UDP Relay Infrastructure Open Source • Rust / Linux

WireRelay: Bounded, Payload-Opaque UDP Relay

A high-performance, resource-bounded UDP relay designed specifically for WireGuard and AmneziaWG infrastructure. Forwards datagrams unchanged to fixed remote backends with strict session tracking, automatic DNS refresh, transactional configuration reloads, and systemd integration.

Download WireRelay → View on GitHub ← All Tools & Ecosystem
Primary Target: WireGuard • AmneziaWG • Custom UDP
Forwarding Mode: Payload-Opaque (Non-TPROXY)
Deployment: Linux systemd • Rust 1.85+ • Pre-1.0
Architecture & Scope

Deterministic UDP Relaying Architecture

WireRelay acts as an explicit, high-efficiency endpoint relay. It is not an iptables TPROXY or NAT router; rather, it binds dedicated UDP listening sockets and maintains isolated, bounded session state tables between clients and fixed upstream servers.

FORWARDING ARCHITECTURE

Bounded Non-TPROXY UDP Forwarding Path

Rust • Non-TPROXY UDP Relay • Fixed 1:1 Listener Mapping
WireRelay Bounded Non-TPROXY UDP Forwarding Path Diagram showing client datagrams entering dedicated UDP listener sockets, processed through bounded session tables with inactivity timers and DNS refresh, and relayed directly to designated upstream endpoints. CLIENT INGRESS Inbound Datagrams UDP / VPN Peering WireGuard Clients Standard handshake & data AmneziaWG Peers Obfuscated packet headers Site-to-Site Routers Branch office tunnels ISOLATED SOCKETS Dedicated Listeners 1:1 Fixed Target Mapping Dedicated Port Binding Fixed backend per listener Dynamic DNS Tracking Automatic backend IP refresh Payload-Opaque Relay Byte-for-byte forwarding STATE MANAGEMENT Session State Table Strict Memory Boundaries Session Slot Limits Hard cap on active peers Inactivity Expiry Cleans idle session table rows Upstream UDP Sockets Deterministic reply routing UPSTREAM EGRESS Backend Server Target Endpoint VPN Server WireGuard / AWG Cloud Gateway Remote cloud host Protected LAN Isolated intranet
Deterministic Forwarding: WireRelay maintains isolated, dedicated UDP listener sockets that forward traffic to predetermined upstream backends without requiring TPROXY or kernel NAT routing. Incoming datagrams are relayed with payload bytes untouched while sessions are managed under strict concurrency limits and inactivity timeouts.

Fixed Backend per Listener

Each listener maps to one configured upstream endpoint, so clients cannot select arbitrary destinations. Relay clients are not authenticated; use firewall or source filtering when access must be restricted.

Payload-Opaque Forwarding

Forwards datagrams without inspecting or modifying payload bytes. Preserves cryptographic integrity, protocol signatures, and obfuscation parameters untouched.

Strict Resource Bounds

Defines global and per-source-IP session limits, a new-session rate limit, bounded queues, and idle expiration. Size these limits against the host's memory and file-descriptor budget.

Dynamic DNS Refresh

Asynchronously monitors upstream hostnames and updates backend IP endpoints without dropping active listener state when cloud VPN servers change addresses.

Transactional Reload

Validates candidate configuration with check-config and reloads through wire-relay reload. Unchanged listeners and sessions are preserved; listener additions and timeout adjustments can be applied without restarting the daemon.

Prometheus Telemetry

Exposes standard Prometheus metrics tracking packet rates, active session counts, byte counters, and error counters for production observability.

Deployment

Installing & Running WireRelay

Deploy as a standalone binary or configure as a managed systemd service:

Linux Terminal Configuration

# 1. Automated installation via privileged installer script:

curl -fsSL https://raw.githubusercontent.com/wiresock/wire-relay/main/wire-relay-install.sh | sudo bash


# 2. Example configuration: /etc/wire-relay/config.toml

[service]

max_sessions = 1000

idle_timeout = "180s"


[[listeners]]

name = "wg_main"

bind = "0.0.0.0:51820"

backend = "vpn.internal.example.com:51820"


# 3. Verify configuration syntax

wire-relay check-config --config /etc/wire-relay/config.toml


# 4. Manage systemd service

sudo systemctl start wire-relay

View WireRelay Repository on GitHub →