erebe/wstunnel
Wstunnel
wstunnel is a tool that tunnels arbitrary TCP traffic through WebSocket connections, enabling communication across restrictive firewalls and proxies. It operates as both a client and server, encapsulating TCP data within WebSocket binary frames and multiplexing multiple connections over a single WebSocket link. The tool supports mutual TLS authentication, requiring clients to present signed certificates for verification before establishing a tunnel, and provides shared secret access control and tunnel forwarding restrictions for additional security.
The project distinguishes itself by offering multiple traffic routing modes, including HTTP proxy, SOCKS5 proxy, and transparent proxy routing, allowing dynamic forwarding of client requests through the tunnel. It supports reverse tunneling to expose local services behind NAT or firewalls, and can fall back to HTTP2 transport when WebSocket connections are blocked. Traffic disguise capabilities let users customize TLS settings, HTTP path prefixes, and request headers to make tunnel traffic resemble normal web traffic.
Beyond TCP, wstunnel can forward UDP datagrams, Unix socket data, and standard input/output streams through the tunnel. It terminates TLS connections at the tunnel endpoint and supports port forwarding between machines. The tool is available as a single binary with command-line configuration for specifying local and remote endpoints.
Features
- WebSocket Proxy Tunnels - Creates encrypted tunnels through firewalls and proxies by wrapping TCP traffic inside WebSocket connections.
- Connection Multiplexing - Multiplexes multiple TCP connections over a single WebSocket connection using stream identifiers to separate traffic.
- WebSocket-Tunneled - Creates an HTTP proxy that dynamically forwards client requests through the WebSocket tunnel to any destination.
- Reverse Proxy Tunneling Tools - Exposes local services to the internet through a remote server using WebSocket-based reverse tunnels.
- Reverse Tunnels - Listens on the remote server for incoming connections and forwards them back through the tunnel to a local service.
- SOCKS5 Proxies - Creates a SOCKS5 proxy that dynamically forwards client requests through the tunnel to any destination.
- TCP Tunneling - Forwards TCP connections through a WebSocket or HTTP2 tunnel to bypass firewalls and proxies.
- TCP Packet Encapsulation - Encapsulates TCP data within WebSocket binary frames for transmission over HTTP-compatible channels.
- TCP and UDP Forwarders - Forwards raw TCP streams bidirectionally between the tunnel client and server, preserving connection semantics.
- Mutual TLS Authentication - Secures WebSocket tunnel connections with mutual TLS authentication using client certificates.
- Client Certificate Authentication - Authenticates clients by validating X.509 certificates during the TLS handshake, requiring a trusted certificate authority chain.
- Protocol Upgrades - Establishes tunnels by upgrading standard HTTP connections to WebSocket protocol using the HTTP Upgrade header.
- HTTP2 Fallback Transports - Falls back to HTTP2 transport when WebSocket connections are blocked by firewalls or proxies.
- UDP Tunneling - Forwards UDP datagrams through a WebSocket or HTTP2 tunnel to bypass firewalls and proxies.
- Port Forwarding Tools - Forwards arbitrary TCP ports between machines through a single WebSocket connection.
- TLS Termination - Terminates TLS connections at the tunnel endpoint, decrypting traffic before forwarding it over the WebSocket tunnel.
- HTTP-Tunneled SOCKS Proxies - Bypasses corporate or restrictive HTTP proxies by tunneling TCP traffic over WebSocket connections.
- Traffic Disguise Techniques - Customizes TLS settings, HTTP path prefixes, and request headers to make tunnel traffic resemble normal web traffic.
- Transparent Proxying - Intercepts all TCP and UDP traffic on a port and forwards it through the tunnel without per-application configuration.
- Shared Secret Keys - Restricts server access to clients that provide a matching path prefix during the WebSocket upgrade request.
- Tunnel Access Restrictions - Limits which remote hosts and ports the tunnel can forward traffic to based on server-side rules.
- Tunneling and Proxying - Proxies traffic over WebSockets to bypass restrictive network firewalls.
