WireGuard Inbound (User-space WireGuard server) #2477

hax0r31337 · 2023-08-23T03:25:38Z

WireGuard is one of the most commonly used VPN protocols. I believe it's essential to implement a server for Xray in order to introduce advanced routing features to WireGuard.

Example Xray server config

{
    "port": 31337,
    "protocol": "wireguard",
    "settings": {
        "secretKey": "EGs4lTSJPmgELx6YiJAmPR2meWi6bY+e9rTdCipSj10=",
        "peers": [
            {
                "publicKey": "osAMIyil18HeZXGGBDC9KpZoM+L2iGyXWVSYivuM9B0=",
                "allowedIPs": [
                    "192.168.0.0/16",
                    "fe81:0000:0000:0000:0000:0000:0000:0000/16"
                ]
            }
        ],
        "mtu": 1300
    },
    "tag": "server"
}

Corresponding WireGuard client config

[Interface]
Address = 192.168.6.2/24
DNS = 9.9.9.9
MTU = 1300
PrivateKey = CPQSpgxgdQRZa5SUbT3HLv+mmDVHLW5YR/rQlzum/2I=

[Peer]
AllowedIPs = 0.0.0.0/0
Endpoint = 10.0.13.37:31337
PublicKey = MmLJ5iHFVVBp7VsB0hxfpQ0wEzAbT2KQnpQpj0+RtBw=

yuhan6665 · 2023-08-24T15:01:17Z

what do you think @RPRX

master88wi · 2023-08-24T17:51:22Z

+1

RPRX · 2023-08-26T09:00:04Z

我觉得可以有，让我们把 WireGuard 相关的 PR 放到 v1.8.5 后处理

yuhan6665 · 2023-11-13T01:04:38Z

wg 这块重新实现了 @hax0r31337 能麻烦佬更新到最新的 main 吗？

hax0r31337 · 2023-11-13T05:37:15Z

I need assistance using Linux Tun device with WireGuard server, as I have limited knowledge of the Linux netstack.

yuhan6665 · 2023-11-13T15:05:47Z

感谢高速更新我抽空测一下。。

yuhan6665 · 2023-11-15T03:35:56Z

嗯。。看起来 5ae3791 至少在安卓上 wg 坏掉了。。

11:28:43.990  W  type=1400 audit(0.0:181984): avc:  denied  { getattr } for  path="/proc/sys/net/ipv4/conf/all/rp_filter" dev="proc" ino=2617254 scontext=u:r:untrusted_app_32:s0:c247,c256,c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file permissive=0 app=com.v2ray.ang
11:28:43.998  I  [Info] [2266353430] app/proxyman/outbound: failed to process outbound traffic > proxy/wireguard: failed to create virtual tun interface > failed to disable ipv4 rp_filter for all: stat /proc/sys/net/ipv4/conf/all/rp_filter: permission denied

CC @kunsonx

hax0r31337 · 2023-11-15T03:54:56Z

嗯。。看起来 5ae3791 至少在安卓上 wg 坏掉了。。

11:28:43.990  W  type=1400 audit(0.0:181984): avc:  denied  { getattr } for  path="/proc/sys/net/ipv4/conf/all/rp_filter" dev="proc" ino=2617254 scontext=u:r:untrusted_app_32:s0:c247,c256,c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file permissive=0 app=com.v2ray.ang
11:28:43.998  I  [Info] [2266353430] app/proxyman/outbound: failed to process outbound traffic > proxy/wireguard: failed to create virtual tun interface > failed to disable ipv4 rp_filter for all: stat /proc/sys/net/ipv4/conf/all/rp_filter: permission denied

CC @kunsonx

I added user-space mode in ea22f73, you can set kernelMode to false (which is false by default) to use gVisor virtual TUN for cases don't have sufficient permission to use system netstack

kunsonx · 2023-11-15T06:37:17Z

建议在 Android 环境使用 gVisor virtual netstack. 在标准 Android 环境下可能没有相关权限去启用 Tun 与配置权限.

kunsonx · 2023-11-15T06:40:39Z

The kernelMode is confusing for users. Could you make the changes disabled tun devices when Android environment?

@hax0r31337

hax0r31337 · 2023-11-15T07:14:22Z

The kernelMode is confusing for users. Could you make the changes disabled tun devices when Android environment?

@hax0r31337

In my opinion, it's necessary to keep a user-space feature in case of insufficient permission, or just for granting superuser permission as less as possible.
Perhaps it need a better name, I'm bad at naming things

kunsonx · 2023-11-15T07:29:32Z

Let's make the things as two.

The first one we can't use tun device and setup iptables params on Android. so the option for system tun should be disabled for anytime.

The second thing it is we can provide option for enable or disable system tun device and in my opinion it should be enable by default (It provide better netstack performance).

hax0r31337 · 2023-11-15T08:23:24Z

On the other hand, my opinion is to maintain an out-of-box experience. Since all of the default outbound/inbound configuration can work in the user-space, expect this thing.

kunsonx · 2023-11-15T08:33:34Z

So could we check which permissions we have when it started then choose which mode we can run by default? it's possible ?

hax0r31337 · 2023-11-15T12:04:42Z

So could we check which permissions we have when it started then choose which mode we can run by default? it's possible ?

Nice proposal, I'll give it a try

hax0r31337 · 2023-11-15T12:28:27Z

The kernelMode config can be ignored for most of the users from now on.

kunsonx · 2023-11-15T13:18:19Z

Thanks for your work. It looks better now.

yuhan6665 · 2023-11-16T03:00:06Z

测了一下更新
tun 可以了但是似乎是 UDP 流量出不去 wg outbound
TCP 测了好像没有问题等会儿我试下 inbound

10:53:22.291  I  [Info] app/dns: failed to lookup ip for domain imasdk.googleapis.com at server UDP:1.1.1.1:53 > context deadline exceeded
10:53:22.291  I  [Info] [3036575879] app/proxyman/outbound: failed to process outbound traffic > proxy/wireguard: failed to lookup DNS > app/dns: returning nil for domain imasdk.googleapis.com > multierr: context deadline exceeded | 
10:53:22.291  I  [Info] [3036575879] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

yuhan6665 · 2023-11-16T03:40:34Z

inbound 没有问题我试了老版的 client 对新版的 server 完全正常

hax0r31337 · 2023-11-16T04:23:35Z

测了一下更新 tun 可以了但是似乎是 UDP 流量出不去 wg outbound TCP 测了好像没有问题等会儿我试下 inbound

10:53:22.291  I  [Info] app/dns: failed to lookup ip for domain imasdk.googleapis.com at server UDP:1.1.1.1:53 > context deadline exceeded
10:53:22.291  I  [Info] [3036575879] app/proxyman/outbound: failed to process outbound traffic > proxy/wireguard: failed to lookup DNS > app/dns: returning nil for domain imasdk.googleapis.com > multierr: context deadline exceeded | 
10:53:22.291  I  [Info] [3036575879] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

Unfortunately, I was unable to reproduce this issue, it's working on my PC.

2023/11/16 12:21:34 [Debug] [1674829396] proxy/dokodemo: processing connection from: 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] proxy/dokodemo: received request for 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] app/dispatcher: default route for udp:9.9.9.9:53
2023/11/16 12:21:34 127.0.0.1:51306 accepted udp:9.9.9.9:53 [proxy1 >> client]

Config: https://pastebin.mozilla.org/pwtDSNZf
I have tested whether kernelMode set to on or off, it's both working

yuhan6665 · 2023-11-16T13:24:43Z

好的感谢我再研究一下不行就先合发版
@kunsonx 麻烦你有空也测一下

yuhan6665 · 2023-11-18T03:27:20Z

先合了感谢两位大佬！

Phoenix-999 · 2023-11-22T11:29:51Z

@hax0r31337
I know you are very busy, but do you have a step-by-step guide on how to set up WireGuard inbound and outbound correctly?
I appreciate your assistance in advance.

hkbase · 2023-11-26T03:02:25Z

{
    "tag": "wgserver",
    "port": 8888,
    "protocol": "wireguard",
    "settings": {
        "secretKey": "yIw6sjOIp94Ni4mdlPm3GMJ4PvowqGVDZ1Ouw+f7Ukc=",
        "peers": [
            {
                "publicKey": "VvME/dCl8xvuWXljnNqRJFBeekk32SfjGqf/vKbXB2M=",
                "allowedIPs": [
                    "192.168.1.0/24"
                ]
            }
        ],
        "mtu": 1412
    }
}

