You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+24-35Lines changed: 24 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,41 +4,30 @@ WireGuard Obfuscator is a tool designed to make WireGuard traffic look like rand
4
4
5
5
What started as a quick-and-dirty solution just for personal use has grown into a fully-featured project with the following capabilities:
6
6
7
-
##### Key-Based Obfuscation
8
-
Obfuscation is performed using a user-specified key. While this arguably makes it more like encryption, keep in mind that strong cryptography is not the goal here—WireGuard itself already handles secure encryption. The key's purpose is to make your traffic look unrecognizable, not unbreakable.
9
-
10
-
##### Symmetric operation
11
-
You can use the obfuscator on both ends of a WireGuard tunnel, or just one—it will figure out automatically whether packets are obfuscated or not, and will always do the right thing.
12
-
13
-
##### Packet Salting
14
-
Each packet gets a random salt, ensuring that even identical packets always look different after obfuscation. This further frustrates signature-based DPI systems.
15
-
16
-
##### Handshake Randomization
17
-
WireGuard handshake packets are padded with random dummy data, so their obfuscated sizes vary widely. This makes it difficult for anyone monitoring traffic to spot patterns or reliably fingerprint handshakes. Even data packets can have their size increased by a few random bytes.
18
-
19
-
##### Built-In NAT Table
20
-
The application features a high-performance, built-in NAT table. This allows hundreds of clients to connect to a single server port while preserving fast, efficient forwarding. Each client’s address and port are mapped to a unique server-side port.
21
-
22
-
##### Static (Manual) Bindings / Two-Way Mode
23
-
You can manually define static NAT table entries, which enables "two-way" mode—allowing both WireGuard peers to initiate connections toward each other through the obfuscator.
24
-
25
-
##### Multi-Section Config Files
26
-
Supports both simple config files and command-line arguments for quick one-off runs or advanced automation. You can define multiple obfuscator instances within a single config file.
27
-
28
-
##### Detailed and customizable logging
29
-
Verbosity levels range from errors-only to full packet-level traces for advanced troubleshooting and analytics.
30
-
31
-
##### Cross-Platform and Lightweight
32
-
Available as binaries for Linux, Windows, and Mac, as well as tiny multi-arch Docker images (amd64, arm64, arm/v7, arm/v6, 386, ppc64le, s390x). The images are extremely small and suitable even for embedded routers like MikroTik.
33
-
34
-
##### Cross-compile ready
35
-
Easily portable and compilable on Linux, macOS, and Windows (MSYS2/MinGW, with automatic fallback to poll()).
36
-
37
-
##### Very low dependency footprint
38
-
No huge libraries or frameworks.
39
-
40
-
##### Android Client Coming Soon?
41
-
A companion Android client is planned.
7
+
***Key-Based Obfuscation**
8
+
Obfuscation is performed using a user-specified key. While this arguably makes it more like encryption, keep in mind that strong cryptography is not the goal here—WireGuard itself already handles secure encryption. The key's purpose is to make your traffic look unrecognizable, not unbreakable.
9
+
***Symmetric operation**
10
+
You can use the obfuscator on both ends of a WireGuard tunnel, or just one—it will figure out automatically whether packets are obfuscated or not, and will always do the right thing.
11
+
***Packet Salting**
12
+
Each packet gets a random salt, ensuring that even identical packets always look different after obfuscation. This further frustrates signature-based DPI systems.
13
+
***Handshake Randomization**
14
+
WireGuard handshake packets are padded with random dummy data, so their obfuscated sizes vary widely. This makes it difficult for anyone monitoring traffic to spot patterns or reliably fingerprint handshakes. Even data packets can have their size increased by a few random bytes.
15
+
***Built-In NAT Table**
16
+
The application features a high-performance, built-in NAT table. This allows hundreds of clients to connect to a single server port while preserving fast, efficient forwarding. Each client’s address and port are mapped to a unique server-side port.
17
+
***Static (Manual) Bindings / Two-Way Mode**
18
+
You can manually define static NAT table entries, which enables "two-way" mode—allowing both WireGuard peers to initiate connections toward each other through the obfuscator.
19
+
***Multi-Section Config Files**
20
+
Supports both simple config files and command-line arguments for quick one-off runs or advanced automation. You can define multiple obfuscator instances within a single config file.
21
+
***Detailed and customizable logging**
22
+
Verbosity levels range from errors-only to full packet-level traces for advanced troubleshooting and analytics.
23
+
***Cross-Platform and Lightweight**
24
+
Available as binaries for Linux, Windows, and Mac, as well as tiny multi-arch Docker images (amd64, arm64, arm/v7, arm/v6, 386, ppc64le, s390x). The images are extremely small and suitable even for embedded routers like MikroTik.
25
+
***Cross-compile ready**
26
+
Easily portable and compilable on Linux, macOS, and Windows (MSYS2/MinGW, with automatic fallback to poll()).
27
+
***Very low dependency footprint**
28
+
No huge libraries or frameworks.
29
+
***Android Client Coming Soon?**
30
+
A native Android version of the obfuscator is planned, allowing you to obfuscate WireGuard traffic directly on Android devices (including phones, tablets, or Android TVs). This will make it possible to use the obfuscator together with mobile WireGuard clients or WireGuard running on smart TVs.
0 commit comments