Simple TCP over Websocket tunneling

Some crappy networks only allow HTTP(S). This small program allows you to tunnel anything in HTTP(S).

Note that the URL path is always /, the server does not support SSL/TLS out of the box and there is one remote TCP address per instance. This is done on purpose as this program is intended to be run behind a reverse proxy.

Having a working Golang environment:

go install github.com/trazfr/tcp-over-websocket@latest

The server listens for Websocket inbound connections. Each time a client is connected, the server opens a new TCP connection to the remote service.

Example: ssh to github

# on server example.org
tcp-over-websocket server -listen_ws :8080 -remote_tcp github.com:22

The client opens a TCP connection and creates a Websocket connection toward a tcp-over-websocket server each time a TCP connection is accepted.

Example: open a tunnel to the server

# on the client, target the previous server on example.org
tcp-over-websocket client -listen_tcp :1234 -remote_ws ws://example.org:8080/

To use the tunnel, one may only run ssh -p 1234 127.0.0.1 on the client.

tcp-over-websocket does not support SSL/TLS on server side. To be able to host a website and several tunnel servers at the same place, one may configure an HTTP reverse proxy.

Let's assume we want to serve the previous server on SSL/TLS on the URL wss://example.org/github-ssh/.

Using a similar configuration, one NGINX instance may be the reverse proxy for several tunnels for different services by changing the URL.

NGINX configuration extract:

http {
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    server {
        listen 443 ssl default_server;
        listen [::]:443 default_server ipv6only=on ssl;
        server_name example.org;
        // put here the SSL/TLS configuration

        location = /github-ssh/ {
            limit_except GET {
                deny all;
            }
            // for "tcp-over-websocket server-listen_ws 127.0.0.1:8080 -remote_tcp github.com:22"
            proxy_pass http://127.0.0.1:8080/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }
        // TODO configure different locations to different instances of tcp-over-websocket
    }
}

To connect from the client, the command is like this:

tcp-over-websocket client -listen_tcp :1234 -remote_ws wss://example.org/github-ssh/

The tcp-over-websocket server hosts a Prometheus service. It only exposes some basic metrics.

curl http://example.org:8080/metrics