使用上面的配置，创建wireguard入站server配置失败，报错如下：

Failed to start: main: failed to create server > proxy/wireguard: TODO: support promiscuous mode

hax0r31337 · 2023-11-26T05:28:36Z

{ "tag": "wgserver", "port": 8888, "protocol": "wireguard", "settings": { "secretKey": "yIw6sjOIp94Ni4mdlPm3GMJ4PvowqGVDZ1Ouw+f7Ukc=", "peers": [ { "publicKey": "VvME/dCl8xvuWXljnNqRJFBeekk32SfjGqf/vKbXB2M=", "allowedIPs": [ "192.168.1.0/24" ] } ], "mtu": 1412 } } 使用上面的配置，创建wireguard入站server配置失败，报错如下： Failed to start: main: failed to create server > proxy/wireguard: TODO: support promiscuous mode

You are running on a previliged user, which activates kernel mode automatically, but the wireguard server doesn't support kernel mode currently, you have to disable kernel mode manually by adding "kernelMode": false in the settings

hkbase · 2023-11-27T05:12:02Z

@hax0r31337 thank you very much～，adding "kernelMode": false in the settings，then it‘s OK～

{
  "inbounds": [
    {
      "tag": "wgserver",
      "port": 8888,
      "protocol": "wireguard",
      "settings": {
        "secretKey": "yIw6sjOIp94Ni4mdlPm3GMJ4PvowqGVDZ1Ouw+f7Ukc=",
        "peers": [
          {
            "publicKey": "VvME/dCl8xvuWXljnNqRJFBeekk32SfjGqf/vKbXB2M=",
            "allowedIPs": [
              "192.168.1.0/24"
            ]
          }
        ],
        "kernelMode": false,
        "mtu": 1412
      }
    }
  ]
}

masbur · 2023-12-12T04:34:18Z

Is Wireguard inbound not support statsquery for each peer ?

{
    "stat": [
        {
            "name": "inbound>>>api>>>traffic>>>uplink",
            "value": "3144"
        },
        {
            "name": "inbound>>>api>>>traffic>>>downlink",
            "value": "5016"
        },
        {
            "name": "inbound>>>Wireguard>>>traffic>>>uplink",
            "value": "331012"
        },
        {
            "name": "inbound>>>Wireguard>>>traffic>>>downlink",
            "value": "7663508"
        },
        {
            "name": "outbound>>>blocked>>>traffic>>>uplink",
            "value": "0"
        },
        {
            "name": "outbound>>>blocked>>>traffic>>>downlink",
            "value": "0"
        }
    ]
}

MJamshidnejad · 2023-12-25T12:57:42Z

@hax0r31337 thank you very much～，adding "kernelMode": false in the settings，then it‘s OK～

{
  "inbounds": [
    {
      "tag": "wgserver",
      "port": 8888,
      "protocol": "wireguard",
      "settings": {
        "secretKey": "yIw6sjOIp94Ni4mdlPm3GMJ4PvowqGVDZ1Ouw+f7Ukc=",
        "peers": [
          {
            "publicKey": "VvME/dCl8xvuWXljnNqRJFBeekk32SfjGqf/vKbXB2M=",
            "allowedIPs": [
              "192.168.1.0/24"
            ]
          }
        ],
        "kernelMode": false,
        "mtu": 1412
      }
    }
  ]
}

It is needed to configuration guide page of Wireguard outbound.

MrSaeid007 · 2024-03-28T16:27:07Z

I tested it and updated tun. It works, but it seems that UDP traffic cannot go out. wg outbound TCP. I tested it and it seems there is no problem. I will try inbound later.

10:53:22.291  I  [Info] app/dns: failed to lookup ip for domain imasdk.googleapis.com at server UDP:1.1.1.1:53 > context deadline exceeded
10:53:22.291  I  [Info] [3036575879] app/proxyman/outbound: failed to process outbound traffic > proxy/wireguard: failed to lookup DNS > app/dns: returning nil for domain imasdk.googleapis.com > multierr: context deadline exceeded | 
10:53:22.291  I  [Info] [3036575879] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

Unfortunately, I was unable to reproduce this issue, it's working on my PC.

