udp-over-tcp (mullvad)

Free allowance: No service and no account; a Rust library with two binaries, udp2tcp and tcp2udp
Verdict: self-hosted, last resortverdict paid-only: no free allowance; listed for its price. Self-hosted options are listed last, because this site is for users who have no hardware.
Cost: no price statedsee Price below
Identity: anonymousno card, no phone
Binding limit: noneno named constraint binds
Evidence: documented4 sources; a first-party page was read and the sentence quoted
Freshness: stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23

Free tier	no service and no account; a Rust library with two binaries, udp2tcp and tcp2udp unit none; metered on none
Price	USD 0
Binding	none the constraint is the server half, which is why Mullvad itself can offer the feature and a client cannot get it for free
Identity	anonymous no account
Egress	not applicable; the software states no volume; ingress: tcp free allowance: none published
Interface	cli udp2tcp and tcp2udp binaries, or the Rust crate
Tooling	cargo; two binaries, embeddable as a library
Composes with	composes with a server host; the Mullvad deployment of it is a paid provider feature recorded elsewhere.
Reliability	one udp2tcp instance handles one peer only; the server spawns a UDP socket per TCP connection
Notes	Included because it is the production-grade reference for the technique and the ancestor proxyguard names. Its existence also explains why the wrapper question is a hosting question: Mullvad can offer WireGuard over TCP because it owns the server half. A library alone cannot give the same thing without a server to run it. The 16-bit length prefix caps a datagram at 65535 bytes, which is not a real constraint for WireGuard's MTU.
Evidence note	documented its behaviour inside the Mullvad app is not testable without a subscription; the library's own protocol is documented
Parsed numbers	has-free-tier 0 price USD 0

Evidence 4

date	source	what it proved
2026-10-23	github.com/mullvad/udp-over-tcp	"A library (and binaries) for tunneling UDP datagrams over a TCP stream"; tcp2udp example forwarding 10.0.0.0:5001/TCP to 127.0.0.1:51820/UDP
2026-10-23	github.com/mullvad/udp-over-tcp	the wire format: "Each datagram is preceded with a 16 bit unsigned integer in big endian byte order"
2026-10-23	github.com/mullvad/udp-over-tcp	588 stars, no GitHub releases, last push 2026-08-17
2026-10-23	mullvad.net/en/blog/introducing-wireguard-over-tcp-and-ipv6	Mullvad deploys WireGuard over TCP on its own servers and switches to it with 'mullvad relay set tunnel wireguard --protocol tcp'

More fields 9

wg path	none
wg detail	tcp2udp runs on the server and forwards to 127.0.0.1:51820; udp2tcp runs on a user beside the WireGuard interface
ingress	tcp
volume stated	not applicable; the software states no volume
bytes transit	yes
transit note	through the tcp2udp server, which owns the UDP socket to WireGuard
hosting requirement	a server host running tcp2udp; the client binary goes beside the WireGuard interface
last release	no GitHub releases; last push 2026-08-17
stars	588

Unknown values 2