WireGuard
The agent can expose a virtual WireGuard endpoint for TCP, UDP, and ICMP traffic without relying on a SOCKS proxy. The client creates the local TUN interface and carries its traffic through the existing agent connection.
Quick usage
- Set
wg-enabled: truein the agent configuration. - Start the agent and wait for it to register.
- Generate and start the client-side interface by following Client WireGuard.
How it works
Each agent receives a private WireGuard endpoint implemented with the gVisor network stack. The endpoint is reached through the existing agent connection; it does not expose a new network listener on the target.
WireGuard datagrams are carried over the SSH data connection. This UDP-over-TCP encapsulation can reduce performance compared with native WireGuard, but allows it to work over Goauld’s supported transports.
Limitations
The agent runs without privileges and cannot forward raw packets required by features such as Nmap SYN scans.
When using Nmap, use nmap --unprivileged for TCP connect scans. Where ICMP echo is supported, nmap -PE can be used for host discovery instead of SYN probes.
Options
WireGuard is disabled by default.
--wg-enabled: enable the WireGuard endpoint.--wg-port: virtual remote port assigned to the endpoint. The default0selects a random port.