TCP Proxy

Summary

Add a TCP proxy for last-mile connectivity in restrictive networks where only outbound TCP/443 is allowed. Users can establish TCP tunnels that encapsulate WireGuard UDP traffic (with SSL/TLS support) so peers remain reachable behind firewalls, captive portals, and locked-down corporate/guest networks.

Goals

• Keep Netmaker/WireGuard connectivity working when UDP is blocked and only TCP/443 is permitted
• Encapsulate WireGuard UDP inside TCP (and optionally TLS/SSL on 443) for restrictive last-mile paths
• Make setup straightforward for users operating in locked-down environments (hotels, airports, enterprise egress filters)
• Preserve WireGuard security properties while adapting transport for constrained networks
• Prefer 443 to blend with normal HTTPS egress where deep packet inspection or port allowlists apply

Scope (initial)

• TCP tunnel mode that wraps WireGuard UDP for last-mile / restricted egress
• SSL/TLS support for tunnels terminating on TCP/443
• Client and server/gateway configuration to enable TCP encapsulaton when UDP fails or is disallowed
• Clear operator docs for restrictive-network setups and failover (UDP preferred, TCP fallback)

Success criteria

• A client on a network that allows only outbound TCP/443 can join and stay connected to a Netmaker network
• WireGuard traffic is successfully encapsulated over TCP (with TLS/SSL when enabled)
• Admins/users can enable and verify TCP tunnel mode without custom external tooling