Add TLS Support to bypass UDP blockings

[amirhmoradi]

Hi, thanks for the great work on this project. I have been searching for quite sometime to find the best combination of amnezia+ui+tor.

Context:

In highly censored countries, UDP traffic is either blocked totally or heavily impacted (ex: 50% of packets are dropped or long delays injected to break handshakes).

Suggestion:

Add a tunnel support like https://github.com/ameshkov/udptlspipe to pass the wireguard udp (even amneziawg is udp...) connection inside the tunnel (important to support the Probing protection config from the udptlspipe project too to avoid the wg server endpoint being blocked)

[NOXCIS]

@amirhmoradi I'll look into it

[amirhmoradi]

@NOXCIS thanks for looking into this.
I was doing some tests and came to the conclusion: We need to have the possibility for clients to either connect directly through udp (as it works currently) or use the tls/tcp tunnel.
This way, for users (and mainly nodes in a site-to-site setup) who are not in those censored countries, there would be no impact (in terms of speed and complexity of connecting).
thanks.

[NOXCIS]

@amirhmoradi does the tls tunnel need to work on the client side as well or am I confused?

[amirhmoradi]

the client side is the responsibility of the client, we need just to explain the feature clearly in the documentation.

the wiregate stack shall expose the tunnel server and configure it to connect to the wireguard server - > details and specific important wireguard details

then, (outside of scope) the client shall install the udptlspipe on their local machine and configure their wireguard clients to connect to the local udptlspipe process with correct mtu settings.

the important part would be:

• exclude udptlspipe server IP from AllowedIPs in the WireGuard client configuration
• expose both normal wg (or amneziawg) and the tunnel in the same time

also, the udptlspipe is one of multiple ways to manage the usecase, maybe other projects are also good.

[NOXCIS]

@amirhmoradi setting default exclusionary rules is easy.
Same goes for port exposure. I could integrate udptls container or build it into the WireGate container. As long as I maintain backwards compatibility.

[amirhmoradi]

@NOXCIS I would vote for using their container for easier set up, clarity and maintenance.

[NOXCIS]

@amirhmoradi Should it be to the quick installer defaults or should it be always on.

[amirhmoradi]

@NOXCIS i am not sure if I understood correctly... the usecase of using udptlspipe being quite limited to cases where users are based in heavily censored countries, i would not turn it on by default, but rather leave it to the admin to decide and inform the users.

[amirhmoradi]

@NOXCIS hi, is there anything I can do to help this issue move forward please ?

[NOXCIS]

@amirhmoradi PR?

[NOXCIS]

@amirhmoradi After testing and reading much documentation, I've decide not to go with UDPTLSPipe opting for a modified wg-tcp-tunnel instead that will be built into the server dashboard and a custom IOS and Mac OS client. Windows and Android clients will follow later.

UDPTLSPipe is just too unstable in real world use in my experience with it so far.