W

wg-obfuscator

> 编程语言

Open source

WireGuard Obfuscator - simple obfuscator for WireGuard. Useful if your ISP/government blocks WireGuard traffic.

770 stars0 likes0 views

Website GitHub

About

WireGuard Obfuscator - simple obfuscator for WireGuard. Useful if your ISP/government blocks WireGuard traffic.

WireGuard Obfuscator

WireGuard Obfuscator is a tool designed to disguise WireGuard traffic as random data or a different protocol, making it much harder for DPI (Deep Packet Inspection) systems to detect and block. This can be extremely useful if your ISP or government attempts to block or throttle WireGuard traffic.

Project Goals:

Compact and dependency-free: The application is designed to be as lightweight as possible, with no external dependencies at all. This makes it suitable even for installation on minimal hardware such as basic home routers.
Independent obfuscator: Instead of maintaining a separate fork of WireGuard, the obfuscator is built to be fully independent of the VPN client/server. This allows seamless integration into an existing network architecture or even running the obfuscator on a separate device if the device running WireGuard is unable to support additional applications.
Preserve bandwidth efficiency: The obfuscator continues to use only UDP and introduces minimal overhead to the size of original packets to ensure maximum throughput.

What it's NOT:

Not a standalone solution: You need to run this tool on both ends of the WireGuard connection. You must deploy the obfuscator on both sides to ensure proper obfuscation and deobfuscation of traffic. Therefore, you cannot use it with third-party VPN servers. If you want to bypass your ISP's restrictions or censorship, you need to run your own VPN server (e.g., hosted on a VPS) and connect to it using WireGuard.
Not a VPN: This is not a VPN service or a WireGuard client/server. It only obfuscates WireGuard traffic.

Table of Contents:

Feature overview
Basic concept
Configuration
How to download, build and install
Caveats and recommendations
Download
Credits
Support the developer and the project

Feature overview

Originally built as a quick personal solution, this project has grown into a fully-featured tool with the following capabilities:

WireGuard-specific design
This obfuscator is purpose-built for the WireGuard protocol: it recognizes WireGuard packet types and actively monitors handshake success to ensure reliable operation.
Key-based obfuscation
Obfuscation is performed using a user-specified key. While this arguably makes it more like encryption, note that providing strong cryptographic guarantees is not the goal here - WireGuard itself already handles secure encryption. The key’s purpose is to make your traffic look unrecognizable, not unbreakable.
Symmetric operation
The tool automatically detects whether packets are obfuscated and processes them accordingly.
Handshake randomization
WireGuard handshake packets are padded with random dummy data, so their obfuscated sizes vary significantly. This makes it difficult for anyone monitoring traffic to spot patterns or reliably fingerprint handshakes. Even data packets can have their size increased by a few random bytes too.
Masking
Starting from version 1.4, the project introduces masking support: the ability to disguise traffic as another protocol. This is especially useful when DPI only allows whitelisted protocols. At the moment, the only available option is STUN emulation. Since STUN is commonly used for video calls, it is rarely blocked.
Very fast and efficient
The obfuscator is designed to be extremely fast, with minimal CPU and memory overhead. It can handle high traffic loads without noticeable performance degradation.
Built-in NAT table
The application features a high-performance, built-in NAT table. This allows hundreds of clients to connect to a single server port while preserving fast, efficient forwarding. Each client’s address and port are mapped to a unique server-side port.
Static (manual) bindings / two-way mode
You can manually define static NAT table entries, which enables "two-way" mode - allowing both WireGuard peers to initiate connections toward each other through the obfuscator.
Multi-section configuration files
Supports both simple configuration files and command-line arguments for quick one-off runs or advanced automation. You can define multiple obfuscator instances within a single configuration file.
Detailed and customizable logging
Verbosity levels range from error-only output to full packet-level traces for advanced troubleshooting and analytics.
Cross-platform and lightweight
Available as binaries for Linux, Windows, and Mac, as well as tiny multi-arch Docker images (amd64, arm64, arm/v7, arm/v6, 386, ppc64le, s390x). The images are extremely small and suitable even for embedded routers like MikroTik.
Very low dependency footprint
No large external libraries or frameworks are required.
Android client
A very simple Android port of the obfuscator is available: https://github.com/ClusterM/wg-obfuscator-android/ - it allows you to obfuscate WireGuard traffic on Android devices, including phones, tablets, and Android TVs.
Easy web UI
If you want a ready-made WireGuard server with obfuscation and a web panel instead of configuring this tool by hand, see WireGuard Obfuscator Easy.

