dtlspipe下载dtlspipe源代码下载

dtlspipe

其他类别

v1.8.2

下载

dtlspipe

UDP会话的通用DTLS包装器。像stunnel一样，但对于UDP。适用于包装Wireduard或UDP OpenVPN或任何其他面向连接的UDP会话。

“客户端”会收到原告UDP流量，并通过加密的DTLS连接将其转发到“服务器”。 “服务器”会聆听UDP端口并接受加密的DTLS会话，将每个会话的消息转发为单独的UDP连接到明文UDP端口。

特征

跨平台（Windows/Mac OS/Linux/Android/*BSD）
使用经过验证的DTLS加密进行安全数据报隧道
简单配置：只需预共享键，收听地址和前向地址即可。

安装

二进制

预先建造的二进制文件可在此处找到。

从源构建

另外，您可以从源安装DTLSpipe。在源目录中运行以下命令：

 make install

用法

通用情况

假设您有以下设置：您的服务器具有公共IP地址203.0.113.11，在端口514上运行了一些UDP服务。您想安全地访问此服务，并在您和此服务之间具有UDP Datagrams加密和认证。

使用命令dtlspipe genpsk生成预共享键
在服务器计算机上运行dtlspipe -server： dtlspipe -psk xxxxxxxxxxxx server 0.0.0.0:2815 127.0.0.1:514
在计算机上运行dtlspipe -client： dtlspipe -psk xxxxxxxxxxxx client 127.0.0.1:2816 203.0.113.11:2815
使用地址127.0.0.1:2816而不是203.0.113.11:514与服务通信。

几笔注：

您可以使用任何端口而不是2815和2816。
使用Localhost地址127.0.0.1进行端口绑定也是可选的，并且在示例中使用以限制端口访问仅从Local主机访问。使用0.0.0.0允许从外部访问网络。
也可以通过DTLSPIPE_PSK环境变量指定PSK。

线人

DTLSpipe设置可以使用通用情况进行示例进行，但是更具体地说，DTLSpipe Server应指向WireGuard Server端口，WireGuard Client应该与DTLSpipe客户端端口进行通信。

您需要进行以下调整对Wineguard客户端的调整：

使用DTLSpipe客户端的绑定地址作为客户端固定连接的终点。
使用较小的MTU进行VireGuard隧道，将MTU = 1280添加到Wineguard客户端和服务器隧道配置的[Peer]部分。
从WireGuard Client Config中的AllowedIPs中排除DTLSpipe服务器地址。该计算器可能会为您提供帮助。服务器地址的示例203.0.113.11 ：

 AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/5, 200.0.0.0/7, 202.0.0.0/8, 203.0.0.0/18, 203.0.64.0/19, 203.0.96.0/20, 203.0.112.0/24, 203.0.113.0/29, 203.0.113.8/31, 203.0.113.10/32, 203.0.113.12/30, 203.0.113.16/28, 203.0.113.32/27, 203.0.113.64/26, 203.0.113.128/25, 203.0.114.0/23, 203.0.116.0/22, 203.0.120.0/21, 203.0.128.0/17, 203.1.0.0/16, 203.2.0.0/15, 203.4.0.0/14, 203.8.0.0/13, 203.16.0.0/12, 203.32.0.0/11, 203.64.0.0/10, 203.128.0.0/9, 204.0.0.0/6, 208.0.0.0/4, 224.0.0.0/3, ::/0

附加说明

DTLSpipe服务器默认情况下跳过了Helloverify消息，以便解决一些DPI系统。它与一些DOS安全风险相关。请添加服务器选项-skip-hello-verify=false如果这种行为不受欢迎。另外，可以通过防火墙来减轻这种风险，从而限制了服务器端口的会话。

概要

 $ dtlspipe -h
Usage:

dtlspipe [OPTION]... server <BIND ADDRESS> <REMOTE ADDRESS>

  Run server listening on BIND ADDRESS for DTLS datagrams and forwarding decrypted UDP datagrams to REMOTE ADDRESS.

dtlspipe [OPTION]... client <BIND ADDRESS> <REMOTE ADDRESS>

  Run client listening on BIND ADDRESS for UDP datagrams and forwarding encrypted DTLS datagrams to REMOTE ADDRESS.

dtlspipe [OPTION]... hoppingclient <BIND ADDRESS> <ENDPOINT GROUP> [ENDPOINT GROUP]...

  Run client listening on BIND ADDRESS for UDP datagrams and forwarding encrypted DTLS datagrams to a random chosen endpoints.

  Endpoints are specified by a list of one or more ENDPOINT GROUP. ENDPOINT GROUP syntax is defined by following ABNF:

    ENDPOINT-GROUP = address-term *( "," address-term ) ":" Port
    address-term = Domain / IP-range / IP-prefix / IP-address
    Domain = <Defined in Section 4.1.2 of [RFC5321]>
    IP-range = ( IPv4address ".." IPv4address ) / ( IPv6address ".." IPv6address )
    IP-prefix = IP-address "/" 1*DIGIT
    IP-address = IPv6address / IPv4address
    IPv4address = <Defined in Section 4.1 of [RFC5954]>
    IPv6address = <Defined in Section 4.1 of [RFC5954]>

  Endpoint is chosen randomly as follows.
  First, random ENDPOINT GROUP is chosen with equal probability.
  Next, address is chosen from address sets specified by that group, with probability
  proportional to size of that set. Domain names and single addresses condidered 
  as sets having size 1, ranges and prefixes have size as count of addresses in it.

  Example: 'example.org:20000-50000' '192.168.0.0/16,10.0.0.0/8,172.16.0.0-172.31.255.255:50000-60000'

dtlspipe [OPTION]... genpsk

  Generate and output PSK.

dtlspipe ciphers

  Print list of supported ciphers and exit.

dtlspipe curves

  Print list of supported elliptic curves and exit.

dtlspipe version

  Print program version and exit.

Options:
  -cid
    	enable connection_id extension (default true)
  -ciphers value
    	colon-separated list of ciphers to use
  -cpuprofile string
    	write cpu profile to file
  -curves value
    	colon-separated list of curves to use
  -identity string
    	client identity sent to server
  -idle-time duration
    	max idle time for UDP session (default 30s)
  -key-length uint
    	generate key with specified length (default 16)
  -mtu int
    	MTU used for DTLS fragments (default 1400)
  -psk string
    	hex-encoded pre-shared key. Can be generated with genpsk subcommand
  -rate-limit value
    	limit for incoming connections rate. Format: <limit>/<time duration> or empty string to disable (default 20/1m0s)
  -skip-hello-verify
    	(server only) skip hello verify request. Useful to workaround DPI (default true)
  -stale-mode value
    	which stale side of connection makes whole session stale (both, either, left, right) (default either)
  -time-limit duration
    	limit for each session duration. Use single value X for fixed limit or range X-Y for randomized limit
  -timeout duration
    	network operation timeout (default 10s)