Skip to content

WireGuard: Implement UDP FullCone NAT#5833

Merged
RPRX merged 9 commits intoXTLS:mainfrom
LjhAUMEM:wg-fc
Mar 22, 2026
Merged

WireGuard: Implement UDP FullCone NAT#5833
RPRX merged 9 commits intoXTLS:mainfrom
LjhAUMEM:wg-fc

Conversation

@LjhAUMEM
Copy link
Copy Markdown
Contributor

  • 修复 wireguard full cone
  • 配置解析使用 std (修复 ./xray wg 无法使用问题)

close #5601

测试配置

{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1080,
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "wireguard",
      "settings": {
        "secretKey": "YKjJrIBGR3QjDvhXSIK4ndxiyDgNOzTJOu8teRxHQGU=",
        "peers": [
          {
            "endpoint": "",
            "publicKey": "ZaUsMjS5OeCRHLMAtp3rMDBVRYur622DRL71Bx9kjno="
          }
        ],
        "noKernelTun": true,
        "domainStrategy": "ForceIPv4"
      }
    }
  ]
}
{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      // "listen": "127.0.0.1",
      "port": 1081,
      "protocol": "wireguard",
      "settings": {
        "secretKey": "uJX4Xm3JmWzYpqIZFiKP+JlDXUpD39eqHJ1Bsn5R5nc=",
        "peers": [
          {
            "publicKey": "Eq5K/cMuaVF7NucLpSqzxOQ+/iMFj1ZU2PpeJAscvic="
          }
        ],
        "noKernelTun": true,
        "domainStrategy": "ForceIP"
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

@RPRX
Copy link
Copy Markdown
Member

RPRX commented Mar 22, 2026

Ready 时说一声,不急的话放后面的版本也行

@LjhAUMEM
Copy link
Copy Markdown
Contributor Author

ready 了,我测试下来没啥问题

刚刚在纠结那个 localaddr,不手动创建 endpoint 好像没有这个信息,那造个假的吧,反正也用不上

@RPRX
Copy link
Copy Markdown
Member

RPRX commented Mar 22, 2026

话说这个能不能和 tun 共用一下代码

@LjhAUMEM
Copy link
Copy Markdown
Contributor Author

writeRawUDPPacket 导出应该能共用一下,其他的不好动,真正共用还是等全部重构了 wireguard 再说吧,这两目前创建的 tun 用途不太一样

@LjhAUMEM
Copy link
Copy Markdown
Contributor Author

哦对还有 udpConnectionHandler 和 udpConn,不过如果要动的话那也是换成我写的版本,hy 的 udp 入站逻辑也是类似的

@RPRX
Copy link
Copy Markdown
Member

RPRX commented Mar 22, 2026

@LjhAUMEM 说起来忘拉你进组织了,已邀请

@RPRX
Copy link
Copy Markdown
Member

RPRX commented Mar 22, 2026

配置解析使用 std (修复 ./xray wg 无法使用问题)

我看了下它的配置解析本来是像 WS 0-RTT 支持任意格式的,你这改成了只支持 std,且会 break 现有非 std 的配置文件

@RPRX
Copy link
Copy Markdown
Member

RPRX commented Mar 22, 2026

影响 ./xray wg 无法使用的只是 %2 那个判断,因为 base64 std 加了 = 的 padding 后 x25519 公私钥长度均为 34 字节

@RPRX RPRX changed the title wireguard fullcone WireGuard: Implement UDP FullCone NAT Mar 22, 2026
@RPRX RPRX merged commit 67a71ad into XTLS:main Mar 22, 2026
39 checks passed
@RPRX
Copy link
Copy Markdown
Member

RPRX commented Mar 22, 2026

@LjhAUMEM 测一下 #5554 #5555

@LjhAUMEM
Copy link
Copy Markdown
Contributor Author

#5554 确实有效 (虽然还没细看是怎么修复成功的),我在本地加入了 5554 的修改,测试成功,下面是测试配置,在未加入修改前是失败

client

{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1080,
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "wireguard",
      "settings": {
        "secretKey": "YKjJrIBGR3QjDvhXSIK4ndxiyDgNOzTJOu8teRxHQGU=",
        "peers": [
          {
            "endpoint": "127.0.0.1:1081",
            "publicKey": "ZaUsMjS5OeCRHLMAtp3rMDBVRYur622DRL71Bx9kjno=",
            "allowedIPs": ["65.108.151.63/32"]
          },
          {
            "endpoint": "127.0.0.1:1082",
            "publicKey": "sZ8uL19fcFIkymT4EpGCEV+eupreuMibTtL7UY+1lBg=",
            "allowedIPs": ["2a01:4f9:c012:8091::1/128"]
          }
        ],
        "noKernelTun": true,
        "domainStrategy": "ForceIPv4"
      }
    }
  ]
}

server

{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1081,
      "protocol": "wireguard",
      "settings": {
        "secretKey": "uJX4Xm3JmWzYpqIZFiKP+JlDXUpD39eqHJ1Bsn5R5nc=",
        "peers": [
          {
            "publicKey": "Eq5K/cMuaVF7NucLpSqzxOQ+/iMFj1ZU2PpeJAscvic="
          }
        ],
        "noKernelTun": true,
        "domainStrategy": "ForceIP"
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

server2

{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1082,
      "protocol": "wireguard",
      "settings": {
        "secretKey": "SAN0qVVGxYONUCdJVPnA6gb0bFlmD9o35QA2Cvc2/VI=",
        "peers": [
          {
            "publicKey": "Eq5K/cMuaVF7NucLpSqzxOQ+/iMFj1ZU2PpeJAscvic="
          }
        ],
        "noKernelTun": true,
        "domainStrategy": "ForceIP"
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

test cmd

curl https://ident.me --connect-to ::65.108.151.63:443 -x socks5://127.0.0.1:1080
curl https://ident.me --connect-to ::[2a01:4f9:c012:8091::1]:443 -x socks5://127.0.0.1:1080

#5555 还不清楚预期行为是啥,不急的话我晚点再看

@RPRX
Copy link
Copy Markdown
Member

RPRX commented Mar 23, 2026

应该就是 #5554 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

关于使用WireGuard协议Nat类型为Nat3即PortRestrictedCone Nat的问题

2 participants