proxyguard

codeberg.org/eduVPN/proxyguardTool (wireguard transport)egress/proxyguardJSON compare report an error provider JSON

Free allowance: No service and no account; MIT-licensed client and server, packaged in the eduVPN server repository
Verdict: self-hosted, last resortverdict paid-only: no free allowance; listed for its price. Self-hosted options are listed last, because this site is for users who have no hardware.
Cost: no price statedsee Price below
Identity: anonymousno card, no phone
Binding limit: noneno named constraint binds
Evidence: documented4 sources; a first-party page was read and the sentence quoted
Freshness: stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23

Free tier	no service and no account; MIT-licensed client and server, packaged in the eduVPN server repository unit none; metered on none
Price	USD 0
Binding	none the constraint is a server host, mitigated by the fact that it is designed to sit behind a reverse proxy on an existing HTTPS port
Identity	anonymous no account for the tool; the eduVPN ecosystem around it issues accounts separately
Egress	not applicable; the software states no volume; ingress: tcp free allowance: none published
Interface	cli proxyguard-client --to http://host ; proxyguard-server --listen --to
Tooling	make install adds systemd units; DEB and RPM packages in the eduVPN repo
Composes with	rides any HTTPS reverse proxy, so it composes with a host that already serves a website and with a CDN that passes an Upgrade header.
Reliability	client requires TLS 1.3 or newer; on Linux --fwmark may be needed to avoid a routing loop, and that flag needs root or CAP_NET_ADMIN
Notes	The most institutionally-backed wrapper: it ships in eduVPN's server packages and is the WireGuard-over-TCP path their own apps use. The reverse-proxy design is the practical difference from wstunnel: because it speaks HTTP with an Upgrade handshake, it can share port 443 with a normal web server, so it needs a host that already exists rather than a dedicated one. It also names mullvad/udp-over-tcp as its ancestor.
Evidence note	documented a measured run through an nginx or HAProxy front would raise it; eduVPN publishes deployment docs but no throughput figure
Parsed numbers	has-free-tier 0 price USD 0

Evidence 4

date	source	what it proved
2026-10-23	codeberg.org/eduVPN/proxyguard/raw/branch/main/README.md	"proxy UDP connections over HTTP(s). The main use case is to proxy WireGuard packets" and "This proxy thus needs to run for every client and for a server"
2026-10-23	codeberg.org/eduVPN/proxyguard/raw/branch/main/README.md	"This project started with a UDP to TCP approach, but later moved to HTTP for use behind a reverse proxy"
2026-10-23	codeberg.org/eduVPN/proxyguard/releases	release 2.1.1 published 2026-08-26
2026-10-23	codeberg.org/eduVPN/proxyguard/raw/branch/main/README.md	"The goal of this project is NOT to work around intentional state/organizational network blocks/censorship"

More fields 8

wg path	none
wg detail	client listens on 127.0.0.1:51821 and the WireGuard config sets Endpoint = 127.0.0.1:51821; server runs 'proxyguard-server --listen 0.0.0.0:51821 --to 127.0.0.1:51820'
ingress	tcp
volume stated	not applicable; the software states no volume
bytes transit	yes
transit note	through the server half, which forwards to the local WireGuard port
hosting requirement	a server host with an HTTP listener, preferably behind a reverse proxy on 443; a user half runs on the device
last release	2.1.1 2026-08-26

Unknown values 2

per object cap stated: the field does not apply to this kind of offer
retention stated: the field does not apply to this kind of offer