Turn WireGuard into an HTTP Proxy

September 2026 Many VPNs have WireGuard support. With a little configuration, we can use the VPN and all its connections as HTTP proxies, providing us with a large, cost-effective pool of IPs. This article shows how to do this on Linux.

Background: Network Interfaces

You may skip the background info and just follow the setup steps below. Computers have network interfaces. Examples are a Wifi modem / antenna or a physical port to plug in an ethernet cable. There are also virtual interfaces which act like interfaces but are in fact just "make believe". We could for example create an interface that passes traffic to our actual WiFi network interface but doesn't let any advertisements through. A VPN also usually creates such a virtual interface and makes all traffic go through it. In simple terms those VPN interfaces intercept data, modify it and pass it somewhere else. We will create an interface along with special "routing tables" that define which and how traffic flows.

Setup

First make sure your VPN supports Wireguard and export its connections as Wireguard .conf files Here are some guides: - Mullvad
- Proton VPN
- Surf Shark
- A sample file may look like the following.

[Interface]
PrivateKey = ** some private key ** 
Address = 100.8.0.0/32
DNS = 101.4.1.2

[Peer]
PublicKey = ** some public key ** 
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = 87.3.89.19:14824

Under the Interface section we have to add the line

Table = off

This prevents WireGuard from changing the routing tables on your computer automatically. We will need to create those later ourselves, since we don't want all our traffic to go through the interface. Also make sure to remove the DNS setting if present since it will be set globally Name the file myvpn.conf or any other name and place it inside /etc/wireguard/ If the folder does not exist create it and move the conf file there

mkdir -p /etc/wireguard
mv myvpn.conf /etc/wireguard/

Next we need to install the dependencies

sudo apt-get update
sudo apt-get install wireguard tinyproxy

We can now start the WireGuard interface

# 'myvpn' is the filename that we gave the config file prior (myvpn.conf)
sudo wg-quick up myvpn

Because we set Table = off, none of our traffic currently goes through this interface There are multiple ways to let only certain traffic go through. An easy approach is to send all traffic of a certain user through the interface. So when we use that user we are always going through our VPN Let us add a user

sudo useradd --system --no-create-home --shell /usr/sbin/nologin myvpn-user

To get the users unique identifier (uid) run

id -u myvpn-user

Lets assume the uid is 119 We will use this uid to create a routing table for that specific user On the created table we create a rule that routes all traffic through the myvpn interface

sudo ip rule add uidrange "119-119" table 100 
sudo ip route replace default dev "myvpn" table 100

The first command tells Linux to use routing table 100 when deciding where traffic generated by myvpn-user should go. The second command adds a default route to table 100 that sends traffic through the myvpn WireGuard interface. Now, when we make a web request as this user, it goes through the VPN and therefore uses the VPN's public IP address.

# actual ip address
curl https://api.ipify.org/
# vpn ip address
sudo -u myvpn-user curl https://api.ipify.org/

The final question remaining is how can we use this like an HTTP proxy e.g. yourdomain:8083 -> VPN IP 1, yourdomain:8084 -> VPN IP 2, ... A simple approach is to run a proxy like tinyproxy as our new user myvpn-user and it will simply send all arriving traffic through the myvpn interface

User myvpn-user 
Group myvpn-user 
Port 1098 

Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
LogLevel Info
MaxClients 200

MinSpareServers 20 
MaxSpareServers 100
StartServers 30

MaxRequestsPerChild 0

Allow 127.0.0.1
Allow 172.17.0.0/16

ViaProxyName "tinyproxy"

ConnectPort 443
ConnectPort 563

Put the config into /etc/tinyproxy/ Be generous with MaxClients, MinSpareServers, MaxSpareServers and StartServers as browsers may spawn many requests in paralell Now all we have to do is start the proxy as the user we created

sudo -u myvpn-user tinyproxy -d -c /etc/tinyproxy/tinyproxy-001.conf

We can now use the proxy

# VPN IP Address
curl -x http://127.0.0.1:1098 https://api.ipify.org/
# Home IP
curl https://api.ipify.org/

We need to restart WireGuard, set the routes and restart tinyproxy on every reboot. To make this easier I created a simple script that configures the system fully automatic. All you need to do is put the wireguard .conf files in /etc/wireguard. they must be named proxy-xxx.conf where xxx is any number e.g. 015, 101, ... You can download it here