Features
| Pricing | Documentation | Contact | Blog
Features
| Pricing | Documentation | Contact | Blog
WireGuard Listeners are specialized Listeners that implement the WireGuard encryption protocol, providing secure, authenticated communication channels between your clients and AWS resources. Unlike standard UDP Listeners that forward raw packets, WireGuard Listeners handle the WireGuard handshake and transport encryption, then deliver the unencapsulated payload data to your configured destinations.
WireGuard is a modern, high-performance encryption protocol that uses state-of-the-art cryptography. Originally developed for the Linux kernel and commonly used for VPN implementations, WireGuard is now available across all major platforms including Windows, macOS, iOS, and Android. It's designed to be simpler, faster, and more secure than traditional protocols like OpenVPN or IPSec.
Key advantages of WireGuard include:
When you create a WireGuard Listener, Proxylity provides the same infrastructure benefits as standard Listeners while adding WireGuard protocol support:
WireGuard Listeners establish encrypted connections with authenticated clients and forward the decrypted payload data to your configured Destinations. This allows you to process the actual application data rather than encrypted WireGuard packets. Whether that payload is raw application data from custom clients or encapsulated IP packets from WireGuard VPN clients is entirely up to your implementation.
| Feature | UDP Listeners | WireGuard Listeners |
|---|---|---|
| Security | Transport-level (client must implement encryption) | End-to-end encrypted with authentication |
| Client Setup | Simple socket connection | WireGuard client configuration required |
| Protocol Support | UDP packets only | Any payload data (encrypted via WireGuard) |
| NAT Traversal | Client responsibility | Built-in NAT traversal and roaming |
| Use Cases | IoT telemetry, gaming, real-time data | Secure custom protocols, encrypted data channels |
WireGuard listeners in Proxylity UDP Gateway provide encrypted communication channels using the WireGuard protocol. The system automatically generates WireGuard keys and handles peer authentication.
WireGuardListener:
Type: Custom::ProxylityUdpGatewayListener
Properties:
Name: my-wireguard-listener
Description: "WireGuard encrypted endpoint"
...
Protocols:
- "wg"
Peers:
- PublicKey: "client1_base64_public_key_here"
AllowedIPs:
- "10.0.0.2/32"
- "10.0.1.0/24"
- PublicKey: "client2_base64_public_key_here"
AllowedIPs:
- "10.0.0.3/32"
SharedSecret: "optional_base64_shared_secret"
ClientRestrictions:
Networks:
- "203.0.113.0/24"
- "198.51.100.0/24"
Destinations:
- Name: wireguard-handler
DestinationArn: !GetAtt WireGuardLambda.Arn
Role:
Arn: !GetAtt ProxylityRole.Arn
Batching:
Count: 10
TimeoutInSeconds: 0.5"wg" for WireGuard listenersThe listener automatically generates a WireGuard key pair. Access the public key using CloudFormation attributes:
Outputs:
WireGuardServerPublicKey:
Description: "WireGuard server public key for client configuration"
Value: !GetAtt WireGuardListener.WireGuardPublicKey
Export:
Name: !Sub "${AWS::StackName}-WireGuardPublicKey"WireGuard Listeners can work with different types of clients:
You can build custom applications that use the WireGuard encryption protocol to send arbitrary payload data securely. These applications would handle the WireGuard handshake and encryption, then send your custom data format through the encrypted channel.
Standard WireGuard VPN clients can also connect to WireGuard Listeners. In this case, the clients send encapsulated IP packets, and your destinations receive the inner IP packet data. You can then process these packets according to your application's needs - you might extract HTTP requests, DNS queries, or any other IP-based protocol.
Once your WireGuard Listener is configured, here's how to set up various types of clients:
If you're using standard WireGuard VPN clients, they use a simple INI-style configuration format:
[Interface]
PrivateKey = CLIENT_PRIVATE_KEY_HERE
Address = 10.0.0.2/32
[Peer]
PublicKey = LISTENER_PUBLIC_KEY_HERE
Endpoint = your-listener.proxylity.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25wg genkey)# Install WireGuard
sudo apt update && sudo apt install wireguard
# Save configuration to /etc/wireguard/proxylity.conf
sudo wg-quick up proxylity
# Auto-start on boot
sudo systemctl enable wg-quick@proxylityUse the official WireGuard VPN applications:
When a client sends data through a WireGuard connection:
WireGuard Listeners support the same Destinations as UDP Listeners, but with additional context:
If you're using WireGuard VPN clients, your destinations will receive the inner IP packet data. You can then parse and process these packets according to your application's needs - extracting HTTP requests, DNS queries, or any other protocol data you need.
WireGuard Listeners provide robust security, but proper configuration is essential:
wg genkeyWireGuard Listeners support the same Client Restrictions as other Listeners, applying to the outer WireGuard protocol traffic. Additional security is provided by:
Build applications that need encrypted, authenticated communication:
Leverage WireGuard's encryption for secure data transmission:
If you do need VPN capabilities, you can implement them selectively:
WireGuard Listeners provide excellent performance characteristics:
Monitor your WireGuard Listeners through:
Like all Listeners, WireGuard Listeners can be managed through:
Use AWS CloudFormation with Proxylity's custom resource types. WireGuard-specific parameters include:
The Proxylity Dashboard provides WireGuard-specific management features:
WireGuard Listeners offer a different approach compared to traditional VPN solutions:
If you're considering migrating from UDP Listeners to WireGuard Listeners:
Both approaches can coexist, allowing gradual migration or hybrid deployments. You might use UDP Listeners for high-frequency, low-latency data where encryption isn't critical, and WireGuard Listeners for sensitive or authenticated communication channels.