wstunnel demo
github.com · 2 records in Egress and tunnels · JSON
Records 2
- trialwstunnel demo relay
Egress and tunnelsidentity anonymousno cardlimit write-gatedevidence unverifiedstale on 2026-11-19
- self-hosted, last resortwstunnel
Egress and tunnelsverdict paid-onlyidentity anonymousno cardevidence documentedstale on 2026-11-23
wstunnel demo relay
Egress and tunnels- Free allowance
- You can give it a try with wstunnel demo server
- Verdict
- triala time-boxed or one-time trial, not a recurring allowance
- Cost
- not statedsee Price below
- Identity
- anonymousno card, no phone
- Binding limit
- write-gatedthe demo server allowlists one tunnel: 'The tunnel is the only one that is going to be allowed.'
- Evidence
- unverified7 sources; asserted and not checked
- Freshness
- stale on 2026-11-19checked 2026-11-04 (live); stale on 2026-11-19
| Free tier | You can give it a try with wstunnel demo server unit none; metered on unstated |
|---|---|
| Price | USD 0 |
| Limits |
|
| Binding | write-gated The demo relay's allowlist is the first thing that fails, before any byte count: the documented example is a single fixed TCP forward, so a reverse UDP binding is not established to be permitted at all. |
| Identity | anonymous the demo takes a shared password: '-P demo' with wss://ws.erebe.dev, no account |
| Egress | no allowance published for the demo relay; it is described as a way to check that you can bypass a proxy, not as a service; ingress: udp free allowance: none published |
| Interface | cli Documented demo example: wstunnel client -L 'tcp://4443:10.43.0.11:443' -P demo --tls-sni-override=google.fr wss://ws.erebe.dev. Reverse UDP form (client usage, not shown with the demo): -R 'udp://1212:1.1.1.1:53'. |
| Tooling | wstunnel static binary |
| Composes with | wstunnel -R udp://51820 on any free VM, or the demo relay if it permits the binding; this is the shape that composes with a free compute lane |
| Reliability | a shared demo endpoint with no stated capacity; the operator can withdraw it without notice |
| Notes | The wstunnel client is genuinely capable of a reverse UDP port and is the standard tool for carrying WireGuard over TCP 443. The free part is the demo relay, which is explicitly a courtesy. A self-run wstunnel server removes the courtesy limit but needs a VM of the user's own, so it is the last resort. |
| Evidence note | unverified Unverified because the demo's UDP permission was not tested and its capacity is unpublished. |
| Parsed numbers |
|
Evidence 7
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | github.com/erebe/wstunnel | the demo server, the -P demo shared password, the allowlist sentence, and the -R udp:// reverse UDP form in the client usage block |
| 2026-10-23 | github.com/erebe/wstunnel | repository metadata: 'Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI', public, not archived |
| 2026-11-03 | github.com/erebe/wstunnel | the README's demo example is a local-to-remote TCP forward with the shared password demo |
| 2026-11-03 | github.com/erebe/wstunnel | the README offers a demo server for trying the tunnel |
| 2026-11-03 | github.com/erebe/wstunnel | the README's demo example says the one tunnel is the only one allowed |
| 2026-11-04 | github.com/erebe/wstunnel | the README says the demo relay allows only the one documented tunnel |
| 2026-11-04 | probe: ws.erebe.dev | the demo host completes a TLS 1.3 handshake on 2026-11-04 presenting a self-signed certificate |
More fields 6
| wg path | inside-udp |
|---|---|
| wg detail | the client carries raw UDP both ways and reverse mode binds a port on the server: 'udp://1212:1.1.1.1:53 => listen on server for incoming udp on port 1212 and forward to cloudflare dns 1.1.1.1 on port 53 from local machine'. Whether the shared demo relay at wss://ws.erebe.dev permits a reverse UDP binding is not documented. |
| ingress | udp |
| volume stated | no allowance published for the demo relay; it is described as a way to check that you can bypass a proxy, not as a service |
| bytes transit | yes |
| transit note | the wstunnel server unwraps the websocket and emits the datagrams |
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer
wstunnel
Egress and tunnels- Free allowance
- No service and no account; the software is a static binary released under an open licence
- Verdict
- self-hosted, last resortverdict paid-only: no free allowance; listed for its price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- no price statedsee Price below
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented3 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | no service and no account; the software is a static binary released under an open licence unit none; metered on none |
|---|---|
| Price | USD 0 |
| Identity | anonymous no account; the client dials a wstunnel server a user or somebody else runs |
| Egress | not applicable; the software states no volume, and the tunnel's ceiling is whatever the host and the network in between allow; ingress: tcp free allowance: none published |
| Interface | cli wstunnel client / wstunnel server subcommands |
| Tooling | static binary per platform; a systemd unit is the documented server form |
| Composes with | a websocket upgrade passes through any TCP or HTTP forwarder that does not buffer, so a free HTTP-only hosted tunnel plus a wstunnel server converts a TCP-only path into a WireGuard path; the wstunnel server still has to run somewhere a user controls. |
| Reliability | the udp tunnel auto-closes after 30 s idle unless timeout_sec=0; the client sends websocket pings every 30 s by default; MTU must drop to about 1300 or packets fragment |
| Notes | The most maintained wrapper. It is not a WireGuard implementation: it forwards udp:// flows over a websocket or HTTP/2 connection, so the far end needs a wstunnel server. The README states HTTP/2 fails behind a buffering reverse proxy or CDN and that only a directly exposed server works, which makes websocket the usable transport behind a CDN. |
| Evidence note | documented measured throughput on a named path would raise it; the README carries only a benchmark image with no numbers in text |
| Parsed numbers |
|
Evidence 3
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | github.com/erebe/wstunnel | the WireGuard recipe, the udp:// forward with timeout_sec, and the server --restrict-to flag |
| 2026-10-23 | github.com/erebe/wstunnel | release v11.1.0 published 2026-10-19, 7122 stars, last push 2026-10-19 |
| 2026-10-23 | raw.githubusercontent.com/erebe/wstunnel/master/README.md | "If you see some throughput issue, be sure to lower the MTU of your wireguard interface ... to something like 1300 or you will endup fragmenting udp packet (due to overhead of other layer)" |
More fields 9
| wg path | none |
|---|---|
| wg detail | the README ships a WireGuard recipe: server 'wstunnel server --restrict-to localhost:51820 wss://[::]:443' and client "wstunnel client -L 'udp://51820:localhost:51820?timeout_sec=0' wss://my.server.com:443", with the WireGuard peer Endpoint changed to localhost:51820 |
| ingress | tcp |
| volume stated | not applicable; the software states no volume, and the tunnel's ceiling is whatever the host and the network in between allow |
| bytes transit | yes |
| transit note | the bytes cross the wstunnel server, then any CDN or forwarder in front of it |
| hosting requirement | a host with a public address running wstunnel server; a user half runs on the device |
| last release | v11.1.0 2026-10-19 |
| stars | 7122 |
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer