windtf/wireproxy

★ 5,593GoAudience · ops devopsComplexity · 3/5LicenseSetup · easy

Mindmap

mindmap
  root((wireproxy))
    What it does
      WireGuard without root
      Local SOCKS5 proxy
      TCP tunnels
    Tech Stack
      Go
      WireGuard protocol
    Use Cases
      Per-app VPN routing
      SSH proxy command
      Reverse TCP tunnel
    Audience
      DevOps engineers
      Power users
    License
      ISC permissive

mindmap root((wireproxy)) What it does WireGuard without root Local SOCKS5 proxy TCP tunnels Tech Stack Go WireGuard protocol Use Cases Per-app VPN routing SSH proxy command Reverse TCP tunnel Audience DevOps engineers Power users License ISC permissive

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Route a single browser or app through a VPN server in another country while the rest of your machine uses your normal connection.

USE CASE 2

Set up a SOCKS5 proxy on localhost that forwards traffic through a WireGuard tunnel, no root required.

USE CASE 3

Create a static TCP tunnel so a local service is reachable over WireGuard from a remote machine.

USE CASE 4

Use wireproxy as an SSH ProxyCommand so SSH connections go through a WireGuard peer.

Tech stack

GoWireGuard

Getting it running

Difficulty · easy Time to first run · 30min

Requires an existing WireGuard peer and its config, wireproxy itself installs with one Go command.

ISC license, use freely for any purpose, including commercial, with minimal restrictions.

In plain English

Wireproxy is a small program that connects to a WireGuard VPN peer and makes that connection available to your other apps as a local proxy, without creating a new network interface on your machine. WireGuard is a modern VPN protocol, but normally setting it up requires administrator (root) permissions and modifies your system's network configuration. Wireproxy avoids both of those requirements by running entirely in user space, meaning it operates like a regular program rather than a system-level network driver. The practical use case is selective routing: you might want one browser or application to send its traffic through a VPN server in another country, while everything else on your machine uses your normal connection. With wireproxy running in the background, you point that specific app at a local SOCKS5 or HTTP proxy address (for example, port 25344 on your own machine), and wireproxy forwards that traffic through the WireGuard tunnel. Beyond proxy mode, wireproxy also supports static TCP tunnels in both directions. A client tunnel listens on a local port and forwards traffic to a remote address over WireGuard. A server tunnel works the opposite way, listening on the WireGuard network and forwarding to a local service. There is also a STDIO tunnel mode, which lets wireproxy act as a proxy command inside SSH configuration. Configuration is done through an INI-style config file that mirrors the format WireGuard already uses, so existing WireGuard configs can be imported with one extra line. The README includes a full sample config with comments explaining each section. Wireproxy is written in Go and can be installed with a single Go install command. It runs on Linux, macOS, and other platforms. The project is licensed under the ISC license.

Copy-paste prompts

Prompt 1

I have a WireGuard config file and want to route only my browser through the VPN using wireproxy. Show me the wireproxy config and how to point Firefox at the local SOCKS5 proxy.

Prompt 2

How do I set up wireproxy to create a reverse TCP tunnel, exposing a local web server on port 8080 to a remote WireGuard peer?

Prompt 3

Give me a wireproxy config that imports my existing wg0.conf WireGuard config and listens on localhost:25344 as an HTTP proxy.

Prompt 4

How do I use wireproxy as a ProxyCommand in ~/.ssh/config so SSH to my home server goes through a WireGuard tunnel?

Open on GitHub → Explain another repo

← windtf on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.