To pass wireguard's traffic through a TCP tunnel by using udp2raw
For Arch linux, install udp2raw by pacman:
pacman -S udp2raw
For Debian or Ubuntu, you can use a binary release from: https://github.com/wangyu-/udp2raw/releases
Then, install it under /sbin directory. For example, on a x86_64 system:
wget https://github.com/wangyu-/udp2raw/releases/download/20200818.0/udp2raw_binaries.tar.gz
tar xzvf udp2raw_binaries.tar.gz
sudo mv udp2raw_amd64 /sbin
- Replace private and public keys in configuration files
- Replace password in udp2raw command in both server's and client's configuration file
- Change
YOUR-SERVER-IPin client's config file (in udp2raw command) to your server IP address - On both server and client, copy corresponding config file to
/etc/wireguard/wg0 - Start wireguard on both server and client:
sudo systemclt start wg-quick@wg0 - Check connectivity by performing a ping command from client:
ping 10.8.0.1
- Please note that based on the configuration provided, by udp2raw command, port
4096of your server will be exposed to the world. Of course, you can change it to another port number. - If it doesn't work, remove
PreUpandPostdownlines from both configs and runudp2rawcommands in command-line with a--log-leveloption to see if TCP tunnel can be successfully established.
NOTE: this will not work with
AllowedIPs = 0.0.0.0/0for example, as the udp2raw tunnel would break.a potential workaround is to use something like https://www.lautenbacher.io/en/lamp-en/wireguard-exclude-a-single-ip-address/ to generate a list which excludes your udp2raw server IP.
another possibility is setting up an explicit route for the server IP as described in https://www.procustodibus.com/blog/2022/02/wireguard-over-tcp/#point-to-internet