# sandialabs/wiretap

Wiretap is a transparent, VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.

Repository: https://github.com/sandialabs/wiretap
Canonical: https://ross.abutalabs.com/products/wiretap
Language: Go
License: NOASSERTION
License Family: other
Topics: golang, infosec, proxy, snl-cyber-sec, tunnel, vpn, wireguard, scr-2819, snl-applications
Last push: 2026-07-30T19:07:41+00:00

## Health v2 (maintenance only)
Score: 78/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 95, release rhythm 44, longevity 98
- inputs: {"age_days": 1384, "days_push": 34, "days_rel": 212, "gap_med": 90.5, "n_releases_24m": 7}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1107, forks 46 (observed 2026-08-28T04:03:36.740351+00:00)

## What it is
Wiretap is a transparent, VPN-like proxy server written in Go that tunnels traffic through WireGuard without requiring special privileges on the server side. It lets a client reach remote networks as if local, with support for chaining servers and port forwarding.

## Use cases
- tunnel traffic through a remote network without root on the server
- pivot into an internal network during a penetration test
- create a VPN-like connection using only a userspace binary
- chain multiple servers to reach nested networks
- share network access with teammates via WireGuard configs
- port forward services from a remote network to local machine

## When to choose
- you need VPN-style network access but lack admin/root privileges on the target machine
- you want transparent routing of a subnet through a remote host
- you need to chain pivots across multiple networks
- you prefer WireGuard-based tunneling with minimal setup

## When to avoid
- you need a full-featured production VPN for an organization
- you cannot install WireGuard on the client machine
- you only need simple SOCKS/HTTP proxying without network-level routing
- your environment blocks bidirectional UDP traffic

## Facets
- artifact type: cli-tool
- maturity: active
- function: proxy, vpn, networking, security, cli
- domain: networking, security, developer-tools
- platform: windows, cross-platform, go
- tags: wireguard, tunneling, transparent-proxy, privilege-escalation, infosec, red-team, pivot, command-line, linux, macos

## Member repositories
- sandialabs/wiretap (main) score 78

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:36.740351+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:44:05.442880+00:00, confidence not recorded.
  - readme: https://github.com/sandialabs/wiretap (fetched 2026-08-28T04:03:36.740351+00:00, sha baca9edfdb40)
- Data as of 2026-08-30T08:39:29.467469+00:00.