Hacker News Reader

Comment by razighter777 | Hacker News Reader

That's more of a job for an encapsulating protocol. (shadowsocks or similar) Wireguard isn't designed to be obfuscating alone. It's just a simple l3 udp tunnel with a minimal attack surface.

View on HN

That's the traditional answer parroted in the Wireguard documentation but a few hours' serious thought and design is enough to reveal the fatal flaw: any encapsulating protocol will have to reinvent and duplicatively implement all of the routing logic. Perr-based routing is at least 50% of wireguard's value proposition. Having to reimplement it at the higher level defeats the purpose. No, obfuscation _has_ to be part of the same protocol as routing.

(Btw, same sort of thing occurs with zfs combining raid and filesystem to close the parity raid write hole. Often strictly layered systems with separation of concerns are less than the sum of their parts.)

In this case with the, I believe it’s called quantum tunneling by mullvad, it’s actually a good thing. Because the encapsulation protocol is just UDP/IP, a well established existing protocol that can masquerade as any kind of internet traffic easily.

Makes it difficult to block by censors. Great video I saw here: https://youtu.be/pZiG8r-diTM?si=wy35elqMt1T6euq0

This also means wg is just doing one thing instead of a dozen it doesn’t “need” to.

> It's just a simple l3 udp tunnel

Wait, isn’t UDP L4? Am I missing something?

Wireguard is a L3 VPN that uses UDP (L4) for tunneling. Thats probably what was meant.

Yes, but it tunnels arbitrary IP packets encapsulated in UDP.

Reply on news.ycombinator.com