Hacker News Reader

Comment by akho | Hacker News Reader

Wireguard is not censorship-resistant, and most VPN-averse countries block cross-border Wireguard. Why reply a practical question in an area in which you have no experience?

View on HN

Because Indonesia is new to the game and might still be catching up. They’re probably playing whackamole with the most common public VPN providers and might not be doing deep packet inspection yet. I worked with someone getting traffic out of Hong Kong a year ago and there was a lot trial and error figuring out what was blocked and what was not. Wireguard was one that worked.

They recommend Tailscale in particular. Tailscale control plane and DERPs (which are functionally required on mobile) will be among the first to go.

Outline (shadowsocks-based) and amnezia (obfuscated wg and xray) both offer few-click install on your own VPS, which is easier than setting up headscale or static wg infrastructure, and will last you longer.

Also, you did not answer my "why" question. I'm not sure what question you were answering.

Is it possible to identify wireguard traffic that isn't on a common port?

Yes. Fixed packet headers, predictable packet sizes. I don't know what "a common port" means in relation to wg.

51820 is the one they use in the docs, that's probably the most common one.

They mean UDP port 51820

Yeah. Tailscale uses 41641, and you can generally use whatever. I don't think there's any consensus, or majority.

Reply on news.ycombinator.com