el3xyz started a thread on the WireGuard mailing list with a patch for per-packet payload obfuscation in WireGuard and is asking for comments.
https://lists.zx2c4.com/pipermail/wireguard/2021-September/007142.html
To make detection more difficult two things are being done
- handshake initiation, response and cookie messages are padded with random sized garbage
- Up to 192 bytes of each message is encrypted with obfuscation key derived from peer public key (different keys are used in different directions).
I posted commands for setting it up that worked for me.
On both peers:
$ sudo apt install build-essential linux-headers-amd64
$ cd
$ git clone https://github.com/el3xyz/wireguard-linux-compat
$ cd wireguard-linux-compat/src
$ make DEV=wireguard_obf
$ sudo make install
$ cd
$ git clone https://github.com/el3xyz/wireguard-tools
$ cd wireguard-tools/src
$ make DEV=wireguard_obf
$ cd
$ (umask 077; ~/wireguard-tools/src/wg genkey > privatekey)
$ ~/wireguard-tools/src/wg pubkey < privatekey > publickey
One one peer:
peera$ sudo ip link add dev wgobf0 type wireguard_obf
peera$ sudo ip address add dev wgobf0 192.168.2.1 peer 192.168.2.2
peera$ sudo ~/wireguard-tools/src/wg set wgobf0 \
listen-port 51820 \
private-key privatekey \
peer [peerb-publickey] \
allowed-ips 0.0.0.0/0 \
endpoint [peerb-ip]:51820
peera$ sudo ip link set up dev wgobf0
On the other peer:
peerb$ sudo ip link add dev wgobf0 type wireguard_obf
peerb$ sudo ip address add dev wgobf0 192.168.2.2 peer 192.168.2.1
peerb$ sudo ~/wireguard-tools/src/wg set wgobf0 \
listen-port 51820 \
private-key privatekey \
peer [peera-publickey] \
allowed-ips 0.0.0.0/0 \
endpoint [peera-ip]:51820
peerb$ sudo ip link set up dev wgobf0
