Hacker News Reader

Comment by sjy | Hacker News Reader

I suggest looking into WireGuard [1]. I found it easier to use than OpenVPN, and I think it will displace it as the de facto standard when it eventually gets merged into the Linux kernel. You'll have to use lower-level configuration tools to get started with it, which I am finding helpful to pursue the same goal of learning about networking more thoroughly.

[1]: https://news.ycombinator.com/item?id=17659983

View on HN

While like Wireguard a lot, it won't displace Openvpn completely, for the simple reason that it only works over UDP, and cannot work over TCP, unlike Openvpn.

Transforming generic layer 3 datagrams into traffic that looks like something else is the general domain of obfuscation. Making WireGuard traffic look like TCP is one form of such obfuscation. Making it look like TLS or DNS or HTTP are other forms. (Actually putting layer 3 traffic into framing inside a legit TCP stream is inefficient and the wrong way to think about the problem domain.) No promises, but I'm expecting some nice things to come in this domain of generic obfuscation mechanisms to punch through various forms of filtering.

Inefficient as it may be, it is something I simply need for my use case - connecting home from a certain network which only allows outgoing connections on a handful of TCP ports.

No. You need your traffic to look like TCP, for your particular network filtering. But you do not need to achieve that by using the naive and inefficient approach of, "stick the packets into a TCP stream prefixed by a length field." Rather, there are more clever tricks for making your traffic look like TCP, which generally fall into the same realm as other obfuscation mechanisms.

Reply on news.ycombinator.com