Need help forwarding Wireguard traffic through Shadowsocks

[hizani]

Hey! I want to set up Wireguard obfuscation through Shadowsocks because WG stopped working several days ago due to ISPs in my country starting to block Wireguard and OpenVPN connections to foreign servers.

It should be something like this:

I've tried to set it up following this guide, but it doesn't work for me probably because the author uses -libev version and I'm using the rusty one, so maybe there are mistakes in my adaptation of it's configs.

Here are my configs

VPS

Wireguard

[Interface]
Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = 60207
PrivateKey = <key>
PostUp = iptables -I INPUT -p udp --dport 60207 -j ACCEPT
PostUp = iptables -I FORWARD -i eth0 -o wg0 -j ACCEPT
PostUp = iptables -I FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostUp = ip6tables -I FORWARD -i wg0 -j ACCEPT
PostUp = ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D INPUT -p udp --dport 60207 -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PostDown = ip6tables -D FORWARD -i wg0 -j ACCEPT
PostDown = ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <key>
PresharedKey = <key>
AllowedIPs = 10.66.66.66/32,fd42:42:42::66/128

Shadowsocks

{
    "servers": [
        {
            "server":"0.0.0.0",
            "server_port":8388,
            "password":<password>,
            "timeout":300,
            "method":"chacha20-ietf-poly1305",
            "fast_open":true,
	    "mode": "tcp_and_udp"
        }
    ]
}

Logs

Started Shadowsocks proxy server.
INFO  shadowsocks server 1.17.0 build 2023-10-15T02:31:38.682312905+00:00
INFO  shadowsocks tcp server listening on 0.0.0.0:8388, inbound address 0.0.0.0:8388
INFO  shadowsocks udp server listening on 0.0.0.0:8388, inbound address 0.0.0.0:8388

Local Client

Wireguard

[Interface]
PrivateKey = <key>
Address = 10.66.66.66/32,fd42:42:42::66/128
DNS = 10.66.66.10,1.1.1.1,1.0.0.1

[Peer]
PublicKey = <key>
PresharedKey = <key>
Endpoint = 127.0.0.1:1081
AllowedIPs = 0.0.0.0/0,::/0

Shadowsocks

{
    "servers": [
        {
	    "server":<VPS IP>,
	    "server_port":8388,
            "method":"chacha20-ietf-poly1305",
    	    "password":<password>,
    	    "timeout":300,
    	    "fast_open":true
	}
    ],
    "locals": [
        {
	    "protocol": "tunnel",
            "local_address": "127.0.0.1",
    	    "local_port":1081,
    	    "mode":"udp_only",
	    "forward_address":<VPS IP>,
	    "forward_port":60207
        },
        {
            "local_address": "127.0.0.1",
    	    "local_port":1080
        }
    ]
}

(Default connection by 1080 port without Wireguard works fine)

Logs

Started Shadowsocks-Rust Client Service.
INFO  shadowsocks local 1.17.1 build 2023-11-28T14:22:38.311607013+00:00
INFO  shadowsocks socks TCP listening on 127.0.0.1:1080
INFO  shadowsocks UDP tunnel listening on 127.0.0.1:1081

---

When I enable Wireguard on my local PC I can't ping any IP, and logs show no errors.

Are there any mistakes in my configs?

[zonyitoo]

Firstly, you can enable sslocal's log by running sslocal -vvv and see if sslocal actually receives requests from Wireguard.

[hizani]

Firstly, you can enable sslocal's log by running sslocal -vvv and see if sslocal actually receives requests from Wireguard.

Yes, sslocal receives WG traffic

TRACE [43072:131681119897280] [shadowsocks_service::local::net::udp::association] udp relay 127.0.0.1:25098 -> <VPS IP>:60207 (proxied) with 148 bytes
TRACE [43072:131681119897280] [shadowsocks::relay::udprelay::aead] UDP packet generated aead salt b"\x82\xa4\xc0\x8b\xc6\xb1|}^\x1ds\xb0\xd5K\x17C\x17\xa2\xcdoz^\xd9\xc0g\xb0\xe7\x9a\x07\x9abB"
TRACE [43072:131681119897280] [shadowsocks::relay::udprelay::proxy_socket] UDP server client send to <VPS IP>:60207, control: UdpSocketControlData { client_session_id: 14887344535427807600, server_session_id: 0, packet_id: 2, user: None }, payload length 148 bytes, packet length 203 bytes
TRACE [43072:131681119897280] [shadowsocks_service::local::net::udp::association] udp relay 127.0.0.1:25098 -> <VPS IP>:60207 (proxied) with 148 bytes
TRACE [43072:131681119897280] [shadowsocks::relay::udprelay::aead] UDP packet generated aead salt b"\xd3\xdd\xfa\xff\xcc\xee$\x0c\x17v=\xfc\x15 \xf9\xf7\xa2\xa6\xaa\xab\xc7p\xf3\x7f4B!\xaa&vJ\x87"

[hizani]

I also tried to add -vvv for ssserver and seems like packets don't get to the server.

