Proxylity opened WireGuard endpoints to unknown devices on AWS

Why it matters

Proxylity is separating encrypted connectivity from device identity, letting developers onboard unknown WireGuard clients and trigger durable AWS workflows without running UDP servers.

On June 3, Proxylity founder Lee Harding added two capabilities to Proxylity's UDP Gateway: WireGuard endpoints that accept clients without advance registration, and asynchronous delivery from those endpoints into AWS Lambda. The product update gives developers a way to receive encrypted packets from newly provisioned devices and use each packet to start a long-running serverless workflow.

The release is a direct extension of Harding's career running the infrastructure he is now trying to remove. According to Proxylity's About page, he operated a global Wi-Fi platform at Eleven Software that served 9 million daily users and processed more than 10,000 RADIUS-over-UDP transactions per second. Earlier, he built serverless systems at Zapproved using Lambda, S3, SQS and SNS, after spending more than a decade developing performance-sensitive C++ systems at Autodesk.

Those jobs exposed the mismatch behind Proxylity: AWS made it relatively simple to connect HTTP requests to managed compute and storage, while UDP applications still left engineering teams responsible for servers, load balancers, capacity planning and patching. Harding founded the Portland, Oregon company in 2024 to make UDP traffic behave like another serverless event source.

From fixed peers to public enrollment

Proxylity's WireGuard Listeners previously required customers to list every permitted peer's public key in a CloudFormation template. That approach works for a controlled set of machines. It becomes a deployment bottleneck when a mobile application generates a keypair during installation, or when devices create keys on first boot.

The new AllowUnknownPeers property changes that enrollment model. When enabled, Proxylity's WireGuard Listener completes a handshake with a valid client even when the client's public key is absent from the configured peer list. WireGuard still encrypts the connection, but Proxylity no longer treats advance registration as a prerequisite.

Harding wrote in the launch announcement, "The analogy to HTTPS is intentional." A public web server can establish an encrypted TLS connection before it knows the visitor's identity. Proxylity is applying that separation to WireGuard: encryption happens at the network boundary, while the Lambda function or downstream workflow handles identity and authorization.

That distinction matters. Encryption alone does not establish that a device should receive access. Proxylity offers an optional UnknownPeerPreSharedKey for deployments that need a basic gate. Every unknown client must possess the same pre-shared key, while named peers can continue using individual secrets on the same Listener.

Harding describes the shared key accurately as a barrier rather than strong identity. A leaked credential could admit any holder, and rotating it across a large fleet creates its own operational work. Applications serving sensitive devices still need per-device authentication, enrollment records and credential revocation at the application layer.

A UDP packet becomes a workflow trigger

The second feature changes what happens after Proxylity receives a packet. UDP Gateway's Lambda integration had used synchronous RequestResponse invocation, leaving the gateway waiting for the function to finish and using its return value to send packets back to the client.

Setting UseAsyncInvoke switches delivery to Lambda's Event invocation mode. AWS documentation says an asynchronous invocation queues the event and returns a 202 status without waiting for the function's response. In Proxylity's implementation, the gateway can move on immediately, the function's return value is discarded and the originating UDP client receives no reply.

That makes the mode suitable for fire-and-forget workloads. An incoming packet can start a Step Functions state machine or an AWS Lambda durable function, which AWS designed to checkpoint progress and support executions lasting as long as one year.

Proxylity's example is device provisioning. A device generates a WireGuard keypair on first boot, connects using a fleet-wide pre-shared key and sends a provisioning packet. Lambda then starts a workflow that registers the identity, issues a certificate, creates a DynamoDB record and sends a notification. Confirmation reaches the device through another channel after the workflow completes.

Async invocation also changes the failure model. The launch announcement cautions that AWS can retry failed asynchronous invocations, so handlers and downstream workflows should be idempotent or use a dead-letter queue. Proxylity also prevents UseAsyncInvoke and response streaming from being enabled on the same destination because the two modes make opposing promises: one abandons the reply path, while the other keeps it open to stream packets back.

Harding's narrow infrastructure bet gets wider

Harding introduced Proxylity publicly in May 2025 with a thesis that experimentation in network software remains expensive because developers must build infrastructure before testing an idea. In his founding post, he framed UDP as an initial wedge toward making message-based network protocols easier to develop and deploy.

Open WireGuard enrollment pushes that wedge beyond private services with carefully managed peer lists. It gives Proxylity a route into device onboarding, mobile clients and public encrypted services where the server cannot know every participant in advance. Async Lambda delivery extends the same gateway from request-response networking into event-driven automation.

Proxylity distributes UDP Gateway through AWS Marketplace, keeping the purchase and usage charges on a customer's AWS bill. Its current pricing includes 1 million packets per month at no charge, followed by $1.25 per million for the next 99 million packets. Each Listener costs $0.00139 per port-hour, or roughly $1 per month, before charges for Lambda and other AWS services.

That pricing supports Harding's central pitch: make a UDP experiment cheap enough to start without committing to always-on network infrastructure. The June release strengthens the proposition by removing two forms of waiting - the registration step before an unknown device connects and the synchronous execution window after its packet arrives.

The tradeoff is explicit. Open endpoints move identity checks into application code, and asynchronous delivery removes immediate responses. For provisioning, telemetry and audit workflows that already operate on those assumptions, Proxylity has turned an encrypted UDP packet into a direct entry point for AWS serverless applications.