Hacker News Reader

almost all DPI software recognize the wireguard handshake.

Why should that matter? How does the DPI software get your keys? Isn't WireGuard data flow completely opaque to anyone or anything between endpoints?

If the DPI software blocks WireGuard packets, that's an entirely different discussion. It gets into the area of "technical solutions" to fight "administrative policy".

View on HN

> It gets into the area of "technical solutions" to fight "administrative policy".

Yes, that's exactly the point. Sometimes that's the best course of action available to you. If the userspace implementation were to be deprecated that could pose difficulties.

Why would it be an issue? Can't you specify localhost as the endpoint and use the proxy to send it where it needs to go? What is the difference between the implementations?

I like to visualize networks as a series of tubes in my head. Maybe I'm misunderstanding something but I'm imagining a kernel driver that acts as a separate network interface proxying to localhost as a klein bottle[0] esque object

[0]: https://en.wikipedia.org/wiki/Klein_bottle

Performance will take a hit then, which is unfortunate.

Reply on news.ycombinator.com