How to run wireguard over tcp with udptunnel?

Question

I'd like to run wireguard over tcp. I wanted to use udptunnel for sending udp packets over tcp. However, when I run wireguard and then try to run udptunnel, the udptunnel fails with the following error: setup_udp_recv: bind: Address already in use.

When I try to run udptunnel first and wireguard second, wireguard fails with the following error: RTNETLINK answers: Address already in use.

Used commands:

wg-quick up wg0
udptunnel -s 443 127.0.0.1/51820

In the wireguard config file (wg0.conf) I use port 51820 (ListenPort = 51820).

When I scan if port 51820 or 443 is used, and neither wireguard or udptunnel is running I get no results.

netstat -tulpn | grep 51820
netstat -tulpn | grep 443

Answer 1

From the manual of udptunnel (http://www.cs.columbia.edu/~lennox/udptunnel/):

In all cases, the UDP address and port to tunnel is given after all options. UDPTunnel will listen to this adddress for packets, and will send received packets on this address.

In other words, the address/port is not only where you push the outgoing wireguard traffics to that gets them encapsulated as TCP traffics, but also the destination address/port of them after they are decapsulated on the other side and the source address/port of the incoming wireguard traffics after they are decapsulated on this side.

Therefore, it will not work well for you if your wireguard server is supposed to serve more than one client, as you'll need a udptunnel instance per client.

On the server, it should listen on the the UDP port that the wireguard client listens on (hence the wireguard client will need to use a fixed port; it doesn't need to be port forwarded if behind NAT though, since it sends/receives traffics with a localhost loopback).

On the client, it should listen on the UDP port that the wireguard server listens on.

On both sides, the address (127.0.0.1) and UDP port used by their own udptunnel instance should be set as Endpoint= under the Peer section for the other side. (It's not strictly necessary for you to set the Endpoint= on the server, but it will allow the server to reach the client via the wireguard tunnel even if the vice versa never occurred after wireguard and udptunnel are up on both sides.)

P.S. Actually now the wireguard setup doesn't really have a client/server model anymore. The model is merely based on the udptunnel setup (or how the wireguard setup was supposed to work without udptunnel).