back
65 comments
Great little tool!

I use it to selectively proxy Firefox tabs using multi-account containers to a home router that speaks Wireguard (but no application-layer proxying protocol or SSH).

TIL multi-account containers allow per-container proxy settings!

Am I correct in thinking it needs a separate extension to set that up, like this one? https://addons.mozilla.org/en-GB/firefox/addon/container-pro...

Edit: I was not correct, which is apparently grounds for downvotes now.

No separate extension needed; it’s right there in the container settings now!

Somebody has the detailed steps in a sibling comment.

It used to, but now I think they added it to the 'main' one.
You can be downvoted for anything. Walk it off :)
Would you happen to have any good resources explaining how such a setup could be configured?
I've been using Sidebery and this for container specific proxy configuration and it works fine https://addons.mozilla.org/it/firefox/addon/container-proxy/

I had a socks server running in docker that turned Forticlient, the worst corporate vpn solution ever, into socks so then I could use access the internal urls in one container, still have fast internet elsewhere, and not expose my computer's entire network traffic to Forticrap.

I've done this in the past to assign a different exit node in Mullvad to a given Firefox container.

1. You click the Multi-Account Containers extension icon

2. Select "Manage Containers"

3. Select the container that you want to use for this purpose

4. Click "Advanced proxy settings"

5. Enter the address. For example, `socks://us-nyc-wg-socks5-301.relays.mullvad.net:1080` if I'm using one of Mullvad's NYC servers

This supposes you're already connected to one of Mullvad's wireguard servers.

You can also use the FoxyProxy extension [0] for finer-control or extend this behavior across all tabs.

[0]: https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-sta...

https://github.com/dariost/soks works better for what I needed to do with wireguard. It does more or less the same thing but it reuses an existing wireguard interface. I detailed my use in this blog post https://www.nicoco.fr/blog/2023/09/10/wireguard/ (yes, shameless plug).
This is very different. wireproxy seems to contain a userspace implementation of TCP and Wireguard. soks looks like an IP router than can only handle TCP, replacing routing tables as the control mechanism with something that decides to use or not use a SOCKS5 proxy.
I didn't mean to dismiss wireproxy, I was just sharing where my findings lead me when I set up wireguards tunnel for myself. Apologies if this didn't come out right.
Out of curiosity, why does this work better for you?

I used to do a similar thing using a Docker container on a Raspberry Pi, but being able to run this on any OS and with a guarantee that it won’t accidentally mess up the host’s routing table makes the user space solution a much better choice in my view.

It worked better for me because with some software (eg qbittorrent) you can directly choose the network interface to use, so having a 'standard' wg0 interface is great.

Now I also wanted to re-use this interface for some websites I visited, and the easy way to do that was to configure rules in foxyproxy to use a socks proxy for that, which is where soks come into play.

I don't doubt that wireproxy is useful to many!

WTF is _this_
Thanks for insightful comment.

(was there a question in it?)

There's also onetun. https://github.com/aramperes/onetun
Is there completely userspace server implementation? Without tun/tap devices, etc. I guess some kind of userspace IP stack is necessary for that, although not sure.
https://github.com/noisysockets/noisysockets

With that, you can replace a Dialer in Go that connects sockets, effectively wrapping sockets with Wireguard. Since it does that in userspace, you get no tun/tap. This is all open-sourced by @dpeckett

With those things, he also built a userspace wireguard gateway that includes DNS resolution. https://github.com/noisysockets/gateway

https://news.ycombinator.com/user?id=dpeckett

Upstream WireGuard (golang) has had this capability for a few years now: https://github.com/WireGuard/wireguard-go/tree/master/tun/ne...
It's really completely in userspace and doesn't need any kernel modules or even superuser permissions for managing TUN/TAP devices (like e.g. OpenSSH's TUN device mode does)!

It uses a userspace TCP/IP stack by Google, as far as I understand.

Neat! This is a great replacement for my SSH tunnels when I need a different IP.

