HTTP over userspace TCP/IP stack over WireGuard over SOCKS-over-WebSocket

This browser node uses socksgo for SOCKS-over-WebSocket, batchudp + wgo for the WireGuard transport, and gonnect-netstack/vtun for the userspace TCP/IP stack.

Typical test flow:

start a socks-over-websocket server such as gost -L "socks5+ws://:1080?udp=true&udpBufferSize=4096&bind=true"
open one or two tabs with this demo
start each node
exchange each tab’s public key and advertised endpoint
set the peer allowed IPs
start the in-tunnel HTTP server on one side and request it from the other side

Node Config

SOCKS-over-WebSocket URL

Local tunnel IP

Requested WG listen port

Peer keepalive seconds

Local private key

Local public key

Loading WASM module...

Peer Config

Peer public key

Peer preshared key

Peer endpoint

Peer allowed IPs

For two tabs, each side should advertise a different tunnel IP and include the remote tab’s tunnel IP in Peer allowed IPs. Changing Local tunnel IP auto-updates the default peer IP and request URL until you override them manually. If you edit these fields while the node is already running, the new config is applied on the next Start / Apply Node, server start, or request.

Share / Import

Node share payload

Copying exports the current node config plus live runtime details such as the public key, advertised endpoint, and active in-tunnel server URL. Importing maps that data into this tab’s peer config, flips the local tunnel IP to the complementary address when possible, and can auto-run a request to the remote server.

Advertised Endpoint

Actual WG listen port

Raw UDP bind from proxy

Suggested peer endpoint

In-Tunnel HTTP Server

Listen address inside VTun

Response body

Reachability

Server URL to test from peer

If the proxy reports an unspecified bind address such as 0.0.0.0, use the suggested endpoint or replace the host manually with the proxy host that other peers can actually reach.

HTTP Client

Method

Target URL inside tunnel

Headers

Body

Request path is idle.