74bf824eeb
Former-commit-id: 385a62d66ae710ca7c521ac8fc55b7c21730380f Former-commit-id: 23ddc898b03ea65daab52646bf15f0cb8ace769d [formerly a75d6123c2676d026c119f58becb40fd24c3cd6e] [formerly d2fc2265d5d9f316b8b2e64a0efe4bfde94919c1 [formerly ade268386dfd252cbae9982a33449bc91aba7d27 [formerly ade268386dfd252cbae9982a33449bc91aba7d27 [formerly ade268386dfd252cbae9982a33449bc91aba7d27 [formerly 6ae72e372f44cb38dc4f0ade36ce2b2af896fec8]]]]] Former-commit-id: 2af7f7fb721ef3c080c8e52b149f685f57cc56a7 [formerly 4b4d29baafa47323e1f29fa8429942fd7e6d3e2a] Former-commit-id: 16062cea85f475a3e2aa55d89525a58e5e000dca Former-commit-id: 83606d3a274529b778d178916993ff5a3b66e59f Former-commit-id: 27ad74cc92ce756fabaccd59de888bc05bd73433 Former-commit-id: aed8546b1f5c8f266aaaf940118f0ed1296ef5b3 [formerly 74dcc5b1bf95ba306ff31b4bb3d945517e155677] Former-commit-id: 018ef1461154ce6c99b2234271c5f3ba56881541 |
||
---|---|---|
app | ||
src | ||
test | ||
.dockerignore | ||
.gitignore | ||
.travis.yml | ||
default.nix | ||
Dockerfile | ||
Dockerfile.old | ||
LICENSE | ||
logo_wstunnel.png | ||
README.md | ||
Setup.hs | ||
stack.yaml | ||
wstunnel.cabal |
Description
Most of the time when you are using a public network, you are behind some kind of firewall or proxy. One of their purpose is to constrain you to only use certain kind of protocols. Nowadays, the most widespread protocol is http and is de facto allowed by third party equipment.
This tool understands this fact and uses the websocket protocol which is compatible with http in order to bypass firewalls and proxies. Wstunnel allows you to tunnel what ever traffic you want.
My inspiration came from this project but as I don't want to install npm and nodejs to use this tool, I remade it in Haskell and improved it.
What to expect:
- Good error messages and debug informations
- Static tunneling (TCP and UDP)
- Dynamic tunneling (socks5 proxy)
- Support for http proxy (when behind one)
- Support for tls/https server (with embedded self signed certificate, see comment in the example section)
- Standalone binary for linux x86_64 (so just cp it where you want)
- Standalone archive for windows
P.S: Please do not pay attention to Main.hs because as I hate to write command line code this file is crappy
Command line
Use the websockets protocol to tunnel {TCP,UDP} traffic
wsTunnelClient <---> wsTunnelServer <---> RemoteHost
Use secure connection (wss://) to bypass proxies
wstunnel [OPTIONS] ws[s]://wstunnelServer[:port]
Client options:
-L --localToRemote=[BIND:]PORT:HOST:PORT Listen on local and forwards
traffic from remote
-D --dynamicToRemote=[BIND:]PORT Listen on local and dynamically
(with socks5 proxy) forwards
traffic from remote
-u --udp forward UDP traffic instead of
TCP
-p --httpProxy=USER:PASS@HOST:PORT If set, will use this proxy to
connect to the server
Server options:
--server Start a server that will forward
traffic for you
-r --restrictTo=HOST:PORT Accept traffic to be forwarded
only to this service
Common options:
-v --verbose Print debug information
-q --quiet Print only errors
-h --help Display help message
-V --version Print version information
Examples
Simplest one
On your remote host, start the wstunnel's server by typing this command in your terminal
wstunnel --server ws://0.0.0.0:8080
This will create a websocket server listening on any interface on port 8080. On the client side use this command to forward traffic through the websocket tunnel
wstunnel -D 8888 ws://myRemoteHost:8080
This command will create a sock5 server listening on port 8888 of a loopback interface and will forward traffic.
Ex: With firefox you can setup a proxy using this tunnel, by setting in networking preferences 127.0.0.1:8888 and selecting socks5 proxy
As proxy command for SSH
You can specify stdio
as source port on the client side if you wish to use wstunnel as part of a proxy command for ssh
ssh -o ProxyCommand="wstunnel -L stdio:%h:%p ws://localhost:8080" my-server
When behind a corporate proxy
An other useful example is when you want to bypass an http proxy (a corporate proxy for example) The most reliable way to do it is to use wstunnel as described below
Start your wstunnel server with tls activated
wstunnel --server wss://0.0.0.0:443 -r 127.0.0.1:22
The server will listen on any interface using port 443 (https) and restrict traffic to be forwarded only to the ssh daemon.
Be aware that the server will use self signed certificate with weak cryptographic algorithm. It was made in order to add the least possible overhead while still being compliant with tls.
Do not rely on wstunnel to protect your privacy, as it only forwards traffic that is already secure by design (ex: https)
Now on the client side start the client with
wstunnel -L 9999:127.0.0.1:22 -p mycorporateproxy:8080 wss://myRemoteHost:443
It will start a tcp server on port 9999 that will contact the corporate proxy, negotiate a tls connection with the remote host and forward traffic to the ssh daemon on the remote host.
You may now access your server from your local machine on ssh by using
ssh -p 9999 login@127.0.0.1
Wireguard and wstunnel
https://kirill888.github.io/notes/wireguard-via-websocket/
How to Build
Install the stack tool https://docs.haskellstack.org/en/stable/README/ or if you are a believer
curl -sSL https://get.haskellstack.org/ | sh
and run those commands at the root of the project
stack init
stack install
TODO
- Add sock5 proxy
- Add better logging
- Add better error handling
- Add httpProxy authentification
- Add Reverse tunnel
- Add more tests for socks5 proxy