Basic Concept

…

Instance name

[main]

source-lport = 13255 target = 10.13.1.100:13255 key = love static-bindings = 1.2.3.4:12883:6670, 5.6.7.8:12083:6679 verbose = 2

You can specify multiple instances

[second_server] source-if = 0.0.0.0 source-lport = 13255 target = 10.13.1.100:13255 key = hate verbose = 4

…

AllowedIPs = 0.0.0.0/0

…

ini AllowedIPs = 0.0.0.0/0


You would use:

```ini
AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 224.0.0.0/3, 208.0.0.0/4, 192.0.0.0/5,
204.0.0.0/6, 200.0.0.0/7, 202.0.0.0/8, 203.128.0.0/9, 203.64.0.0/10,
203.32.0.0/11, 203.16.0.0/12, 203.8.0.0/13, 203.4.0.0/14, 203.2.0.0/15,
203.1.0.0/16, 203.0.128.0/17, 203.0.0.0/18, 203.0.64.0/19, 203.0.96.0/20,
203.0.120.0/21, 203.0.116.0/22, 203.0.114.0/23, 203.0.112.0/24,
203.0.113.128/25, 203.0.113.64/26, 203.0.113.0/27, 203.0.113.48/28,
203.0.113.32/29, 203.0.113.40/30, 203.0.113.46/31, 203.0.113.44/32

…

ini
[Interface]
FwMark = 0xdead

Then, in WireGuard Obfuscator, specify the same mark:

In the config file:
```
fwmark = 0xdead
```
Or via command-line:
```
--fwmark 0xdead
```

…

[Interface] PrivateKey = ListenPort = 1111

[Peer] PublicKey = Endpoint = 127.0.0.1:2222


**Peer A Obfuscator config** (`1.2.3.4`):

source-lport = 2222 target = 5.6.7.8:4444 static-bindings = 127.0.0.1:1111:3333 key = your_secret_key


**Peer B Obfuscator config** (`5.6.7.8`):

source-lport = 4444 target = 127.0.0.1:6666 static-bindings = 1.2.3.4:3333:5555 key = your_secret_key


**Peer B WireGuard config** (`5.6.7.8`):

[Interface] PrivateKey = ListenPort = 6666

[Peer] PublicKey = Endpoint = 127.0.0.1:5555


In this example the line:

static-bindings = 1.2.3.4:1111:3333


Visually, it looks like this:

…

log-file = /var/log/wg-obfuscator.log log-timestamps = AUTO


When a log file is set, the log goes **only** to the file, and every line gets a timestamp:

2025-08-16 04:05:12.345 [main][I] Starting WireGuard Obfuscator v1.5 2025-08-16 04:05:12.346 [main][I] Listening on port 0.0.0.0:13255 for source 2025-08-16 04:05:19.881 [main][I] New client connected: 192.168.1.10:51820

…

/var/log/wg-obfuscator.log { weekly rotate 8 compress missingok notifempty postrotate systemctl reload wg-obfuscator 2>/dev/null || killall -HUP wg-obfuscator 2>/dev/null || true endscript }

…

sh make sudo make install


This will install the obfuscator as a systemd service.  
You can start it with:
```sh
sudo systemctl start wg-obfuscator

The configuration file is located at:
/etc/wg-obfuscator.conf

Third-party packages

ALT Linux apt-rpm package in Sisyphus

Windows

You can download ready-to-run binaries with all required DLL libraries.

If you want to build this tool for Windows from the source code, you need MSYS2 and the following packages:

base-devel
gcc
git

Install the required packages, then run:

make

Note: On Windows, the obfuscator is only available as a command-line application. You need to run it from the terminal and manage startup yourself, so it's required to use some additional tools if you want to install it as a system service.

macOS

You can download ready-to-run binaries for both x64 and ARM versions of macOS.

To build Obfuscator from the source code just type:

make

…

yaml
version: '3.8'

services:
  wg-obfuscator:
    image: clustermeerkat/wg-obfuscator:latest
    volumes:
      - ./.wg-obfuscator.conf:/etc/wg-obfuscator/wg-obfuscator.conf
    ports:
      - "13255:13255/udp"
    container_name: wg-obfuscator-container
    restart: unless-stopped

image can be changed to use a specific tag (e.g., clustermeerkat/wg-obfuscator:1.1).
Place your config as .wg-obfuscator.conf in the same directory as docker-compose.yml, or adjust the volume path.
Port mapping (13255:13255/udp) must correspond to your obfuscator’s listen port.

Running manually

You can also run the container directly:

docker run -d \
  --name wg-obfuscator \
  -v $PWD/.wg-obfuscator.conf:/etc/wg-obfuscator/wg-obfuscator.conf \
  -p 13255:13255/udp \
  clustermeerkat/wg-obfuscator:latest

WireGuard Obfuscator Easy

If you need a full WireGuard server with obfuscation and a web management interface rather than the standalone obfuscator, use [WireGuard Obfuscator Easy](https:/

Issues· 0 open

View all issues Open on GitHub

No open issues yet, or sync has not completed.

> Tags

Cdpi-bypassdpi-bypassingobfuscationwireguard

wg-obfuscator

About

WireGuard Obfuscator

Feature overview

Basic Concept

Instance name

You can specify multiple instances

Third-party packages

Windows

macOS

Running manually

WireGuard Obfuscator Easy

Issues· 0 open

> Tags

> Details

> Related tools

wg-obfuscator

About

WireGuard Obfuscator

Feature overview

Basic Concept

Instance name

You can specify multiple instances

Third-party packages

Windows

macOS

Running manually

WireGuard Obfuscator Easy

Issues· 0 open

> Tags

> Discussion

> Details

> Related tools