Jan 24 16:01:44 host systemd[1]: Started Shadowsocks proxy server.
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.358576624+00:00 TRACE [82651:139628357638784] [shadowsocks_rust::service::server] Config { log: LogConfig { level: 3, format: LogFormatConfig { without_time: false }, config_path: None }, runtime: RuntimeConfig { worker_count: None, mode: MultiThread } }
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.358955926+00:00 TRACE [82651:139628357638784] [shadowsocks_rust::sys] rlimit NOFILE rlimit { rlim_cur: 1024, rlim_max: 524288 } require adjustion
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.359023856+00:00 DEBUG [82651:139628357638784] [shadowsocks_rust::sys] rlimit NOFILE adjusted rlimit { rlim_cur: 524288, rlim_max: 524288 }
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.360314052+00:00 INFO  [82651:139628357638784] [shadowsocks_rust::service::server] shadowsocks server 1.17.0 build 2023-10-15T02:31:38.682312905+00:00
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.360987118+00:00 TRACE [82651:139628357638784] [shadowsocks_service::server] Config { server: [ServerInstanceConfig { config: ServerConfig { addr: SocketAddr(0.0.0.0:8388), password: <password>, method: CHACHA20_POLY1305, enc_key: [146, 255, 109, 115, 7, 126, 227, 163, 249, 78, 239, 121, 155, 156, 122, 140, 78, 250, 199, 131, 8, 9, 211, 238, 153, 228, 239, 84, 218, 117, 28, 93], timeout: None, identity_keys: [], user_manager: None, plugin: None, plugin_addr: None, remarks: None, id: None, mode: TcpAndUdp, weight: ServerWeight { tcp_weight: 1.0, udp_weight: 1.0 } }, acl: None }], local: [], dns: System, dns_cache_size: None, ipv6_first: false, ipv6_only: false, no_delay: false, fast_open: false, keep_alive: None, mptcp: false, nofile: None, outbound_fwmark: None, outbound_bind_interface: None, outbound_bind_addr: None, inbound_send_buffer_size: None, inbound_recv_buffer_size: None, outbound_send_buffer_size: None, outbound_recv_buffer_size: None, manager: None, config_type: Server, udp_timeout: None, udp_max_associations: None, acl: None, security: SecurityConfig { replay_attack: SecurityReplayAttackConfig { policy: Default } }, balancer: BalancerConfig { max_server_rtt: None, check_interval: None, check_best_interval: None }, config_path: Some("/etc/shadowsocks/shadowsocks.json"), worker_count: 2 }
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.362736886+00:00 TRACE [82651:139628357638784] [shadowsocks::dns_resolver::hickory_dns_resolver] initializing DNS resolver with system-config ResolverConfig { domain: None, search: [Name("nlpve.king-support.com")], name_servers: NameServerConfigGroup([NameServerConfig { socket_addr: 127.0.0.53:53, protocol: Udp, tls_dns_name: None, trust_negative_responses: false, bind_addr: None }, NameServerConfig { socket_addr: 127.0.0.53:53, protocol: Tcp, tls_dns_name: None, trust_negative_responses: false, bind_addr: None }]) } opts ResolverOpts { ndots: 1, timeout: 5s, attempts: 2, rotate: false, check_names: true, edns0: false, validate: false, ip_strategy: Ipv4AndIpv6, cache_size: 32, use_hosts_file: true, positive_min_ttl: None, negative_min_ttl: None, positive_max_ttl: None, negative_max_ttl: None, num_concurrent_reqs: 2, preserve_intermediates: true, try_tcp_on_error: false, server_ordering_strategy: QueryStatistics, recursion_desired: true, authentic_data: false, shuffle_dns_servers: false }
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.364149643+00:00 INFO  [82651:139628357638784] [shadowsocks_service::server::tcprelay] shadowsocks tcp server listening on 0.0.0.0:8388, inbound address 0.0.0.0:8388
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.364302525+00:00 INFO  [82651:139628357638784] [shadowsocks_service::server::udprelay] shadowsocks udp server listening on 0.0.0.0:8388, inbound address 0.0.0.0:8388
Jan 24 16:01:44 host ssserver[82651]: 2024-01-24T16:01:44.364389272+00:00 TRACE [82651:139628357638784] [shadowsocks_service::server::udprelay] udp server starting extra 1 recv workers

[tjdcs]

I'm also trying to get this working and am stuck at basically the same step. I can connect to wireguard server WITHOUT going through ssocks, but when I try to udp tunnel using the above config something isn't working. I can see from -vvv on sslocal that the traffic is getting seen by sslocal. But I can't tell what's happening after this other than there's no connection.

Do I need to set a specific ListenPort in my wireguard client config? Did you make any progress that I might be missing?