Need help forwarding Wireguard traffic through Shadowsocks

[hizani]

Hey! I want to set up Wireguard obfuscation through Shadowsocks because WG stopped working several days ago due to ISPs in my country starting to block Wireguard and OpenVPN connections to foreign servers.

It should be something like this:

I've tried to set it up following this guide, but it doesn't work for me probably because the author uses -libev version and I'm using the rusty one, so maybe there are mistakes in my adaptation of it's configs.

Here are my configs

VPS

Wireguard

[Interface]
Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = 60207
PrivateKey = <key>
PostUp = iptables -I INPUT -p udp --dport 60207 -j ACCEPT
PostUp = iptables -I FORWARD -i eth0 -o wg0 -j ACCEPT
PostUp = iptables -I FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostUp = ip6tables -I FORWARD -i wg0 -j ACCEPT
PostUp = ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D INPUT -p udp --dport 60207 -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PostDown = ip6tables -D FORWARD -i wg0 -j ACCEPT
PostDown = ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <key>
PresharedKey = <key>
AllowedIPs = 10.66.66.66/32,fd42:42:42::66/128

Shadowsocks

{
    "servers": [
        {
            "server":"0.0.0.0",
            "server_port":8388,
            "password":<password>,
            "timeout":300,
            "method":"chacha20-ietf-poly1305",
            "fast_open":true,
	    "mode": "tcp_and_udp"
        }
    ]
}

Logs

Started Shadowsocks proxy server.
INFO  shadowsocks server 1.17.0 build 2023-10-15T02:31:38.682312905+00:00
INFO  shadowsocks tcp server listening on 0.0.0.0:8388, inbound address 0.0.0.0:8388
INFO  shadowsocks udp server listening on 0.0.0.0:8388, inbound address 0.0.0.0:8388

Local Client

Wireguard

[Interface]
PrivateKey = <key>
Address = 10.66.66.66/32,fd42:42:42::66/128
DNS = 10.66.66.10,1.1.1.1,1.0.0.1

[Peer]
PublicKey = <key>
PresharedKey = <key>
Endpoint = 127.0.0.1:1081
AllowedIPs = 0.0.0.0/0,::/0

Shadowsocks

{
    "servers": [
        {
	    "server":<VPS IP>,
	    "server_port":8388,
            "method":"chacha20-ietf-poly1305",
    	    "password":<password>,
    	    "timeout":300,
    	    "fast_open":true
	}
    ],
    "locals": [
        {
	    "protocol": "tunnel",
            "local_address": "127.0.0.1",
    	    "local_port":1081,
    	    "mode":"udp_only",
	    "forward_address":<VPS IP>,,
	    "forward_port":60207
        },
        {
            "local_address": "127.0.0.1",
    	    "local_port":1080
        }
    ]
}

(Default connection by 1080 port without Wireguard works fine)

Logs

Started Shadowsocks-Rust Client Service.
INFO  shadowsocks local 1.17.1 build 2023-11-28T14:22:38.311607013+00:00
INFO  shadowsocks socks TCP listening on 127.0.0.1:1080
INFO  shadowsocks UDP tunnel listening on 127.0.0.1:1081

---

When I enable Wireguard on my local PC I can't ping any IP, and logs show no errors.

Are there any mistakes in my configs?

[gnartS]

Not that useful but i have an identical problem.
Wireguard works standalone between client and server
Shadowsocks works standalone as a proxy between client and server
Wireguard shows connected but receives no packets even with the server IP sent through default gateway and added into the excluded ip list.

[Su-Du]

I have the same needs as you. Have you implemented this feature?

[hizani]

No, I haven't managed to get it working. I've also tried to use sing-shadowsocks implementation with Xray suite, but it didn't work for me ether.

[gnartS]

Nope. I tried for 2-3 weeks for a long time and completely failed to ever get it working on any platform so essentially gave up.