Show HN: Wiretap – Transparent WireGuard proxy server without root (opens in new tab)

Reminds me of Moloch, the packet capture and indexing software[0]. I wonder why it was renamed and moved out of the AOL github org...

[0]: https://news.ycombinator.com/item?id=22949604

Based on the name initially I thought Wiretap was a MITM proxy for Wireguard.

Thanks for the link! IIUIC, wireproxy is not similar, but complementary: you can run wiretap on the server-side and wireproxy on the client and have a complete user-space solution.

Much better name. Initially I thought Wiretap was a MITM proxy for Wireguard.

Yes! It’s very similar to what Tailscale does in userspace mode, written as more of a standalone utility

Vanilla WireGuard doesn't provide a way to run a peer in userspace that can proxy traffic between another peer and an endpoint such as a web server because you need to be privileged to do things like work with raw packets. However, https://github.com/WireGuard/wireguard-go is a userspace implementation of WireGuard and has recently incorporated Google's userspace networking stack. This project uses these two userspace tools to "fake" a privileged WireGuard peer that proxies TCP, UDP, and (a small subset of) ICMP. It was written as a pentesting/red team utility for my team but it can also serve as a general makeshift VPN when you don't have privileges on a box you want to proxy through.

Edit: typo

Userspace capability. Especially when running inside containers.

this replaces WG + some iptables config in a single user-space solution (no root required)