{"id":28483593,"url":"https://github.com/sh0rch/nf_wgobfs","last_synced_at":"2026-05-12T07:32:34.916Z","repository":{"id":296155258,"uuid":"986962040","full_name":"sh0rch/nf_wgobfs","owner":"sh0rch","description":"User-space WireGuard traffic obfuscator for DPI/ML evasion, using NFQUEUE + ChaCha. Fast, lightweight, and container-ready.","archived":false,"fork":false,"pushed_at":"2025-06-20T04:54:14.000Z","size":52,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-20T05:29:48.497Z","etag":null,"topics":["iptables","linux","netfilter","nfqueue","nftables","obfuscation","rust","udp","vpn","wgobfs","wireguard"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sh0rch.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-05-20T11:25:47.000Z","updated_at":"2025-06-10T09:00:07.000Z","dependencies_parsed_at":"2025-05-29T08:33:26.253Z","dependency_job_id":"1ba5d56b-48bc-4d87-a2ff-4e9707c624ad","html_url":"https://github.com/sh0rch/nf_wgobfs","commit_stats":null,"previous_names":["sh0rch/nf_wgobfs"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/sh0rch/nf_wgobfs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sh0rch%2Fnf_wgobfs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sh0rch%2Fnf_wgobfs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sh0rch%2Fnf_wgobfs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sh0rch%2Fnf_wgobfs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sh0rch","download_url":"https://codeload.github.com/sh0rch/nf_wgobfs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sh0rch%2Fnf_wgobfs/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262239238,"owners_count":23280285,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["iptables","linux","netfilter","nfqueue","nftables","obfuscation","rust","udp","vpn","wgobfs","wireguard"],"created_at":"2025-06-07T22:00:41.160Z","updated_at":"2026-05-12T07:32:34.911Z","avatar_url":"https://github.com/sh0rch.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# 🛡️ nf-wgobfs\n\n⚠️ **Project archived**\n\nThis project is no longer actively developed and has been moved to archive status.\n\nOriginally `nf_wgobfs` implemented WireGuard traffic obfuscation using the Linux\n**netfilter/NFQUEUE** pipeline. One of the planned future directions was migration\nto **eBPF-based packet filtering** to eliminate NFQUEUE overhead and move packet\nprocessing fully into the kernel datapath.\n\nThis work has since been completed in a successor project.\n\n## Successor project\n\nThe development has continued in **gutd**:\n\nhttps://github.com/sh0rch/gutd\n\nKey milestones:\n\n- **v1.2.0** — first TC/XDP eBPF implementation of the obfuscation approach  \n  (conceptual successor of `nf_wgobfs`, but **not wire-compatible**).\n- **v2.0.0** and current **main** — a more advanced implementation using\n  **QUIC-like traffic patterns** and improved obfuscation techniques.\n\n## Project lineage\n\n\nnf_wgobfs → gutd (eBPF / TC / XDP)\n\n\nIf you are looking for a maintained implementation, please use **gutd**.\n\n___\n\n## ✨ Features\n\n* 🔐 **Header + MAC2 obfuscation** with ChaCha (Fastest CPU-optimied ChaCha20 if available, pure Rust fallback)  \n* 📦 **Random ballast + nonce** → breaks length fingerprinting  \n* 🔄 **Adaptive keep‑alive dropper** — hides WG heartbeat patterns while respecting NAT TTL  \n* ⚡ **Zero‑copy hot‑path**: minimal `copy_within`, no heap per packet → multi‑Gbps  \n* 🧠 **IPv4 \u0026 IPv6** support, full UDP/IP checksum recalculation  \n* ☁ **Container‑friendly** — pure user‑space, single binary, no kernel patches\n* 🦀 **No `unsafe` and no dependency on libc** — memory safety and maximum portability\n\n---\n\n## 🔬 Packet layout (after obfuscation)\n\n```\n[IP] [UDP] [CS] [WG_HEADER*] [WG_PAYLOAD] [BALLAST] [L*] [MAC2*] [NONCE]\n                └─── XOR ──┘                        └─── XOR ──┘\n                \nL  – ballast length (1 byte)  \n*  – encrypted bytes (ChaCha)\n```\n\n---\n\n## 🔗 Inspiration \u0026 Differences\n\nThe project is inspired by [infinet/xt_wgobfs](https://github.com/infinet/xt_wgobfs) (kernel module).  \n`nf-wgobfs` takes the idea to user‑space:\n\n|                     | `xt_wgobfs` (kernel) | **nf‑wgobfs** (user‑space) |\n|---------------------|----------------------|----------------------------|\n| Layer               | kernel xt target     | NFQUEUE userspace binary   |\n| Container‑ready     | ✖                    | ✔                         |\n| Kernel upgrade pain | yes (rebuild)        | none                       |\n| SSE2/AVX2 / NEON    | limited              | CPU optimized, auto-detect |\n| ARM VPS             | depends              | CPU optimized, auto-detect |\n| Debug logging       | `dmesg`              | CLI debug mode             |\n\n---\n\n## 📦 Build \u0026 Install\n\n### Dependencies\n```bash\nsudo apt install libnetfilter-queue-dev    # header + .so for build\nrustup toolchain install stable            # if not installed\n```\n\n### Compile\n```bash\ngit clone https://github.com/sh0rch/nf-wgobfs.git\ncd nf-wgobfs\ncargo build --release   # or  cargo build --debug  for verbose logs\n```\n\nResulting binary: `target/release/nf-wgobfs`\n\n---\n\n## 🔧 Quick start\n\n### 1. Prepare configuration file\n\nDefault path is `/etc/nf_wgobfs.conf` (override with `NF_WGOBFS_CONF=/path`):\n\n```ini\n# queue:direction:name:key[:mtu]\n1:out:wg_out:0123456789abcdef0123456789abcdef:1350\n2:in:wg_in:fedcba9876543210fedcba9876543210   # auto cipher, mtu 1500\n```\n\n* **queue** – NFQUEUE number (matches iptables rule).\n* **direction** – `in` or `out` (case‑insensitive).\n* **name** – Free‑form tag for logs.\n* **key** – 32‑byte hex ASCII (same on both ends).\n* **mtu** – *(optional)* effective MTU on external interface, *not WireGuard interface!* (default 1500).\n\n### 2. Wire Firewall\n#### » nftables rules\n\n```bash\nsudo nft add table inet myfilter\n\nsudo nft add chain inet myfilter in_chain {\n    type filter hook prerouting priority 0; policy accept;\n}\n\nsudo nft add chain inet myfilter out_chain {\n    type filter hook postrouting priority 0; policy accept;\n}\n\n# Example: send all UDP to NFQUEUE\nsudo nft add rule inet myfilter in_chain udp dport \u003cLOCAL WG PORT\u003e sport \u003cREMOTE WG PORT\u003e queue num 0\nsudo nft add rule inet myfilter out_chain udp sport \u003cLOCAL WG PORT\u003e dport \u003cREMOTE WG PORT\u003e  queue num 1\n```\n\n#### » iptables *(if you want)*\n\n```bash\n# Inbound (deobfuscation) — before routing\nsudo iptables -t mangle -A PREROUTING -p udp --dport \u003cLOCAL WG PORT\u003e --sport \u003cREMOTE WG PORT\u003e  -j NFQUEUE --queue-num 0\n\n# Outbound (obfuscation) — after routing\nsudo iptables -t mangle -A POSTROUTING -p udp --sport \u003cLOCAL WG PORT\u003e --dport \u003cREMOTE WG PORT\u003e -j NFQUEUE --queue-num 1\n```\n\n*One queue can manage all your WG tunnels. But you must differentiate INBOUND and OUTBOUND traffic to different queues. For better performance, it is better to choose two queues (IN, OUT) per tunnel.*\n\n### 3. Run filter\n\n```bash\nsudo ./nf-wgobfs\n```\n\n#### Command‑line reference\n\n```text\nnf_wgobfs [COMMAND]\n\n                      start all NFQUEUEs in foreground\n--queue \u003cn\u003e           NFQUEUE number (default 0) in foreground\n--generate-units      prepare systemd units to /tmp/nf_wgobfs\n```\n\n---\n\nEnvironment variables:\n\n| Variable          | Meaning                                                 |\n| ----------------- | ------------------------------------------------------ |\n| `NF_WGOBFS_CONF`  | Alternative path to config file                        |\n| `NF_WGOBFS_QUEUE` | Override queue number passed to program (rarely needed)|\n\n---\n\n## 🛠️ Service example (systemd)\n\nGenerate and install automatically:\n```bash\nsudo ./nf-wgobfs --generate-units\nsudo cp /tmp/nf_wgobfs/nf_wgobfs@*.service /etc/systemd/system/\nsudo cp /tmp/nf_wgobfs/nf_wgobfs.target /etc/systemd/system/\nsudo systemctl daemon-reload\nsudo systemctl enable nf_wgobfs.target\nsudo systemctl start nf_wgobfs.target\n```\n\n---\n\n## 🚦 CPU Compatibility\n\nTested CPUs you can find on [fast_chacha](https://github.com/sh0rch/fast_chacha) [actions page](https://github.com/sh0rch/fast_chacha/actions/runs/15289911899)\n\n---\n\n## 🍰 Contributing\n\nSee **CONTRIBUTING.md** – PRs \u0026 issues are welcome!\n\n---\n\n## 📄 License\n\nMIT © sh0rch\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsh0rch%2Fnf_wgobfs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsh0rch%2Fnf_wgobfs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsh0rch%2Fnf_wgobfs/lists"}