Tutorial "Obfuscating WireGuard using Wstunnel"

[wpdevelopment11]

I have written a tutorial, which you may find useful.

Markdown source is here.

[erebe]

Thank you, it is very well made and contains a lot détails/steps.

I am going to add it in the readme :)

[wpdevelopment11]

Thank you for your kind words.

[wpdevelopment11]

I updated tutorial:

• Add a note about Termux, as an alternative to TermOne Plus.
• Use a separate unprivileged user for the wstunnel systemd service.

[alaky2]

Hi,
I configured my Wiregurd (server is Ubuntu and client is Windows 10) acording to very usefull and step by step tutorial of @wpdevelopment11. My wireguard works fine with the wstunnel, but if I do not uncheck the "kill-switch" on the Wireguard client (Windows 10), it doesn't work. It cannot initiate the Handshaking. here are the 2 lines of log that repeats for ever:
2025-01-04 17:12:54.602: [TUN] [me91] Sending handshake initiation to peer 1 (127.0.0.1:58496)
2025-01-04 17:12:59.699: [TUN] [me91] Handshake for peer 1 (127.0.0.1:58496) did not complete after 5 seconds, retrying (try 2)

But if I uncheck the "kill-switch" it works without any problem. The kill switch is very important for me. Please, is there anything I can do to have the kill-switch active?

[wpdevelopment11]

For Wstunnel to work you need to have a static route to the remote server. I don't think it's possible to have "kill-switch" enabled and static route to the server working at the same time.

[alaky2]

Thank you for your concern.
I delete a route in PostUp (which in fact kills all traffic) and add it again in PostDown:
PostUp = route delete 0.0.0.0 mask 0.0.0.0 192.168.100.1 && route add 203.0.113.1 mask 255.255.255.255 192.168.1.1 && start "" wstunnel ...
PostDown = route add 0.0.0.0 mask 0.0.0.0 192.168.100.1 IF 2 && route delete 203.0.113.1 mask 255.255.255.255 192.168.1.1 && powershell ...

I found the number 2, my Interface number, by running the netstat /r on Powershell.
Of course this is not a perfect "kill-switch" but it is better than nothing.
By the way, when I connect to another server without wstunnel and come back to the server obfuscated with wstunnel, sometimes the speed is very low, but after disabling and enabling my wireless modem, speed is good again. In fact using wstunnel doesn't noticeably reduce the VPN speed. Thank you again.

[sincomil]

Here is some templates for creating connection profile configurations for Windows and Linux systems. With this you can simply set connection ON/OFF and profile integrated one-liner scripts do the magic

Linux:

[Interface]
    Address = 10.1.2.X/32
    # Put this as PublicKey on server side: ${user_pubkey}
    PrivateKey = ${user_privkey}
    MTU = 1300
    PreUp = ip ro add ${ws_server_ip} via ${lan_gw_ip} && nohup /opt/bin/wstunnel -v --udp --udpTimeoutSec=-1 -L 127.0.0.1:${wstunnel_port}:127.0.0.1:${wireguard_port} --websocketPingFrequencySec=5 --upgradePathPrefix=${ws_connection_upgrade_string} wss://${ws_server_fqdn} > /dev/null &
    PreDown = pkill wstunnel ; ip ro del ${ws_server_ip} via ${lan_gw_ip}

[Peer]
    PublicKey = ${server_pubkey}
    Endpoint = 127.0.0.1:${wstunnel_port}
    AllowedIPs = 10.1.2.0/24
    PersistentKeepalive = 25

Windows:

[Interface]
    Address = 10.1.2.X/32
    # Put this as PublicKey on server side: ${user_pubkey}
    PrivateKey = ${user_privkey}
    MTU = 1300
    PreUp = route add ${ws_server_ip} mask 255.255.255.255 ${lan_gw_ip} & start "WebSocket" "wstunnel.exe" -v --udp --udpTimeoutSec=-1 -L 127.0.0.1:${wstunnel_port}:127.0.0.1:${wireguard_port} --websocketPingFrequencySec=5 --upgradePathPrefix=${ws_connection_upgrade_string} wss://${ws_server_fqdn}
    PreDown = FOR /F "tokens=4" %i IN ('netstat -aon ^| findstr 2080') DO taskkill /pid %i /f &  route delete ${ws_server_ip} mask 255.255.255.255 ${lan_gw_ip}

[Peer]
    PublicKey = ${server_pubkey}
    Endpoint = 127.0.0.1:${wstunnel_port}
    AllowedIPs = 10.1.2.0/24
    PersistentKeepalive = 25