udp-over-tcp
github.com · Egress and tunnels · 1 record · JSON
udp-over-tcp (mullvad) Egress and tunnels
paidanonymousno cardD
| Free tier | no service and no account; a Rust library with two binaries, udp2tcp and tcp2udp unit none; metered on none |
|---|---|
| Price | USD 0 |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | not applicable; the software states no volume; ingress: tcp free_allowance: none published |
| Identity | anonymous no account |
| Binding | none the constraint is the server half, which is why Mullvad itself can offer the feature and a client cannot get it for free |
| Interface | cli udp2tcp and tcp2udp binaries, or the Rust crate |
| Tooling | cargo; two binaries, embeddable as a library |
| Composes with | composes with a server host; the Mullvad deployment of it is a paid provider feature recorded elsewhere. |
| Reliability | one udp2tcp instance handles one peer only; the server spawns a UDP socket per TCP connection |
| Notes | Included because it is the production-grade reference for the technique and the ancestor proxyguard names. Its existence also explains why the wrapper question is a hosting question: Mullvad can offer WireGuard over TCP because it owns the server half. A client with no host cannot get the same thing from a library. The 16-bit length prefix caps a datagram at 65535 bytes, which is not a real constraint for WireGuard's MTU. |
| Evidence rung | documented its behaviour inside the Mullvad app is not testable without a subscription; the library's own protocol is documented |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
| Parsed numbers |
|
Evidence (4)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | github.com/mullvad/udp-over-tcp | "A library (and binaries) for tunneling UDP datagrams over a TCP stream"; tcp2udp example forwarding 10.0.0.0:5001/TCP to 127.0.0.1:51820/UDP |
| 2026-10-23 | github.com/mullvad/udp-over-tcp | the wire format: "Each datagram is preceded with a 16 bit unsigned integer in big endian byte order" |
| 2026-10-23 | github.com/mullvad/udp-over-tcp | 588 stars, no GitHub releases, last push 2026-08-17 |
| 2026-10-23 | mullvad.net/en/blog/introducing-wireguard-over-tcp-and-ipv6 | Mullvad deploys WireGuard over TCP on its own servers and switches to it with 'mullvad relay set tunnel wireguard --protocol tcp' |
More fields (10)
{
"wg_path": "none",
"wg_detail": "tcp2udp runs on the server and forwards to 127.0.0.1:51820; udp2tcp runs on the client beside the WireGuard interface",
"ingress": "tcp",
"volume_tib_month": null,
"volume_stated": "not applicable; the software states no volume",
"bytes_transit": "yes",
"transit_note": "through the tcp2udp server, which owns the UDP socket to WireGuard",
"hosting_requirement": "a server host running tcp2udp; the client binary goes beside the WireGuard interface",
"last_release": "no GitHub releases; last push 2026-08-17",
"stars": 588
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable