Skip to content

configuration.md

Latest commit

 

History

History
102 lines (79 loc) · 2.53 KB

configuration.md

File metadata and controls

102 lines (79 loc) · 2.53 KB
Raw

Configuration Files

wireproxy-tcp.conf

Main WireGuard configuration for wireproxy:

[Interface]
# Your Mullvad private key (from downloaded config)
PrivateKey = YOUR_MULLVAD_PRIVATE_KEY
# Assigned WireGuard IP
Address = 10.68.41.179/32
# Mullvad DNS
DNS = 100.64.0.7

[Peer]
# Mullvad server public key
PublicKey = ItEcyDXwTXtq6bQubbO6lY0K/oh0dfk26AV+muU+Ah4=
# Points to local udp2tcp tunnel (NOT direct to Mullvad)
Endpoint = 127.0.0.1:51822
# Route all traffic through VPN
AllowedIPs = 0.0.0.0/0
# Keep connection alive through NAT
PersistentKeepalive = 25

[Socks5]
# SOCKS5 proxy for applications
BindAddress = 0.0.0.0:1081

[http]
# HTTP proxy for applications
BindAddress = 0.0.0.0:8081

Important Notes

  1. PrivateKey must match Mullvad registration: Use the key from your downloaded Mullvad config, not a self-generated one
  2. Endpoint is localhost: Because udp2tcp handles the actual connection
  3. Ports 1081/8081: Port 1080 is often used by other services

Getting Your Mullvad Config

  1. Log into Mullvad account
  2. Download WireGuard config for desired server
  3. The PrivateKey in that config is your registered key
  4. The peer's PublicKey and server IP are what you need

redsocks.conf (for transparent proxy)

base {
    log_debug = off;
    log_info = on;
    daemon = on;
    redirector = iptables;
}

redsocks {
    local_ip = 0.0.0.0;
    local_port = 12345;
    ip = 127.0.0.1;
    port = 1081;
    type = socks5;
}

iptables Rules for Transparent Proxy

# Create chain for redsocks
iptables -t nat -N REDSOCKS

# Skip local/private addresses
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN

# Redirect TCP to redsocks
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345

# Apply to traffic from LAN
iptables -t nat -A PREROUTING -i br0 -p tcp -j REDSOCKS

DNS Configuration

The router uses connmand for network management. DNS is set via:

# Check current DNS
cat /etc/resolv.conf

# DNS may be controlled by connman
# Configuration in /var/lib/connman/

For split tunneling, you may want to use a DNS that returns correct IPs for Chinese services while using Mullvad DNS for foreign sites.