利用基于haskell的wstunnel-by-erebe翻墙

Tunneling over websocket protocol.

Most of the time when you are using a public network, you are behind some kind of firewall or proxy. One of their purpose is to constrain you to only use certain kind of protocols. Nowadays, the most widespread protocol is http and is de facto allowed by third party equipment.
This tool understands this fact and uses the websocket protocol which is compatible with http in order to bypass firewalls and proxies. Wstunnel allows you to tunnel what ever traffic you want.
My inspiration came from this project but as I don't want to install npm and nodejs to use this tool, I remade it in Haskell and improved it.
What to expect:

• Good error messages and debug informations
• Static tunneling (TCP and UDP)
• Dynamic tunneling (socks5 proxy)
• Support for http proxy (when behind one)
• Support for tls/https server (with embeded self signed certificate, see comment in the example section)
• Standalone binary for linux x86_64 (so just cp it where you want)
• Standalone archive for windows

Binaries
P.S: Please do not pay attention to Main.hs because as I hate to write command line code this file is crappy

Command line

Use the websockets protocol to tunnel {TCP,UDP} traffic
wsTunnelClient <---> wsTunnelServer <---> RemoteHost
Use secure connection (wss://) to bypass proxies

wstunnel [OPTIONS] ws[s]://wstunnelServer[:port]
Client options:
  -L --localToRemote=[BIND:]PORT:HOST:PORT  Listen on local and forwards
                                            traffic from remote
  -D --dynamicToRemote=[BIND:]PORT          Listen on local and dynamically
                                            (with socks5 proxy) forwards
                                            traffic from remote
  -u --udp                                  forward UDP traffic instead of
                                            TCP
  -p --httpProxy=USER:PASS@HOST:PORT        If set, will use this proxy to
                                            connect to the server
Server options:
     --server                               Start a server that will forward
                                            traffic for you
  -r --restrictTo=HOST:PORT                 Accept traffic to be forwarded
                                            only to this service
Common options:
  -v --verbose                              Print debug information
  -q --quiet                                Print only errors
  -h --help                                 Display help message
  -V --version                              Print version information

Examples

Simplest one

On your remote host, start the wstunnel's server by typing this command in your terminal

wstunnel --server ws://0.0.0.0:8080

This will create a websocket server listenning on any interface on port 8080. On the client side use this command to forwards traffic trought the websocket tunnel

wstunnel -D 8888 ws://myRemoteHost:8080

This command will create a sock5 server listenning only on loopback interface on port 8888 and will forwards traffic.
Ex: With firefox you can setup a proxy using this tunnel by settings in networking preferences 127.0.0.1:8888 and selecting socks5 proxy

When behind a corporate proxy

An other useful example is when you want to bypass an http proxy (a corporate proxy for example) The most reliable way to do it is to use wstunnel as described below
Start your wstunnel server with tls activated

wstunnel --server wss://0.0.0.0:443 -r 127.0.0.1:22

The server will listen on any interface on port 443 (https) and restrict traffic to be forwarded only to the ssh daemon.
Be aware that the server will use self signed certificate with weak cryptographic algorithm. It was made in order to add the least possible overhead while still being compliant with tls.
So do not rely on wstunnel to protect your privacy, if you want to do so, forwards only traffic that is already secure by design (ex: https)
Now on the client side start the client with

wstunnel -L 9999:127.0.0.1:22 -p mycorporateproxy:8080 wss://myRemoteHost:443

It will start a tcp server on port 9999 that will contact the corporate proxy, negociate a tls connection with the remote host and forward traffic to the ssh daemon on the remote host.
You can now access your server from your local machine on ssh by using

ssh -p 9999 login@127.0.0.1

How to Build

Install the stack tool https://docs.haskellstack.org/en/stable/README/ or if you are a believer

curl -sSL https://get.haskellstack.org/ | sh

and run the following command at the root of the project:

stack install 

from https://github.com/erebe/wstunnel

reddit.com上的讨论：

https://www.reddit.com/r/programming/comments/4znoaj/wstunnel_a_standalone_websocket_tunneling_tool/ 

-------

我的补充说明：

ws不是加密连接，wss才是加密连接.(可以利用nginx做反向代理，生成wss链接）

登陆linux vps,

下载其可执行文件：

wget https://github.com/erebe/wstunnel/releases/download/1.0/wstunnel

mv wstunnel wstunnel-by-erebe

chmod 755 wstunnel-by-erebe

./wstunnel-by-erebe -h

root@ar:~# ./wstunnel-by-erebe --server ws://127.0.0.1:448 

会显示：

WAIT for connection on 127.0.0.1:448

不过此命令./wstunnel-by-erebe --server ws://127.0.0.1:448 容易退出，我们可以利用systemd让此命令运行在后台：

nano /etc/systemd/system/wstunnel-by-erebe.service

其内容为：

[Unit]

After=network.target

[Service]

ExecStart=/root/wstunnel-by-erebe --server ws://127.0.0.1:448

Restart=always

[Install]

WantedBy=multi-user.target

然后运行：

systemctl start wstunnel-by-erebe

systemctl enable wstunnel-by-erebe


服务器端就搭建好了。



在客户机器mac上，

curl -sSL https://get.haskellstack.org/ | sh (安装stack)
git clone https://github.com/erebe/wstunnel wstunnel-by-erebe

cd wstunnel-by-erebe

yudeMacBook-Air:wstunnel-by-erebe brite$ ls
Dockerfile  app   stack.yaml
LICENSE   bin   test
README.md  logo_wstunnel.png wstunnel.cabal
Setup.hs  src
yudeMacBook-Air:wstunnel-by-erebe brite$ stack install

会显示：

...

Installing executable(s) in
/Users/brite/wstunnel-by-erebe/.stack-work/install/x86_64-osx/lts-9.9/8.0.2/bin
Registering wstunnel-0.1.0.0...
Completed 3 action(s).
Copying from /Users/brite/wstunnel-by-erebe/.stack-work/install/x86_64-osx/lts-9.9/8.0.2/bin/wstunnel to /Users/brite/.local/bin/wstunnel

Copied executables to /Users/brite/.local/bin:
- wstunnel
yudeMacBook-Air:wstunnel-by-erebe brite$ which wstunnel
/Users/brite/.local/bin//wstunnel
yudeMacBook-Air:wstunnel-by-erebe brite$ mv /Users/brite/.local/bin//wstunnel /Users/brite/.local/bin//wstunnel-by-erebe

(因为存在stack.yaml，于是可以运行stack install来安装这个wstunnel程序.安装后，

得到的可执行文件为~/.local/bin/wstunnel)





然后就可直接运行wstunnel程序了：wstunnel-by-erebe -h


在本地机器上，运行
wstunnel-by-erebe -D 8888 ws://vps-public-ip:448是没有用的，因为服务器上，运行的命令是：
./wstunnel-by-erebe --server ws://127.0.0.1:448 而非：
./wstunnel-by-erebe --server ws://0.0.0.0:448
这意味着：只有vps上的程序能够连接wstunnel-by-erebe，外部ip是不允许连接wstunnel-by-erebe的。
不过我们可以在本地机器访问服务器上的nginx,然后再由服务器上的nginx去连接（反向代理）http://127.0.0.1:448
具体就是在nginx的配置文件中加上一个server段如下：

server {

listen 3151 ssl;

server_name mydomain.com;

location / {

proxy_pass http://127.0.0.1:448;

        proxy_set_header Host    $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

    }

ssl on;

ssl_certificate /root/.acme.sh/mydomain.com/fullchain.cer;

ssl_certificate_key /root/.acme.sh/mydomain.com/mydomain.com.key;

ssl_session_timeout 5m;

}




然后重启nginx.




然后在本地机器上，运行：

wstunnel-by-erebe -D 8888 wss://mydomain.com:3151



然后设置本地机器的浏览器的socks5代理服务器为127.0.0.1:8888 ,浏览器即可翻墙。


项目地址：https://github.com/erebe/wstunnel/
类似项目：https://briteming.blogspot.com/2020/05/websocks.html

----------

相关的项目：
https://www.npmjs.com/package/wstunnel
https://www.npmjs.com/package/ws-tunnel