UDP Relay Infrastructure Open Source • Rust / Linux

WireRelay: Bounded, Payload-Opaque UDP Relay

A high-performance, resource-bounded UDP relay designed specifically for WireGuard and AmneziaWG infrastructure. Forwards datagrams unchanged to fixed remote backends with strict session tracking, automatic DNS refresh, transactional configuration reloads, and systemd integration.

Download WireRelay → View on GitHub ← All Tools & Ecosystem
Primary Target: WireGuard • AmneziaWG • Custom UDP
Forwarding Mode: Payload-Opaque (Non-TPROXY)
Deployment: Linux systemd • Rust 1.85+ • Pre-1.0
Architecture & Scope

Deterministic UDP Relaying Architecture

WireRelay acts as an explicit, high-efficiency endpoint relay. It is not an iptables TPROXY or NAT router; rather, it binds dedicated UDP listening sockets and maintains isolated, bounded session state tables between clients and fixed upstream servers.

FORWARDING ARCHITECTURE

Bounded Non-TPROXY UDP Forwarding Path

Rust • Non-TPROXY UDP Relay • Fixed 1:1 Listener Mapping
WireRelay Bounded Non-TPROXY UDP Forwarding Path Diagram showing client datagrams entering dedicated UDP listener sockets, processed through bounded session tables with inactivity timers and DNS refresh, and relayed directly to designated upstream endpoints. CLIENT INGRESS Inbound Datagrams UDP / VPN Peering WireGuard Clients Standard handshake & data AmneziaWG Peers Obfuscated packet headers Site-to-Site Routers Branch office tunnels ISOLATED SOCKETS Dedicated Listeners 1:1 Fixed Target Mapping Dedicated Port Binding Zero open relay risks Dynamic DNS Tracking Automatic backend IP refresh Payload-Opaque Relay Byte-for-byte forwarding STATE MANAGEMENT Session State Table Strict Memory Boundaries Session Slot Limits Hard cap on active peers Inactivity Expiry Cleans idle session table rows Bidirectional NAT Deterministic reply routing UPSTREAM EGRESS Backend Server Target Endpoint VPN Server WireGuard / AWG Cloud Gateway Remote cloud host Protected LAN Isolated intranet
Deterministic Forwarding: WireRelay maintains isolated, dedicated UDP listener sockets that forward traffic to predetermined upstream backends without requiring TPROXY or kernel NAT routing. Incoming datagrams are relayed with payload bytes untouched while sessions are managed under strict concurrency limits and inactivity timeouts.

Fixed Backend per Listener

Each listener maps to exactly one predetermined upstream endpoint. Eliminates open-relay vulnerabilities and ensures all ingress packets travel strictly to trusted VPN servers.

Payload-Opaque Forwarding

Forwards datagrams without inspecting or modifying payload bytes. Preserves cryptographic integrity, protocol signatures, and obfuscation parameters untouched.

Strict Resource Bounds

Defines explicit per-listener maximum concurrent session limits and inactivity timeouts. Protects edge relay hosts against memory exhaustion and stale session bloat.

Dynamic DNS Refresh

Asynchronously monitors upstream hostnames and updates backend IP endpoints without dropping active listener state when cloud VPN servers change addresses.

Transactional Reload

Supports atomic configuration validation (--check) and live reload via signals, allowing listener additions and timeout adjustments without restarting the daemon.

Prometheus Telemetry

Exposes standard Prometheus metrics tracking packet rates, active session counts, byte counters, and error counters for production observability.

Deployment

Installing & Running WireRelay

Deploy as a standalone binary or configure as a managed systemd service:

Linux Terminal Configuration

# 1. Automated installation via privileged installer script:

curl -fsSL https://raw.githubusercontent.com/wiresock/wire-relay/main/wire-relay-install.sh | sudo bash


# 2. Example configuration: /etc/wirerelay/wirerelay.toml

[listeners.wg_main]

listen = "0.0.0.0:51820"

backend = "vpn.internal.example.com:51820"

max_sessions = 1000

session_timeout_seconds = 180


# 3. Verify configuration syntax

wirerelay --check /etc/wirerelay/wirerelay.toml


# 4. Manage systemd service

sudo systemctl start wirerelay

View WireRelay Repository on GitHub →