{"eid":"github-erebe","name":"wstunnel demo","domain":"github.com","resolved_by":"platform","topics":["egress"],"n_records":2,"best_vorder":2,"review":null,"aliases":["github.com","wstunnel","wstunnel demo","wstunnel demo relay"],"records":[{"rid":"egress/wstunnel-demo","card":{"rid":"egress/wstunnel-demo","eid":"github-erebe","topic":"egress","slug":"wstunnel-demo","provider":"wstunnel demo relay","url":"https://github.com/erebe/wstunnel","domain":"github.com","category":"udp port forward (demo relay, open-source client)","tier":"free","verdict":"trial-only","vorder":2,"grp":"trial","confidence":"unverified","binding":"write-gated","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-06","n_evidence":2,"usd_month":null,"usd_per_tb_month":0.0,"summary":"You can give it a try with wstunnel demo server","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"wstunnel-demo","provider":"wstunnel demo relay","url":"https://github.com/erebe/wstunnel","category":"udp port forward (demo relay, open-source client)","tier":"free","free_tier":{"stated":"You can give it a try with wstunnel demo server","unit":"none","metered_on":"unstated","source_url":"https://github.com/erebe/wstunnel","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://github.com/erebe/wstunnel","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://github.com/erebe/wstunnel","notes":""},"egress":{"terms":"no allowance published for the demo relay; it is described as a way to check that you can bypass a proxy, not as a service; ingress: udp","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://github.com/erebe/wstunnel"},"interface":["cli"],"interface_detail":"wstunnel client -R 'udp://PORT:HOST:PORT' -P demo wss://ws.erebe.dev","tooling":"wstunnel static binary","chaining":"wstunnel -R udp://51820 on any free VM, or the demo relay if it permits the binding; this is the shape that composes with a free compute lane","limits":[{"kind":"write-gated","value":"the demo server allowlists one tunnel: 'The tunnel is the only one that is going to be allowed.'","source":"https://github.com/erebe/wstunnel"}],"limits_note":"","binding":"write-gated","binding_note":"The demo relay's allowlist is the first thing that fails, before any byte count: the documented example is a single fixed TCP forward, so a reverse UDP binding is not established to be permitted at all.","identity_cost":{"kind":"anonymous","detail":"the demo takes a shared password: '-P demo' with wss://ws.erebe.dev, no account","country":"None"},"reliability_note":"a shared demo endpoint with no stated capacity; the operator can withdraw it without notice","confidence":"unverified","confidence_note":"Unverified because the demo's UDP permission was not tested and its capacity is unpublished. What would settle it: run wstunnel client -R 'udp://51820:127.0.0.1:51820' -P demo wss://ws.erebe.dev, send a WireGuard handshake to the reported port, and read wg show.","evidence":[{"url":"https://github.com/erebe/wstunnel","date":"2026-10-23","proved":"the demo server, the -P demo shared password, the allowlist sentence, and the -R udp:// reverse UDP form in the client usage block"},{"url":"https://github.com/erebe/wstunnel","date":"2026-10-23","proved":"repository metadata: 'Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI', public, not archived"}],"verdict":"trial-only","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"The client is genuinely capable of a reverse UDP port and is the standard tool for carrying WireGuard over TCP 443. The free part is the demo relay, which is explicitly a courtesy.","extras":{"wg_path":"inside-udp","wg_detail":"the client carries raw UDP both ways and reverse mode binds a port on the server: 'udp://1212:1.1.1.1:53 => listen on server for incoming udp on port 1212 and forward to cloudflare dns 1.1.1.1 on port 53 from local machine'. Whether the shared demo relay at wss://ws.erebe.dev permits a reverse UDP binding is not documented.","ingress":"udp","volume_tib_month":null,"volume_stated":"no allowance published for the demo relay; it is described as a way to check that you can bypass a proxy, not as a service","bytes_transit":"yes","transit_note":"the wstunnel server unwraps the websocket and emits the datagrams"}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:write-gated","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0.0,"unit":"TB","per":"month","currency":"USD","usd":0.0,"fx_date":null,"parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]},{"rid":"egress/wstunnel","card":{"rid":"egress/wstunnel","eid":"github-erebe","topic":"egress","slug":"wstunnel","provider":"wstunnel","url":"https://github.com/erebe/wstunnel","domain":"github.com","category":"tool (wireguard transport)","tier":"free","verdict":"paid-only","vorder":3,"grp":"paid","confidence":"documented","binding":"none","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":3,"usd_month":null,"usd_per_tb_month":0.0,"summary":"no service and no account; the software is a static binary released under an open licence","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"wstunnel","provider":"wstunnel","url":"https://github.com/erebe/wstunnel","category":"tool (wireguard transport)","tier":"free","free_tier":{"stated":"no service and no account; the software is a static binary released under an open licence","unit":"none","metered_on":"none","source_url":"https://github.com/erebe/wstunnel","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://github.com/erebe/wstunnel","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://github.com/erebe/wstunnel","notes":""},"egress":{"terms":"not applicable; the software states no volume, and the tunnel's ceiling is whatever the host and the network in between allow; ingress: tcp","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://github.com/erebe/wstunnel"},"interface":["cli"],"interface_detail":"wstunnel client / wstunnel server subcommands","tooling":"static binary per platform; a systemd unit is the documented server form","chaining":"a websocket upgrade passes through any TCP or HTTP forwarder that does not buffer, so a free HTTP-only hosted tunnel plus a wstunnel server converts a TCP-only path into a WireGuard path; the wstunnel server still has to run somewhere the client controls.","limits":[],"limits_note":"","binding":"none","binding_note":"the constraint that decides this tool is outside the seven-kind vocabulary: a host with a public address at the far end, which the corpus treats as a paid resource rather than a free one","identity_cost":{"kind":"anonymous","detail":"no account; the client dials a wstunnel server the client or somebody else runs","country":"None"},"reliability_note":"the udp tunnel auto-closes after 30 s idle unless timeout_sec=0; the client sends websocket pings every 30 s by default; MTU must drop to about 1300 or packets fragment","confidence":"documented","confidence_note":"measured throughput on a named path would raise it; the README carries only a benchmark image with no numbers in text","evidence":[{"url":"https://github.com/erebe/wstunnel","date":"2026-10-23","proved":"the WireGuard recipe, the udp:// forward with timeout_sec, and the server --restrict-to flag"},{"url":"https://github.com/erebe/wstunnel","date":"2026-10-23","proved":"release v11.1.0 published 2026-10-19, 7122 stars, last push 2026-10-19"},{"url":"https://raw.githubusercontent.com/erebe/wstunnel/master/README.md","date":"2026-10-23","proved":"\"If you see some throughput issue, be sure to lower the MTU of your wireguard interface ... to something like 1300 or you will endup fragmenting udp packet (due to overhead of other layer)\""}],"verdict":"paid-only","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"The most maintained wrapper. It is not a WireGuard implementation: it forwards udp:// flows over a websocket or HTTP/2 connection, so the far end needs a wstunnel server. The README states HTTP/2 fails behind a buffering reverse proxy or CDN and that only a directly exposed server works, which makes websocket the usable transport behind a CDN.","extras":{"wg_path":"none","wg_detail":"the README ships a WireGuard recipe: server 'wstunnel server --restrict-to localhost:51820 wss://[::]:443' and client \"wstunnel client -L 'udp://51820:localhost:51820?timeout_sec=0' wss://my.server.com:443\", with the WireGuard peer Endpoint changed to localhost:51820","ingress":"tcp","volume_tib_month":null,"volume_stated":"not applicable; the software states no volume, and the tunnel's ceiling is whatever the host and the network in between allow","bytes_transit":"yes","transit_note":"the bytes cross the wstunnel server, then any CDN or forwarder in front of it","hosting_requirement":"a host with a public address running wstunnel server; the client half runs on the device","last_release":"v11.1.0 2026-10-19","stars":7122}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0.0,"unit":"TB","per":"month","currency":"USD","usd":0.0,"fx_date":null,"parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}]}