2023/11/16 12:21:34 [Debug] [1674829396] proxy/dokodemo: processing connection from: 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] proxy/dokodemo: received request for 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] app/dispatcher: default route for udp:9.9.9.9:53
2023/11/16 12:21:34 127.0.0.1:51306 accepted udp:9.9.9.9:53 [proxy1 >> client]

Config: https://pastebin.mozilla.org/pwtDSNZf I have tested whether kernelMode set to on or off, it's both working

Hi, @hax0r31337
Is it possible to add L2tp or pptp into Xray-core?

hax0r31337 · 2024-03-28T16:33:04Z

I tested it and updated tun. It works, but it seems that UDP traffic cannot go out. wg outbound TCP. I tested it and it seems there is no problem. I will try inbound later.
10:53:22.291  I  [Info] app/dns: failed to lookup ip for domain imasdk.googleapis.com at server UDP:1.1.1.1:53 > context deadline exceeded
10:53:22.291  I  [Info] [3036575879] app/proxyman/outbound: failed to process outbound traffic > proxy/wireguard: failed to lookup DNS > app/dns: returning nil for domain imasdk.googleapis.com > multierr: context deadline exceeded | 
10:53:22.291  I  [Info] [3036575879] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe
Unfortunately, I was unable to reproduce this issue, it's working on my PC.
2023/11/16 12:21:34 [Debug] [1674829396] proxy/dokodemo: processing connection from: 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] proxy/dokodemo: received request for 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] app/dispatcher: default route for udp:9.9.9.9:53
2023/11/16 12:21:34 127.0.0.1:51306 accepted udp:9.9.9.9:53 [proxy1 >> client]
Config: https://pastebin.mozilla.org/pwtDSNZf I have tested whether kernelMode set to on or off, it's both working
Hi, @hax0r31337 Is it possible to add L2tp or pptp into Xray-core?

It's possible, but these protocols have a decreasing audience and not future-proof.
It's not worth it to add these protocols to xray-core in my opinion

MrSaeid007 · 2024-03-28T16:57:42Z

I tested it and updated tun. It works, but it seems that UDP traffic cannot go out. wg outbound TCP. I tested it and it seems there is no problem. I will try inbound later.
10:53:22.291  I  [Info] app/dns: failed to lookup ip for domain imasdk.googleapis.com at server UDP:1.1.1.1:53 > context deadline exceeded
10:53:22.291  I  [Info] [3036575879] app/proxyman/outbound: failed to process outbound traffic > proxy/wireguard: failed to lookup DNS > app/dns: returning nil for domain imasdk.googleapis.com > multierr: context deadline exceeded | 
10:53:22.291  I  [Info] [3036575879] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe
Unfortunately, I was unable to reproduce this issue, it's working on my PC.
2023/11/16 12:21:34 [Debug] [1674829396] proxy/dokodemo: processing connection from: 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] proxy/dokodemo: received request for 127.0.0.1:51306
2023/11/16 12:21:34 [Info] [1674829396] app/dispatcher: default route for udp:9.9.9.9:53
2023/11/16 12:21:34 127.0.0.1:51306 accepted udp:9.9.9.9:53 [proxy1 >> client]
Config: https://pastebin.mozilla.org/pwtDSNZf I have tested whether kernelMode set to on or off, it's both working
Hi, @hax0r31337 Is it possible to add L2tp or pptp into Xray-core?
It's possible, but these protocols have a decreasing audience and not future-proof. It's not worth it to add these protocols to xray-core in my opinion

I understand what you mean but I just offered because many of modems(LTE,Fiber,etc) in market only support l2tp or pptp protocol and they not support wireguard or...

Even many clients like windows, mobile(Ipsec)...etc support built-in l2tp or pptp as well so I just offer maybe @RPRX accept.

But I don't have a knowledge to send PR request to do so. I don't know what's the idea of @RPRX to adding this protocol just to inbound Xray-core. so in x-ui panel we can create L2tp or pptp for inbound and connect or local server(VPS) in our country via this protocol.
cc @RPRX & @yuhan6665 & @hax0r31337

hax0r31337 added 4 commits August 23, 2023 11:16

feat: wireguard inbound

54276e4

feat(command): generate wireguard compatible keypair

cfeb5f8

feat(wireguard): connection idle timeout

d1c827d

fix(wireguard): close endpoint after connection closed

20fbb51

hax0r31337 and others added 2 commits August 24, 2023 23:57

Merge branch 'main' into main

f17fa3a

fix(wireguard): resolve conflicts

ed38086

RPRX mentioned this pull request Aug 26, 2023

WIP feat: refactor wireguard outbound #1974

Closed

hax0r31337 and others added 5 commits September 19, 2023 16:32

feat(wireguard): set cubic as default cc algorithm in gVisor TUN

a485cc6

Merge branch 'main' into merged-1

a1c657f

chore(wireguard): resolve conflict

28b98e3

chore(wireguard): remove redurant code

23cd296

chore(wireguard): remove redurant code

a33c17c

hax0r31337 marked this pull request as draft November 13, 2023 02:50

hax0r31337 added 2 commits November 13, 2023 11:24

feat: resolve conflicts & rework client

0f5171b

feat: rework server for gvisor tun

6142b33

feat: keep user-space tun as an option

ea22f73

hax0r31337 marked this pull request as ready for review November 13, 2023 07:04

hax0r31337 added 2 commits November 15, 2023 20:12

fix: exclude android from native tun build

4f12363

feat: auto kernel tun

41f2f89

fix: build

be31524

fix: regulate function name & fix test

440292c

yuhan6665 merged commit 0ac7da2 into XTLS:main Nov 18, 2023
34 checks passed

us254 mentioned this pull request Nov 19, 2023

1.8.6更新后wireguard出站异常，回滚到1.8.4正常 #2736

Closed

Phoenix-999 mentioned this pull request Nov 23, 2023

Add WireGuard protocol (feature enhancement suggestion) FranzKafkaYu/x-ui#544

Open

kunsonx mentioned this pull request Nov 26, 2023

Optimize wireguard kernel mode #2757

Open

OnceUponATimeInAmerica mentioned this pull request Jan 12, 2024

wireguard 入站功能缺失 alireza0/x-ui#853

Closed

chika0801 mentioned this pull request May 13, 2024

Wireguard inbound chika0801/Xray-examples#31

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WireGuard Inbound (User-space WireGuard server) #2477

WireGuard Inbound (User-space WireGuard server) #2477

hax0r31337 commented Aug 23, 2023

yuhan6665 commented Aug 24, 2023

master88wi commented Aug 24, 2023

RPRX commented Aug 26, 2023

yuhan6665 commented Nov 13, 2023

hax0r31337 commented Nov 13, 2023 •

edited

Loading

yuhan6665 commented Nov 13, 2023

yuhan6665 commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

kunsonx commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

yuhan6665 commented Nov 16, 2023

yuhan6665 commented Nov 16, 2023

hax0r31337 commented Nov 16, 2023 •

edited

Loading

yuhan6665 commented Nov 16, 2023

yuhan6665 commented Nov 18, 2023

Phoenix-999 commented Nov 22, 2023

hkbase commented Nov 26, 2023 •

edited

Loading

hax0r31337 commented Nov 26, 2023

hkbase commented Nov 27, 2023 •

edited

Loading

masbur commented Dec 12, 2023 •

edited

Loading

MJamshidnejad commented Dec 25, 2023

MrSaeid007 commented Mar 28, 2024

hax0r31337 commented Mar 28, 2024

MrSaeid007 commented Mar 28, 2024 •

edited

Loading

WireGuard Inbound (User-space WireGuard server) #2477

WireGuard Inbound (User-space WireGuard server) #2477

Conversation

hax0r31337 commented Aug 23, 2023

yuhan6665 commented Aug 24, 2023

master88wi commented Aug 24, 2023

RPRX commented Aug 26, 2023

yuhan6665 commented Nov 13, 2023

hax0r31337 commented Nov 13, 2023 • edited Loading

yuhan6665 commented Nov 13, 2023

yuhan6665 commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

kunsonx commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

hax0r31337 commented Nov 15, 2023

kunsonx commented Nov 15, 2023

yuhan6665 commented Nov 16, 2023

yuhan6665 commented Nov 16, 2023

hax0r31337 commented Nov 16, 2023 • edited Loading

yuhan6665 commented Nov 16, 2023

yuhan6665 commented Nov 18, 2023

Phoenix-999 commented Nov 22, 2023

hkbase commented Nov 26, 2023 • edited Loading

hax0r31337 commented Nov 26, 2023

hkbase commented Nov 27, 2023 • edited Loading

masbur commented Dec 12, 2023 • edited Loading

MJamshidnejad commented Dec 25, 2023

MrSaeid007 commented Mar 28, 2024

hax0r31337 commented Mar 28, 2024

MrSaeid007 commented Mar 28, 2024 • edited Loading

hax0r31337 commented Nov 13, 2023 •

edited

Loading

hax0r31337 commented Nov 16, 2023 •

edited

Loading

hkbase commented Nov 26, 2023 •

edited

Loading

hkbase commented Nov 27, 2023 •

edited

Loading

masbur commented Dec 12, 2023 •

edited

Loading

MrSaeid007 commented Mar 28, 2024 •

edited

Loading