[erebe__]

Shameless plug, you can use wstunnel which disguise your traffic as websocket to tunnel any traffic you want. I had most success with it, as it uses TCP, than with QUIC/HTTP3 as usually UDP is more heavily restricted. It works behind GFW and let you use your wireguard for example... I had also good feedback from people in Turkey and Iran

wstunnel: https://github.com/erebe/wstunnel

[PlutoIsAPlanet]

Isn't UDP over TCP a generally bad idea?

[g1sm]

As far as I know, TCP over TCP is less than ideal. I don’t see why UDP over TCP (or the other way around) would be bad.

[fragmede]

Packet size is dependent on the MTU, so practically speaking you're trying to put something 1460 bytes into a 1460 byte container and the only way for that to fit is the split the packet or tell the packet generator to make smaller packets. both of which are reasonable options but they're not the most efficient, leading to slower connections when tunneling one inside the other. It's less of a deal theses days, but that's the why of it.

[g1sm]

Well, sure, but then any kind of encapsulation is less than ideal. However, here the context is VPNs and this means there’s always going to be some sort of encapsulation. And if the choices are between encapsulating something in TCP and encapsulating something in UDP, the latter should always be chosen.

[erebe__]

I use the word tunnel but it would be more correct to use "proxy"

There is no wrappring of udp packet into another layer of TCP. Wstunnel unpack the data at the client forward it using tcp/websocket, and after re-take this data to put it back into its original form (i.e: udp)

so there is no encapsulation of many protocol.

The only place where there is encapsulation, is for tls. if your client use tls to connect to wstunnel server. And that your data is already encrypted with tls (i.e: https) there will be 2 tls encryption