vpn2proxy
Read the docsStart free

Self-hosted VPN appliance · one container

SOCKS5 in.WireGuard out.

vpn2proxy wraps the HTTP and SOCKS5 proxies you already pay for in real, leak-proof WireGuard and OpenVPN servers. Run one container, hand out a QR code, and every app on any phone or laptop exits through your proxy — operating-system wide.

Start tunnelingSee how it works
  • Kill-switch by construction
  • UDP fail-closed, DNS in-tunnel
  • Per-device exit pinning
chain: live
client → wg :51820 → socks5 → internet
Your devices

stock WG / OVPN apps

phonelaptoptablet
vpn2proxyyou run this
wg :51820ovpn :51821
tunneled1.214 GiB
blocked at wall0 pkt
leaked0 pkt
fail-closed: armed
residential exit

sox5://resi-us-01

auth okudp: fail-closed
exit ip 138.226.88.247
Internet

your traffic, your exit ip

Exits through the proxies you already pay for

01 — How it works

Three commands between
a proxy and a VPN.

No agents, no sidecars, no rewriting your network. vpn2proxy renders a sing-box configuration from a small YAML file, probes every upstream, and supervises both VPN servers as one process.

  1. 01

    Point it at your proxies

    Add each upstream once — server, port, credentials, type. Anything that speaks SOCKS5 or HTTP CONNECT.

    vpn2proxy.yaml
    upstreams:
  - name: resi-us-01
    server: p.webshare.io
    port: 1080
    username: ab12cd-1
    password: "••••••••"
  2. 02

    Run one process

    It probes UDP ASSOCIATE support, picks the safe DNS shape, writes the sing-box config and brings up both servers — unprivileged.

    shell
    $ vpn2proxy check
  resi-us-01 socks5 ok udp: unsupported → fail-closed
$ sudo vpn2proxy run
  ✔ wg :51820   ✔ ovpn :51821   ✔ metrics :9091
  3. 03

    Connect anything

    Export a profile or a QR code. Stock WireGuard and OpenVPN apps just work — pinned to the exit you choose.

    shell
    $ vpn2proxy wg export phone --qr
  ▄▄▄▄▄▄▄ ▄▄ ▄▄▄▄▄▄▄
  ▐ ▄▄▄ ▐▐▐▐ ▐ ▄▄▄ ▐   state/export/phone.conf
  ▐ ███ ▐▐▐▐ ▐ ███ ▐   exit: resi-us-01
  ▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀
02 — The promotion

A proxy is a suggestion.
A VPN is a law.

A proxy is an address your applications have to remember to respect. A VPN is an interface your operating system can't route around.

before

A proxy

an address:port, per application

  • Configured app by app, forever
  • Invisible to most mobile apps
  • No OS-wide encryption
  • One misconfigured app leaks around it
  • UDP and DNS quietly bypass it
after

A VPN

one interface, everything routed

  • Every app, every port, zero config
  • First-class on iOS, Android, macOS, Windows, Linux
  • WireGuard / OpenVPN encryption end to end
  • Kill-switch — no route exists around the proxy
  • DNS resolved inside the tunnel, over DoH
03 — Under the hood

Built like an appliance.
Not like a script.

kill-switch

No route exists that bypasses the proxy

The generated config contains no direct outbound. Hung upstream? Traffic times out inside the tunnel. Verified with packet capture: zero packets reach the WAN.

0
packets escaped
hung-upstream capture
udp policy

Probe, then fail closed

Every upstream is asked for UDP ASSOCIATE. If it says no, UDP is rejected — never leaked.

probing udp associate…
unsupported → reject rule
dns hijacked → doh in-chain
shape locked: tcp-only
exit pinning

Every device, its own exit

Pin a peer to a specific proxy. Stable /32 per device makes per-peer accounting exact.

phonesox5 · us-01
laptopsox5 · de-02
tabletovpn · us1
observability

Per-peer, per-proxy counters

Prometheus on loopback. Watch every device and every upstream, in real time.

wg:phone4.18 GiB
deployment

One file. One process. One port per endpoint.

Ship it as a single container or a hardened systemd unit. No TUN device, no new privileges, no capability dance — the dataplane runs in userspace.

