wstunnel demo

github.com · Egress and tunnels · 2 records · JSON

wstunnel demo relay Egress and tunnelstrialanonymousno cardUwrite-gated
wstunnel Egress and tunnelspaidanonymousno cardD

wstunnel demo relay Egress and tunnels

trialanonymousno cardUwrite-gated

github.com/erebe/wstunnel · udp port forward (demo relay, open-source client) · egress/wstunnel-demo · JSON · compare

Free tier	You can give it a try with wstunnel demo server unit none; metered on unstated
Price	USD 0
Per-object cap	not applicable
Retention	not applicable
Egress	no allowance published for the demo relay; it is described as a way to check that you can bypass a proxy, not as a service; ingress: udp free_allowance: none published
Identity	anonymous the demo takes a shared password: '-P demo' with wss://ws.erebe.dev, no account
Limits	write-gated the demo server allowlists one tunnel: 'The tunnel is the only one that is going to be allowed.' source
Binding	write-gated The demo relay's allowlist is the first thing that fails, before any byte count: the documented example is a single fixed TCP forward, so a reverse UDP binding is not established to be permitted at all.
Interface	cli wstunnel client -R 'udp://PORT:HOST:PORT' -P demo wss://ws.erebe.dev
Tooling	wstunnel static binary
Composes with	wstunnel -R udp://51820 on any free VM, or the demo relay if it permits the binding; this is the shape that composes with a free compute lane
Reliability	a shared demo endpoint with no stated capacity; the operator can withdraw it without notice
Notes	The client is genuinely capable of a reverse UDP port and is the standard tool for carrying WireGuard over TCP 443. The free part is the demo relay, which is explicitly a courtesy.
Evidence rung	unverified Unverified because the demo's UDP permission was not tested and its capacity is unpublished. What would settle it: run wstunnel client -R 'udp://51820:127.0.0.1:51820' -P demo wss://ws.erebe.dev, send a WireGuard handshake to the reported port, and read wg show.
Checked	2026-10-23 (live); stale on 2026-11-06
Parsed numbers	`$.price_per_tb_month` price-per-tb USD0.0 TB / month

Evidence (2)

date	source	what it proved
2026-10-23	github.com/erebe/wstunnel	the demo server, the -P demo shared password, the allowlist sentence, and the -R udp:// reverse UDP form in the client usage block
2026-10-23	github.com/erebe/wstunnel	repository metadata: 'Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI', public, not archived

More fields (7)

{
 "wg_path": "inside-udp",
 "wg_detail": "the client carries raw UDP both ways and reverse mode binds a port on the server: 'udp://1212:1.1.1.1:53 => listen on server for incoming udp on port 1212 and forward to cloudflare dns 1.1.1.1 on port 53 from local machine'. Whether the shared demo relay at wss://ws.erebe.dev permits a reverse UDP binding is not documented.",
 "ingress": "udp",
 "volume_tib_month": null,
 "volume_stated": "no allowance published for the demo relay; it is described as a way to check that you can bypass a proxy, not as a service",
 "bytes_transit": "yes",
 "transit_note": "the wstunnel server unwraps the websocket and emits the datagrams"
}

Unknown or withheld values (2)

$.per_object_cap.stated not-applicable
$.retention.stated not-applicable

wstunnel Egress and tunnels

paidanonymousno cardD

github.com/erebe/wstunnel · tool (wireguard transport) · egress/wstunnel · JSON · compare

Free tier	no service and no account; the software is a static binary released under an open licence unit none; metered on none
Price	USD 0
Per-object cap	not applicable
Retention	not applicable
Egress	not applicable; the software states no volume, and the tunnel's ceiling is whatever the host and the network in between allow; ingress: tcp free_allowance: none published
Identity	anonymous no account; the client dials a wstunnel server the client or somebody else runs
Binding	none the constraint that decides this tool is outside the seven-kind vocabulary: a host with a public address at the far end, which the corpus treats as a paid resource rather than a free one
Interface	cli wstunnel client / wstunnel server subcommands
Tooling	static binary per platform; a systemd unit is the documented server form
Composes with	a websocket upgrade passes through any TCP or HTTP forwarder that does not buffer, so a free HTTP-only hosted tunnel plus a wstunnel server converts a TCP-only path into a WireGuard path; the wstunnel server still has to run somewhere the client controls.
Reliability	the udp tunnel auto-closes after 30 s idle unless timeout_sec=0; the client sends websocket pings every 30 s by default; MTU must drop to about 1300 or packets fragment
Notes	The most maintained wrapper. It is not a WireGuard implementation: it forwards udp:// flows over a websocket or HTTP/2 connection, so the far end needs a wstunnel server. The README states HTTP/2 fails behind a buffering reverse proxy or CDN and that only a directly exposed server works, which makes websocket the usable transport behind a CDN.
Evidence rung	documented measured throughput on a named path would raise it; the README carries only a benchmark image with no numbers in text
Checked	2026-10-23 (live); stale on 2026-11-22
Parsed numbers	`$.price_per_tb_month` price-per-tb USD0.0 TB / month

Evidence (3)

date	source	what it proved
2026-10-23	github.com/erebe/wstunnel	the WireGuard recipe, the udp:// forward with timeout_sec, and the server --restrict-to flag
2026-10-23	github.com/erebe/wstunnel	release v11.1.0 published 2026-10-19, 7122 stars, last push 2026-10-19
2026-10-23	raw.githubusercontent.com/erebe/wstunnel/master/README.md	"If you see some throughput issue, be sure to lower the MTU of your wireguard interface ... to something like 1300 or you will endup fragmenting udp packet (due to overhead of other layer)"

More fields (10)

{
 "wg_path": "none",
 "wg_detail": "the README ships a WireGuard recipe: server 'wstunnel server --restrict-to localhost:51820 wss://[::]:443' and client \"wstunnel client -L 'udp://51820:localhost:51820?timeout_sec=0' wss://my.server.com:443\", with the WireGuard peer Endpoint changed to localhost:51820",
 "ingress": "tcp",
 "volume_tib_month": null,
 "volume_stated": "not applicable; the software states no volume, and the tunnel's ceiling is whatever the host and the network in between allow",
 "bytes_transit": "yes",
 "transit_note": "the bytes cross the wstunnel server, then any CDN or forwarder in front of it",
 "hosting_requirement": "a host with a public address running wstunnel server; the client half runs on the device",
 "last_release": "v11.1.0 2026-10-19",
 "stars": 7122
}

Unknown or withheld values (2)

$.per_object_cap.stated not-applicable
$.retention.stated not-applicable