dtlspipe下載dtlspipe源代碼下載

dtlspipe

其他類別

v1.8.2

下載

dtlspipe

UDP會話的通用DTLS包裝器。像stunnel一樣，但對於UDP。適用於包裝Wireduard或UDP OpenVPN或任何其他面向連接的UDP會話。

“客戶端”會收到原告UDP流量，並通過加密的DTLS連接將其轉發到“服務器”。 “服務器”會聆聽UDP端口並接受加密的DTLS會話，將每個會話的消息轉發為單獨的UDP連接到明文UDP端口。

特徵

跨平台（Windows/Mac OS/Linux/Android/*BSD）
使用經過驗證的DTLS加密進行安全數據報隧道
簡單配置：只需預共享鍵，收聽地址和前向地址即可。

安裝

二進制

預先建造的二進製文件可在此處找到。

從源構建

另外，您可以從源安裝DTLSpipe。在源目錄中運行以下命令：

 make install

用法

通用情況

假設您有以下設置：您的服務器具有公共IP地址203.0.113.11，在端口514上運行了一些UDP服務。您想安全地訪問此服務，並在您和此服務之間具有UDP Datagrams加密和認證。

使用命令dtlspipe genpsk生成預共享鍵
在服務器計算機上運行dtlspipe -server： dtlspipe -psk xxxxxxxxxxxx server 0.0.0.0:2815 127.0.0.1:514
在計算機上運行dtlspipe -client： dtlspipe -psk xxxxxxxxxxxx client 127.0.0.1:2816 203.0.113.11:2815
使用地址127.0.0.1:2816而不是203.0.113.11:514與服務通信。

幾筆注：

您可以使用任何端口而不是2815和2816。
使用Localhost地址127.0.0.1進行端口綁定也是可選的，並且在示例中使用以限制端口訪問僅從Local主機訪問。使用0.0.0.0允許從外部訪問網絡。
也可以通過DTLSPIPE_PSK環境變量指定PSK。

線人

DTLSpipe設置可以使用通用情況進行示例進行，但是更具體地說，DTLSpipe Server應指向WireGuard Server端口，WireGuard Client應該與DTLSpipe客戶端端口進行通信。

您需要進行以下調整對Wineguard客戶端的調整：

使用DTLSpipe客戶端的綁定地址作為客戶端固定連接的終點。
使用較小的MTU進行VireGuard隧道，將MTU = 1280添加到Wineguard客戶端和服務器隧道配置的[Peer]部分。
從WireGuard Client Config中的AllowedIPs中排除DTLSpipe服務器地址。該計算器可能會為您提供幫助。服務器地址的示例203.0.113.11 ：

 AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/5, 200.0.0.0/7, 202.0.0.0/8, 203.0.0.0/18, 203.0.64.0/19, 203.0.96.0/20, 203.0.112.0/24, 203.0.113.0/29, 203.0.113.8/31, 203.0.113.10/32, 203.0.113.12/30, 203.0.113.16/28, 203.0.113.32/27, 203.0.113.64/26, 203.0.113.128/25, 203.0.114.0/23, 203.0.116.0/22, 203.0.120.0/21, 203.0.128.0/17, 203.1.0.0/16, 203.2.0.0/15, 203.4.0.0/14, 203.8.0.0/13, 203.16.0.0/12, 203.32.0.0/11, 203.64.0.0/10, 203.128.0.0/9, 204.0.0.0/6, 208.0.0.0/4, 224.0.0.0/3, ::/0

附加說明

DTLSpipe服務器默認情況下跳過了Helloverify消息，以便解決一些DPI系統。它與一些DOS安全風險相關。請添加服務器選項-skip-hello-verify=false如果這種行為不受歡迎。另外，可以通過防火牆來減輕這種風險，從而限制了服務器端口的會話。

概要

 $ dtlspipe -h
Usage:

dtlspipe [OPTION]... server <BIND ADDRESS> <REMOTE ADDRESS>

  Run server listening on BIND ADDRESS for DTLS datagrams and forwarding decrypted UDP datagrams to REMOTE ADDRESS.

dtlspipe [OPTION]... client <BIND ADDRESS> <REMOTE ADDRESS>

  Run client listening on BIND ADDRESS for UDP datagrams and forwarding encrypted DTLS datagrams to REMOTE ADDRESS.

dtlspipe [OPTION]... hoppingclient <BIND ADDRESS> <ENDPOINT GROUP> [ENDPOINT GROUP]...

  Run client listening on BIND ADDRESS for UDP datagrams and forwarding encrypted DTLS datagrams to a random chosen endpoints.

  Endpoints are specified by a list of one or more ENDPOINT GROUP. ENDPOINT GROUP syntax is defined by following ABNF:

    ENDPOINT-GROUP = address-term *( "," address-term ) ":" Port
    address-term = Domain / IP-range / IP-prefix / IP-address
    Domain = <Defined in Section 4.1.2 of [RFC5321]>
    IP-range = ( IPv4address ".." IPv4address ) / ( IPv6address ".." IPv6address )
    IP-prefix = IP-address "/" 1*DIGIT
    IP-address = IPv6address / IPv4address
    IPv4address = <Defined in Section 4.1 of [RFC5954]>
    IPv6address = <Defined in Section 4.1 of [RFC5954]>

  Endpoint is chosen randomly as follows.
  First, random ENDPOINT GROUP is chosen with equal probability.
  Next, address is chosen from address sets specified by that group, with probability
  proportional to size of that set. Domain names and single addresses condidered 
  as sets having size 1, ranges and prefixes have size as count of addresses in it.

  Example: 'example.org:20000-50000' '192.168.0.0/16,10.0.0.0/8,172.16.0.0-172.31.255.255:50000-60000'

dtlspipe [OPTION]... genpsk

  Generate and output PSK.

dtlspipe ciphers

  Print list of supported ciphers and exit.

dtlspipe curves

  Print list of supported elliptic curves and exit.

dtlspipe version

  Print program version and exit.

Options:
  -cid
    	enable connection_id extension (default true)
  -ciphers value
    	colon-separated list of ciphers to use
  -cpuprofile string
    	write cpu profile to file
  -curves value
    	colon-separated list of curves to use
  -identity string
    	client identity sent to server
  -idle-time duration
    	max idle time for UDP session (default 30s)
  -key-length uint
    	generate key with specified length (default 16)
  -mtu int
    	MTU used for DTLS fragments (default 1400)
  -psk string
    	hex-encoded pre-shared key. Can be generated with genpsk subcommand
  -rate-limit value
    	limit for incoming connections rate. Format: <limit>/<time duration> or empty string to disable (default 20/1m0s)
  -skip-hello-verify
    	(server only) skip hello verify request. Useful to workaround DPI (default true)
  -stale-mode value
    	which stale side of connection makes whole session stale (both, either, left, right) (default either)
  -time-limit duration
    	limit for each session duration. Use single value X for fixed limit or range X-Y for randomized limit
  -timeout duration
    	network operation timeout (default 10s)