  • docker
  • systemd
  • any VPS
  • a box at home
  • IPv4
shell
$ docker run --rm -it \
    -p 51820:51820/udp \
    -v ./vpn2proxy.yaml:/etc/vpn2proxy/vpn2proxy.yaml \
    ghcr.io/vpn2proxy/vpn2proxy
  ✔ supervisor up   unprivileged
no lock-in

Swap providers. Keep the profiles.

Change the upstream in YAML and reload. Clients never re-import anything — the tunnel just starts exiting somewhere new.

beforeresi-us-01
afterresi-nl-07✔ reload, 0 re-provisioning
clients

Nothing to install that you don't have

Profiles are standard .conf and embedded .ovpn files. Ship a QR code and you're done.

iOSAndroidmacOSWindowsLinuxrouter

Measured, not promised — from the test harness

0

packets on the WAN with a hung upstream, asserted via payload markers and tcpdump

0.0MB/s

through a residential exit — line rate for the reference provider, no drops

~0s

supervisor respawn after a kill -9, with counters monotonic across the restart

0/20

soak probes passing — the two misses are the injected fault window, by design

04 — The stack

Engineered on
sing-box, pinned.

The dataplane is a pinned sing-box release, executed as a child process and never linked. That means an audited engine, an MIT wrapper, and a version you can hold still.

  • WireGuard + OpenVPN serversIn-process endpoints, stock clients, UDP transport for OpenVPN.
  • Control plane in PythonConfig generation, probes, PKI, keygen, supervision, counters.
  • Supervision, not hopeThree-layer health checks, capped backoff restarts, SIGHUP reload.
vpn2proxy@edge — status
$
up 14d 06hsing-box okclash api okrestarts 0
UPSTREAMS
resi-us-01healthyudp fail-closed1.8 GiB
resi-de-02healthyudp fail-closed912 MiB
PEERS
phonewg 10.200.0.2exit resi-us-011.2 GiB
laptopwg 10.200.0.3exit resi-de-02640 MiB
tabletovpn us1exit default118 MiB
$
05 — Pricing

Bring your own proxies.
We'll bring the tunnel.

Proxy bandwidth stays on your provider's bill. vpn2proxy charges for the appliance, not the traffic.

Solo
$0/forever

For one box, one lab, one experiment.

  • 1 upstream proxy
  • 3 devices
  • WireGuard + OpenVPN
  • Kill-switch, fail-closed UDP
  • Community support
Start self-hosting
most popular
Pro
$12/month

For people whose proxies are infrastructure.

  • 10 upstreams, hot reload
  • 25 devices, per-peer exit pinning
  • Per-endpoint OpenVPN exits
  • Prometheus metrics + alerts
  • Priority support, upgrade assistance
Start free trial
Fleet
$49/month

For teams running exits as a shared utility.

  • Unlimited upstreams and devices
  • SSO + audit log
  • Fleet config push & drift detection
  • Long-term soak reporting
  • Named engineer on call
Talk to us
06 — FAQ

Straight answers.

Do my proxies need to support UDP?

No. At config time vpn2proxy asks each upstream for UDP ASSOCIATE. If it can't, UDP is rejected fail-closed — never leaked — and DNS is resolved inside the chain over DoH. TCP keeps working normally. If your provider does support UDP, it's forwarded in-chain.

Does my traffic pass through you?

No. vpn2proxy is software that runs on your host. Clients connect to your machine, which forwards through your proxy provider. There is no vpn2proxy cloud in the path.

Which clients work?

Stock WireGuard and OpenVPN clients — the ones already on your phone and laptop. WireGuard peers get standard .conf files (plus a QR code), OpenVPN users get .ovpn profiles with CA, certificate, key and tls-crypt embedded.

What do I need to run it?

Any Linux box with a public address and an open UDP port — a $5 VPS, a container, a machine at home. It runs unprivileged with no TUN device and no added capabilities. IPv4 in v1.

Can I switch proxy providers without touching devices?

Yes. Edit the upstream in YAML and run vpn2proxy reload. The servers regenerate and restart without dropping state; clients keep their existing profiles and simply start exiting somewhere new.

What about HTTP proxies?

HTTP CONNECT upstreams are supported. Because HTTP proxies cannot carry UDP, an HTTP upstream forces the fail-closed shape for all UDP — TCP and DNS-over-HTTPS still flow.

07 — Get started

Give your proxies
a promotion.

Free for one upstream and three devices. Bring the proxies; we'll bring the tunnel.

Start free

No credit card · kill-switch on by default · cancel anytime