Proxylity UDP Gateway Adds Open WireGuard Endpoints and Async Lambda Support

Proxylity has introduced two significant updates to its UDP Gateway: Open WireGuard Endpoints and asynchronous Lambda invocation. These features enable the creation of public-facing, event-driven services that leverage encrypted transport without the traditional overhead of strict peer management.

According to Proxylity, the new 'AllowUnknownPeers' property enables WireGuard Listeners to complete handshakes with any valid client. This removes the previous requirement to pre-list public keys within CloudFormation templates, effectively allowing the gateway to accept connections from any client. To maintain security, the company noted that a shared credential gate can be implemented via the 'UnknownPeerPreSharedKey' property, which forces unknown peers to provide a specific pre-shared key (PSK) before they can connect.

The Shift to Serverless Async

Alongside the connectivity updates, Proxylity introduced the 'UseAsyncInvoke' argument for Lambda destinations. This setting shifts the invocation mode from 'RequestResponse' (synchronous) to 'Event' (asynchronous). In this mode, the UDP Gateway triggers the Lambda function and immediately moves on without waiting for a response; consequently, no reply is sent back to the original UDP client.

Proxylity stated that this asynchronous invocation is specifically designed to trigger durable workloads. This includes Lambda durable functions or AWS Step Functions state machines, both of which can run for extended periods without timing out the initial UDP request.

Reducing Operational Overhead

Traditionally, WireGuard has operated on a strict 1:1 mapping of public keys between peers and servers. While secure, this architecture creates scaling challenges for public services or dynamic fleets of IoT devices, where managing thousands of individual keys becomes an operational burden.

By allowing unknown peers, Proxylity is moving toward a "web-like" model for WireGuard. In this framework, the encrypted transport layer is established first, while identity and authentication are handled at the application layer. This shift reduces the friction of device provisioning and allows developers to build public-facing UDP services that trigger complex, fault-tolerant backend workflows without maintaining persistent, stateful connections.

Future Implications

These updates position the UDP Gateway as a bridge between the rigid security of WireGuard and the flexibility of AWS serverless components. By decoupling the transport handshake from the identity management process, Proxylity enables a more scalable approach to encrypted UDP traffic.

Industry observers will likely watch how these features are adopted in IoT and telemetry sectors, where the ability to trigger long-running state machines via a lightweight, encrypted UDP packet offers a more efficient alternative to traditional HTTPS polling or persistent TCP sockets.