{"id":21814326,"url":"https://github.com/snawoot/wg-decoy","last_synced_at":"2025-04-13T23:46:19.901Z","repository":{"id":190044479,"uuid":"680775863","full_name":"Snawoot/wg-decoy","owner":"Snawoot","description":"Decoy handshake for Wireguard","archived":false,"fork":false,"pushed_at":"2023-08-27T15:40:21.000Z","size":17,"stargazers_count":37,"open_issues_count":0,"forks_count":2,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-27T13:51:22.905Z","etag":null,"topics":["dpi","dpi-bypassing","wireguard","wireguard-vpn"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Snawoot.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-20T11:16:42.000Z","updated_at":"2024-10-03T09:04:37.000Z","dependencies_parsed_at":"2024-06-21T13:13:21.165Z","dependency_job_id":null,"html_url":"https://github.com/Snawoot/wg-decoy","commit_stats":null,"previous_names":["snawoot/wg-decoy"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snawoot%2Fwg-decoy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snawoot%2Fwg-decoy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snawoot%2Fwg-decoy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snawoot%2Fwg-decoy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Snawoot","download_url":"https://codeload.github.com/Snawoot/wg-decoy/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248799695,"owners_count":21163398,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dpi","dpi-bypassing","wireguard","wireguard-vpn"],"created_at":"2024-11-27T14:37:44.013Z","updated_at":"2025-04-13T23:46:19.878Z","avatar_url":"https://github.com/Snawoot.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# wg-decoy\n\nDecoy handshake for Wireguard. Allows some initial exchange between wireguard server and client in order to derail DPI filtering.\n\n## Installation\n\n### Binaries\n\nPre-built binaries are available [here](https://github.com/Snawoot/wg-decoy/releases/latest).\n\n### Build from source\n\nRun in the source directory:\n\n```\nmake\n```\n\nBinary will be available in the `bin` directory.\n\nAlternatively, you may invoke Go directly:\n\n```\ngo build ./cmd/wg-decoy -o bin/wg-decoy\n```\n\n## Running application\n\n## Server (Linux only)\n\nAdd iptables rule to capture small packets targeted to wireguard port:\n\n```sh\niptables -t mangle -A PREROUTING -i eth0 -p udp -m udp --dport 51820 -m addrtype --dst-type LOCAL -m length --length 0:44 -j TPROXY --on-port 1820 --on-ip 127.0.0.1\n```\n\nwhere instead of `eth0` use actual address of your public interface, instead of port `51820` use actual wireguard server port.\n\nThen just run server:\n\n```\nwg-decoy server\n```\n\n### Client\n\nMake sure you use some random but fixed port in your wireguard config like this:\n\n```\nListenPort = 56218\n```\n\nand then right before connection start run command:\n\n```\nwg-decoy client SERVER_ADDRESS:SERVER_PORT LOCAL_PORT\n```\n\nwhere `SERVER_ADDRESS:SERVER_PORT` is a WG server endpoint and `LOCAL_PORT` is your `ListenPort` value in your client config.\n\nIf you use `wg-quick` it may be convenient to add wg-decoy invokation as a `PreUp` command in your client config.\n\n## Synopsis\n\n```\n$ wg-decoy -h\nUsage:\n\nwg-decoy [OPTION]... server\nwg-decoy [OPTION]... client \u003cSERVER ADDRESS:PORT\u003e \u003cLOCAL WG PORT\u003e\nwg-decoy version\n\nOptions:\n  -attempts uint\n    \tnumber of client request attempts (default 10)\n  -bind-address string\n    \tserver bind address (default \"127.0.0.1:1820\")\n  -break-early\n    \treturn as soon as minimal number of responses acquired (default true)\n  -client-req string\n    \tclient request (default \"PING\")\n  -min-responses uint\n    \tminimal number of responses to collect (default 5)\n  -server-resp string\n    \tserver response (default \"PONG\")\n  -timeout duration\n    \tnetwork operation timeout (default 5s)\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsnawoot%2Fwg-decoy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsnawoot%2Fwg-decoy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsnawoot%2Fwg-decoy/lists"}