuration file at /etc/wireproxy.conf.

    # Download the service file to the systemd directory
curl https://raw.githubusercontent.com/artem-russkikh/wireproxy-awg/master/systemd/wireproxy.service | sudo tee /etc/systemd/system/wireproxy.service

# Reload systemd and start the service immediately
sudo systemctl daemon-reload
sudo systemctl enable --now wireproxy.service

  11. Configure DNS Resolution Strategy

    master

    Use the [Resolve] section to define how DNS queries are prioritized.

    • ipv4: Prioritize A records.
    • ipv6: Prioritize AAAA records.
    • auto (Default): If the WireGuard interface has only an IPv4 address, it acts as ipv4; otherwise, it acts as ipv6.
    [Resolve]
ResolveStrategy = auto

  12. Configure a wireproxy SOCKS5 profile

    master

    To run multiple VPN connections simultaneously (e.g., for different Firefox containers), create a unique configuration file for each server. Each profile must use a unique BindAddress port.

    Key configuration rules:

    • WGConfig: The absolute path to your downloaded .conf file.
    • [Socks5]: Section for proxy settings.
    • BindAddress: The local IP and port where the SOCKS5 proxy will listen (e.g., 127.0.0.1:25344).
    • Authentication: To enable proxy authentication, provide Username and Password under the [Socks5] section. Avoid using spaces in the password field.
    # Path to the downloaded WireGuard or AmneziaWG config
WGConfig = /Users/jonny/vpntabs/MyVPN.adblock.server.conf

# SOCKS5 proxy settings
[Socks5]
BindAddress = 127.0.0.1:25344

# Optional: Proxy authentication
# Username = myuser
# Password = mypassword