Hacker News Reader

sadly, wireguard/openvpn does not not provide any obfuscation mechanism at protocol level

I think this is a good thing. Apply obfuscation on top of WireGuard, that way you can have the functionality and security of the WireGuard tunnel and swap between different obfuscation techniques as needed.

Is there a mechanism to apply obfuscation on top of wireguard on latest Ubuntu stable? AFAIK wireguard is built inside the kernel.

The idea is you connect to the wireguard UDP port from one of the obfuscation tunnels.

laptop -> obfuscation tunnel (udp2raw/iodine/ssh/tor/wstunnel/etc.) -> wireguard UDP port. Though some protocols like ssh or tor only support TCP, so you have to run an additional tunnel in the machine to get to wireguard (udp-over-tcp).

tunnel on top of another tunnel works, but at the cost of speed and ops complexity.

Reply on news.ycombinator.com