Somewhat related tool: pproxy, can, among many other things, "convert" different tunnel protocols into each other. Also features routing capabilities. I used it to turn an SSH SOCKS5 into an HTTP proxy. https://github.com/moreati/pproxy

I was thinking “hey, I bet it would be pretty easy to write something like this in Go”. And of course it’s written in Go!
Several multi-protocol proxy clients support this functionality, some notable open-source examples include:

  - [sing-box](https://github.com/SagerNet/sing-box)
  - [clash-meta](https://github.com/muink/Clash.Meta) and other clash-based clients
  - [xray](https://github.com/xtls/xray-core)
Close-sourced client include [Surge Mac/iOS](https://nssurge.com/).
Was about to say this. Those multiprotocol proxies (presumably build to climb the Great Firewall) are an interesting microcosm. Tons of possibilities for obscure traffic routing. Also have android implementations. Used them just to open up a hotspot on a non hotspot SIM and non-rooted android a time ago. I am always wondering how trustworthy they are because they are packing tons of code taken from all over the net and have a quite interesting developer community for obvious reasons.
In the closed-source world, cloudflare's warp can also work in proxy mode. Even the free accounts can work this way after converting the warp config to plain wireguard.
For people that care, clash + v2ray seems to be the only thing that reliably works in China. While most big VPN providers claim that they work, they don’t. I haven’t spent a lot of time figuring out how it works, but I do like the concept of rule groups to decide which domains the vpn should proxy.
How's the performance? My memory is that "vanilla" SOCKS is really easy to do (just run ssh with the right option and tell your application to use it) but really slow. I suspect this is mostly for cases where you don't have a normal SOCKS/ssh server, but I'm curious if it offers a benefit there too.
What do you mean by "vanilla" SOCKS, i.e. as opposed to what other type of SOCKS implementation?

For me, SOCKS over SSH has always been pretty performant, unlike e.g. OpenSSH's TUN mode (since that ends up doing TCP over TCP).

It would be great to compare both. Currently I connect to WireGuard and then create a socks proxy using SSH. And it works surprisingly well. But I'm very interested in this solution.
Nice! I was just thinking it would be sweet to have something like this to proxy all my Thunderbird email connections through my Tailscale exit node, without having to direct all my traffic through the exit node.
You can use the tailscale cli as a socks proxy. https://tailscale.com/kb/1113/aws-lambda

If you slap that into a container image and expose the socks port tailscale listens on, bada bing, bada proxy!

You can also install 3proxy or squid proxy on the machine running the exit node and any machine that is on the tailnet can see use it
Neat!

If you want something like this specifically for Mullvad VPN, I've had a good experience with https://github.com/imiric/mullvad-proxy (not my project, just forked it for some updates). What I like is that it embeds the Mullvad CLI tool, so switching servers is trivial, and it's all isolated from the host machine. It's also "just" nginx and some scripts, so it should have good SOCKS5 support.

You can download the "all" config from Mullvad and upload that into stock wireguard. Every Mullvad location becomes available via a huge dropdown in wireguard.

https://mullvad.net/en/blog/wireguard-configuration-tool-has...

Isn't this already easily achievable with ssh? with 'ssh -D[port] foo@somehost' ssh will act as a SOCKS server.
That's fine if you control the endpoint and want to expose ssh on it, but WireGuard endpoints are also commonly available from VPN providers who don't provide shell access.
Just a note: sing-box can do the same thing too. (https://sing-box.sagernet.org/configuration/outbound/wiregua...)
Would this work for watching video via an Apple TV? Apparently it’s possible to configure the ATV to use SOCKS, but the wireproxy implementation notes mention lack of UDP at the moment. So that would preclude video streaming, correct?
I'd really like to see an application level VPN that plays well with Go to `Dial` a `net.Conn` or `Listen` for a `net.Listener` in my Go application.
I set up something similar using network namespaces with Wireguard and tinyproxy. But performance wasn't stellar. Interested how this performs.
No. Do not wrap anything around the WireGuard protocol.

If you must, the very last protocol you should use is HTTP/HTTP3.

Expand?
Does it support OpenVPN?
... Um.. what? It's wireguard. It does the wireguard. Are you looking for tunsocks?
This hybrid approach addresses a significant user pain point - the ease of routing specific traffic through VPN tunnels. However, while Wireproxy's utility in personal and small-scale deployments is evident, its scalability and security in larger, enterprise-level applications warrant further scrutiny. The reliance on user-space operation, though advantageous for certain aspects of performance and compatibility, introduces potential bottlenecks and security concerns
There really are two completely different uses for VPNs.

One is a connection allowing you access to a private network for whatever purposes, which is what this feature enables.

The other is routing ALL your networking through it to disguise where you're located.

Confusing and confounding the two leads to disaster.

GPT comment