Have you actually tried this? I expect that it wouldn't work very well. There's a bit of common wisdom of "don't do TCP over TCP"; the reason WireGuard uses U

Have you actually tried this? I expect that it wouldn't work very well. There's a bit of common wisdom of "don't do TCP over TCP"; the reason WireGuard uses UDP is that UDP faithfully forwards-up-the-stack the unreliability of the underlying Ethernet network. This unreliability is important to the proper operation of TCP flow control for TCP streams sent over WireGuard. If you just plopped those UDP packets on to a perfectly reliable stream (like a TCP stream), it would mess up the flow control for TCP connections going through the VPN (unless something in the stack is taking special care for this scenario). (I'm very interested in solutions to "I'd like the unreliability of UDP so that I can send TCP over it, but I only have TCP" problem.)