Ansible Playbook to install (dual stack) TunSafe VPN: WireGuard with obfuscation
Ansible Playbook I wrote to setup a dual stack* (IPv4/IPv6) TunSafe VPN with obfuscation.
TunSafe is a fast and modern VPN based on the WireGuard protocol. It is a point-to-point VPN, which means it does not have a client-server architecture, but peers, and does not rely on a PKI, unlike OpenVPN.
Please note that TunSafe is not affiliated with the WireGuard project. No support from the WireGuard project will be available and no statements about security from the official WireGuard project apply to tunsafe, nor will it receive (security) updates from WireGuard's upstream. TunSafe is developed by Ludvig "Ludde" Strigeus, best known for developing software such as the BitTorrent client μTorrent, OpenTTD, and Spotify.
*The playbook will try to detect if IPv6 connectivity is available and if so enable it for use with TunSafe. Peers/clients will connect via IPv4.
Why TunSafe?
The WireGuard protocol is encrypted but not obfuscated. If you're behind a (corporate) firewall that does Deep Packet Inspection (DPI), the WireGuard protocol is very easy to detect and block. The Wireguard Project states that 'obfuscation should happen at a layer above WireGuard' but does not offer any examples/solutions to do so.
TunSafe has incorporated obfuscation in it's latest Release Candidate. The default setting is to just make everything look totally random. It can also be set to tls-chrome or tls-firefox to make the traffic look like HTTPS traffic..
Additionally, TunSafe supports two-factor authentication out of the box.
Comments
Tunsafe looks like the rabbithole I need to run down. Thanks
Edit: Spoke too soon. It's a windows app. ??♂️
Edit2: ooh https://tunsafe.com/user-guide/linux
Nice, thanks. Is this likely to be able to run on a 256 MB VPS? Wireguard Go is running on one I have currently with no apparent problems.
Yes, should run just fine on 256MB and might even run on 128MB for just one client.
TunSafe is most likely abandoned, I'd suggest against setting up anything new based on that.
OpenVPN installer | WireGuard installer
TunSafe hasn’t been updated in over a year, but that doesn’t mean it’s obsolete. Looking at the open issues at their git repo, there are no blocking issues,nor could I find any known security vulnerabilities. Note that this does not imply that TunSafe is inherently secure, as, to my knowledge, TunSafe hasn't undergone any third party audit (yet).
If you’re looking for WireGuard with obfuscation (and perhaps 2FA), TunSafe currently is your best bet. If that’s not your use case, i.e. obfuscation and/or 2FA is not required, I recommend sticking with WireGuard
I've only used TunSafe in Windows and it was buggy, I never said obsolete but it is abandoned, which means that it will become obsolete if nothing changes.
If I were to use obfuscation for WireGuard I'd use one of the dedicated traffic obfuscation projects and route WireGuard over it. Of course TunSafe is a viable alternative if you want something simpler for the time being.
It is a shame that TunSafe hasn't seen more development as it was a project with enormous potential.
OpenVPN installer | WireGuard installer
That would be my preferred way as well, but I haven't been able to figure out how to do so. Do you perhaps know how to achieve this for example with Obfsproxy? Thanks!
I don't have experience with it but the first issue would probably be to carry WireGuard over TCP to begin with. WireGuard (like OpenVPN) isn't really designed for evading active censorship.
OpenVPN installer | WireGuard installer
SSF?
https://blog.rraghur.in/2018/11/24/using-wireguard-when-udp-is-blocked/
https://securesocketfunneling.github.io/ssf/#home