gutd v2 — WireGuard Traffic Obfuscator (TC/XDP eBPF)

Benchmark: gutd vs wg-obfuscator

gutd v2 transparently obfuscates WireGuard UDP traffic using a Linux TC/XDP eBPF datapath. On egress it wraps each packet in a fake QUIC Long Header with a fake SNI, adds variable padding and masks the payload with a ChaCha keystream. On ingress the XDP program strips the QUIC emulation and unmasks the packet before the kernel stack sees it. WireGuard is completely unaware of gutd. A pure userspace mode (dual-thread, wire-compatible with eBPF path) is available for older kernels, unprivileged containers, MikroTik RouterOS, and Windows.

Features

• Fake QUIC Long Header encapsulation to mimic typical HTTPS/QUIC traffic
• Optional obfs=noise mode — masks QUIC signatures so packets look like random UDP
• Built-in lightweight HTTP/3 (QUIC) responder at the XDP layer to mock DPI active probes
• WireGuard payload masking with ChaCha (4 rounds by default)
• TC egress hook on a veth pair, XDP ingress hook on the physical NIC
• Port striping: multiple fixed UDP ports per peer
• Keepalive probabilistic drop to suppress WireGuard timing patterns
• Variable padding to obscure packet sizes
• Hot reload via SIGHUP (BPF map update, no restart)
• Pure userspace fallback mode (zero eBPF requirements, ~500 Mbps capable)
• Cross-platform: Linux (eBPF + userspace), Windows (userspace), RouterOS (userspace)
• Multi-peer support (one veth pair + BPF program per peer)
• Static musl build, zero OS dependencies — runs in empty scratch containers
• IPv4 and IPv6 outer transport
• Dynamic peer endpoint learning for clients behind NAT (peer_ip = dynamic)
• Stats via gutd status or SIGUSR1 signal

Quick Start

Generate a shared key and create a minimal config on both peers:

gutd genkey          # → prints 256-bit hex key

# /etc/gutd/gutd.conf  (Linux)
# C:\ProgramData\gutd\gutd.conf  (Windows)
[peer]
peer_ip    = 203.0.113.10    # remote peer public IP
ports      = 41000
key        = <output of gutd genkey>

Running

# eBPF mode (default on Linux, requires root and kernel ≥ 5.2)
sudo ./gutd /etc/gutd/gutd.conf

# Pure userspace mode (Linux — no eBPF, no root with capabilities)
GUTD_USERSPACE=1 ./gutd /etc/gutd/gutd.conf

# Windows (always userspace, run as Administrator for install)
gutd.exe gutd.conf

# Reload config without restart (Linux)
sudo kill -HUP $(pgrep gutd)

Build

# Linux (default, with eBPF)
cargo build --release

# Linux static musl binary
./build-musl.sh

# Windows (userspace only, cross-compile from Linux)
cargo build --release --target x86_64-pc-windows-gnu --no-default-features

See BUILD.md for cross-compilation and musl details.

Documentation

License

Dual-licensed: userspace code under MIT, eBPF/kernel code under GPL-2.0-only. See LICENSE.