Wiretap is a transparent, VPN-like proxy server that tunnels network traffic via WireGuard without requiring special privileges to run.
Wiretap is a transparent, VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.
Wiretap enables users to securely route traffic through a WireGuard-based proxy server, allowing clients to access remote network resources as if they were on the same local network. It is ideal for network administrators and security professionals who need to create flexible, multi-hop VPN-like connections without complex privilege requirements or infrastructure changes.
Wiretap requires privileged access on the Client to configure WireGuard interfaces, typically needing root or admin rights. The Server must allow bidirectional UDP communication on a single port, with the default behavior having the Server initiate the handshake. While UDP is preferred, TCP tunneling is available experimentally but not recommended for production. Proper firewall configuration is essential to ensure connectivity. The tool supports chaining multiple servers to extend network reach and dynamic network reconfiguration by Clients.
Download Wiretap binaries from the GitHub releases page for your Client and Server OS/architecture.
Copy the Wiretap binary onto the Server machine.
Ensure WireGuard is installed on the Client machine.
Verify the Client has privileged access to configure WireGuard interfaces (usually root/admin).
Run Wiretap commands on Client and Server as needed../wiretap configure --endpoint <IP>:<port> --routes <CIDRs>
Configure the Client with the Server endpoint and routing CIDRs.
./wiretap serve
Run the Wiretap Server to receive and relay network traffic.
./wiretap status
Check the current status of the Wiretap network and connections.
./wiretap add-server
Add an additional Wiretap Server to the network (optional).
./wiretap add-client
Add a new Client to the Wiretap network (optional).
./wiretap expose <port>
Set up port forwarding to expose services through the Wiretap network.
./wiretap expose list
List active port forwarding rules.
./wiretap expose remove <port>
Remove a port forwarding rule.