starred/Cloak

Fork 0

mirror of https://github.com/cbeuw/Cloak.git synced 2026-04-26 04:55:58 +03:00

[GH-ISSUE #220] Question about EncryptionMethod for wireguard traffic #178

New issue

Closed

opened 2026-02-26 12:34:11 +03:00 by kerem · 4 comments

kerem commented

2026-02-26 12:34:11 +03:00

Owner

Originally created by @bingzhangdai on GitHub (Mar 26, 2023).
Original GitHub issue: https://github.com/cbeuw/Cloak/issues/220

I have already successfully run wireguard with cloak. From the wiki,

You must not leave EncryptionMethod as plain in Cloak client's configuration file because OpenVPN gives out fingerprint. Change it to aes-gcm or chacha20-poly1305

I am wondering if it also holds true for wireguard. Now I leave the EncryptionMethod as plain.

Originally created by @bingzhangdai on GitHub (Mar 26, 2023). Original GitHub issue: https://github.com/cbeuw/Cloak/issues/220 I have already successfully run wireguard with cloak. From the wiki, ``` You must not leave EncryptionMethod as plain in Cloak client's configuration file because OpenVPN gives out fingerprint. Change it to aes-gcm or chacha20-poly1305 ``` I am wondering if it also holds true for wireguard. Now I leave the EncryptionMethod as plain.

kerem closed this issue

2026-02-26 12:34:11 +03:00

kerem commented

2026-02-26 12:34:12 +03:00

Author

Owner

@valerius2k commented on GitHub (May 3, 2023):

The intention of EncryptionMethod is to hide fingerprints of an underlying proxy. WG should have its own fingerprint too. So if you set EncryptionMethod to plain, the fingerprint will be exposed and your ISP could detect and block it. The data stream has no definite fingerprint only if its data looks like a white noise. But AFAIK it's not so with WG. WG is very good detectable and is blocked more often than other VPN protocols.

@valerius2k commented on GitHub (May 3, 2023): The intention of EncryptionMethod is to hide fingerprints of an underlying proxy. WG should have its own fingerprint too. So if you set EncryptionMethod to plain, the fingerprint will be exposed and your ISP could detect and block it. The data stream has no definite fingerprint only if its data looks like a white noise. But AFAIK it's not so with WG. WG is very good detectable and is blocked more often than other VPN protocols.

kerem commented

2026-02-26 12:34:12 +03:00

Author

Owner

@bingzhangdai commented on GitHub (May 3, 2023):

@valerius2k Thanks for your clarification. It is truly clear!

@bingzhangdai commented on GitHub (May 3, 2023): @valerius2k Thanks for your clarification. It is truly clear!

kerem commented

2026-02-26 12:34:12 +03:00

Author

Owner

@INNKCake commented on GitHub (Aug 7, 2023):

@bingzhangdai can you share a configuration/guide for Wireguard?

@INNKCake commented on GitHub (Aug 7, 2023): @bingzhangdai can you share a configuration/guide for Wireguard?

kerem commented

2026-02-26 12:34:12 +03:00

Author

Owner

@bingzhangdai commented on GitHub (Aug 7, 2023):

First, you should set up the wireguard by following the official guide.

Suppose you have exposed your wireguard port 500/udp on the server. Your cloak is also deployed on the same server. You can use the following conf to redirect 500/udp to localhost:500/udp.
on the server

{
    "ProxyBook": {
        "wireguard": [
            "udp",
            "127.0.0.1:500"
        ]
    },
    "BypassUID": [
        "xxx"
    ],
    "RedirAddr": "xxx",
    "PrivateKey": "xxx",
    "AdminUID": "xxx"
}

on the client

{
    "Transport": "direct",
    "ProxyMethod": "wireguard",
    "EncryptionMethod": "chacha20-poly1305",
    "UID": "xxx",
    "PublicKey": "xxx",
    "ServerName": "cn.bing.com",
    "NumConn": 1,
    "BrowserSig": "chrome",
    "StreamTimeout": 300,
    "KeepAlive": 0
}

Then you can run ck-client -c ck-client.json -u -s serverip -l 500 on your machine. Thus redirect the server:500/udp to localhost:500/udp. Hope this helps.

@bingzhangdai commented on GitHub (Aug 7, 2023): First, you should set up the wireguard by following the official guide. Suppose you have exposed your wireguard port 500/udp on the server. Your cloak is also deployed on the same server. You can use the following conf to redirect 500/udp to localhost:500/udp. on the server ```json { "ProxyBook": { "wireguard": [ "udp", "127.0.0.1:500" ] }, "BypassUID": [ "xxx" ], "RedirAddr": "xxx", "PrivateKey": "xxx", "AdminUID": "xxx" } ``` on the client ```json { "Transport": "direct", "ProxyMethod": "wireguard", "EncryptionMethod": "chacha20-poly1305", "UID": "xxx", "PublicKey": "xxx", "ServerName": "cn.bing.com", "NumConn": 1, "BrowserSig": "chrome", "StreamTimeout": 300, "KeepAlive": 0 } ``` Then you can run `ck-client -c ck-client.json -u -s serverip -l 500` on your machine. Thus redirect the server:500/udp to localhost:500/udp. Hope this helps.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/Cloak#178

No description provided.

Rows
Columns