3 ms·

People using WireGuard: how well does it work in public networks that only have a few select open ports (http/https/openvpn…) ? Does anyone have a workaround (e

by Aissen 8y ago

People using WireGuard: how well does it work in public networks that only have a few select open ports (http/https/openvpn…) ? Does anyone have a workaround (e.g a reverse tcp (+tls/sni?) proxy on port 443?)

tinco 8y ago
Proxying on 443 would 100% work, I can say that without trying. The only case that would not work is if the firewall would do any deep packet inspection to see whether the connection setup resembles https. That of course would also be easy to circumvent, but I don't think any firewall would go so far.
- LukeShu 8y ago
  Lightspeed Systems' web filter does DPI to determine if the connection setup actually resembles HTTPS.
  - tinco 8y ago
    Well shit. Then you would have to tunnel your VPN through a https proxy, if the iOS client doesn't support that you'd be stuck.
vinay_ys 8y ago
Wireguard packets on port 443 looks like malformed QUIC packets. Any firewall that is doing protocol inspection (for L7 policy enforcement) would typically be configured to drop malformed packets. Wireguard would get blocked by such firewalls.
- dcbadacd 8y ago
  Time to make the suggestion to either actually use QUIC or simulate QUIC?
Youden 8y ago
WireGuard itself requires UDP but it's fairly trivial to tunnel UDP over TCP with for example ssf: https://securesocketfunneling.github.io/ssf/ https://securesocketfunneling.github.io/ssf/
- LukeShu 8y ago
  Have you actually tried this? I expect that it wouldn't work very well. There's a bit of common wisdom of "don't do TCP over TCP"; the reason WireGuard uses UDP is that UDP faithfully forwards-up-the-stack the unreliability of the underlying Ethernet network. This unreliability is important to the proper operation of TCP flow control for TCP streams sent over WireGuard. If you just plopped those UDP packets on to a perfectly reliable stream (like a TCP stream), it would mess up the flow control for TCP connections going through the VPN (unless something in the stack is taking special care for this scenario). (I'm very interested in solutions to "I'd like the unreliability of UDP so that I can send TCP over it, but I only have TCP" problem.)
  - gsich 8y ago
    TCP over TCP can work. But that very much depends on the quality of the connection. High latency is going to be a problem.

by Aissen 8y ago

tinco 8y ago

Proxying on 443 would 100% work, I can say that without trying. The only case that would not work is if the firewall would do any deep packet inspection to see whether the connection setup resembles https. That of course would also be easy to circumvent, but I don't think any firewall would go so far.

LukeShu 8y ago
Lightspeed Systems' web filter does DPI to determine if the connection setup actually resembles HTTPS.
- tinco 8y ago
  Well shit. Then you would have to tunnel your VPN through a https proxy, if the iOS client doesn't support that you'd be stuck.

vinay_ys 8y ago

Wireguard packets on port 443 looks like malformed QUIC packets. Any firewall that is doing protocol inspection (for L7 policy enforcement) would typically be configured to drop malformed packets. Wireguard would get blocked by such firewalls.

dcbadacd 8y ago
Time to make the suggestion to either actually use QUIC or simulate QUIC?

Youden 8y ago

WireGuard itself requires UDP but it's fairly trivial to tunnel UDP over TCP with for example ssf: https://securesocketfunneling.github.io/ssf/ https://securesocketfunneling.github.io/ssf/

LukeShu 8y ago
Have you actually tried this? I expect that it wouldn't work very well. There's a bit of common wisdom of "don't do TCP over TCP"; the reason WireGuard uses UDP is that UDP faithfully forwards-up-the-stack the unreliability of the underlying Ethernet network. This unreliability is important to the proper operation of TCP flow control for TCP streams sent over WireGuard. If you just plopped those UDP packets on to a perfectly reliable stream (like a TCP stream), it would mess up the flow control for TCP connections going through the VPN (unless something in the stack is taking special care for this scenario). (I'm very interested in solutions to "I'd like the unreliability of UDP so that I can send TCP over it, but I only have TCP" problem.)
- gsich 8y ago
  TCP over TCP can work. But that very much depends on the quality of the connection. High latency is going to be a problem.