Netbird also, at least to me, has much too much stuff in it, perhaps even more. I would love to be able to connect to everything reliably no matter the network, the daemon doesn't need a reverse proxy, Ai agent routing and billing, in browser SSH client, it's all just attack surface. Tailscale allows you to compile a lot of it out as of a couple of weeks ago, but it's still an awful lot of code.

Netbird doesn’t have proper network isolation, due to its shared policy space compared to one gateway interface per customer/organization. Which is not an issue if you are the only user, but if you are building a service for customers to use, and there’s a potential scale up, it will be an issue, either having multi account mode which will results in many resources you need to deploy or containers per customer, or, having them all shared policy that could potentially allow customer to customer access if misconfiguration happens, alternatively, building a gateway in the middle to broker it all but traffic must pass through which is operational cost plus extra latency, and even privacy concerns.

yeah, seconded. i'm always shocked people leave nebula out of discussions like this

You didn't get it. It would be more clear if you implement it.

With these wrappers, peers also install and run wrapper and unwrapper services, to encapsulate udp packets into websocket frames and vice versa. For example, the software that proceses incoming packets from the internet could be wstunnel listening on 443/TCP. This layer converts the websocket TCP traffic to wireguard UDP, which wireguard would then decrypt. Wireguard could even listen to local host.

In popular implementations, this layer could have notable attack surface, particularly because it often provides additional features, such as obfuscation behind https, authentication, TLS client certificate validation, etc. I recall Debian has a minimal package which does only UDP to tcp parsing and conversion, which is written in C and not maintained. That layer could be insecure, and may lead to code execution on server before wireguard is even involved.

> There is no such thing as "rce packets".

I mean, that depends quite a bit on the code reading the packets, no?

My interpretation of OP is that they trust Wireguard’s code to be secure - random wrappers, somewhat less so.

Oh, you probably never developed any proxy before, so let me explain:

These "VPN"s ("proxies", really) are primary used by people in censor-heavily countries to get around their Internet restrictions, and these countries enforce Internet restriction by detecting and disrupting connections. Thus, for a better experience (a.k.a. usable), the proxy needs to handle these situations properly, otherwise either the link maybe banned or the user just stop using the proxy.

The detection part is why "rVPN" puts up claims like "looks like HTTPS" and "Active-probe resistant" on their page. Oh and by "looks like HTTPS", they probably mean they use WebSocket as background transport for their data frames (see https://docs.rvpn.org/).

(BTW: Does it work? Probably not. In China for example, the detection maybe triggered by traffic volume. That is, as soon as two endpoints transported enough data in given duration of time (days/weeks), these two will be marked as suspicious, no matter what the protocol looked like (see: https://github.com/net4people/bbs/issues/129#issuecomment-12.... there are better sources, I can't find it). Unless the oversea endpoint is somehow whitelisted or at least not in the high-suspicion list)

And now the disrupting part, or rather how to handle it. Usually it's done through simply retrying (reconnect, resend packets etc) transparently. To do that, it's better if you know what the user is trying to do: are they connecting to a new server, or are they trying to close the connection to it? etc.

A blind UDP proxy don't understand what WireGuard is trying to do, the packets in and out are not marked as ACK/PUSH/FIN etc in clear text. So, if you are a proxy, what optimization you can provide? Do you frantically re-transport every packet in risk of wasting bandwidth and/or get detected, or should you just tell WireGuard the other peer is unreachable and hoping it knows how to handle it instead?

Some proxies also has optimization when creating new remote connections, they carry data payload alongside with the ACK request, so the proxy can send the payload as soon as the new remote connection is opened on it's side without waiting for the client to respond to the successful opening of the connection. And you add these in combination to the retry mechanism, that's a lot of work WireGuard simply don't offer.

That's all the information I have to offer.

Now, let me ask, Are you a Chinese spy? Normal people won't be this interested in topic like this, but you do, consistently. Maybe you are trying to collect information so GFW can work better? Don't tell me tho, I don't care to know. IMO I don't really understand why somebody would ever want to develop these VPN/proxies under such risk (dying for it, even), and then just offer it out for free. So what? their users can gain advantages they shouldn't have and then push their Internet censoring country towards advancement? Why should the uncensored Internet help the countries that censors it? I mean, if their country, and by extend their people, blocked the Internet, maybe they should just stay within their own, enjoy their Bilibili/Douyin brainrots and follow their government's order, eat, shit, sleep, obey, generate baby and die, simple life, like the herds under good herdsman. Also, ignorance itself can be useful even good, the useless medicine doctor prescribed works the best on people who don't know it's useless, so good they don't know they should complain. The longer I live, the more I agree that knowledge and truth is privilege, it takes before it gives, as it should, and it should only give if it likes you. Most people and countries just don't deserve that, at least not for free, maybe these countries should just cut the cable off clean, good for everybody involved.

Sure, but why do you think they're marketed these services, who would it be valuable too...

Most VPN companies are incredibly sus, outside of Mulvad they're mostly all incredibly suspicious imo. Western intelligence is desperate to enable the use of such tools in enemy territory so they can bombard enemy culture with American culture and make the populations eager to adopt American/Western customs and as a byproduct install leaders who are pro western ideology and less likely to be adversarial. VPNs when marketed to these countries should be seen as tools of propaganda dissemination l, in my opinion.

The EFF will talk a big game about how this tech is about freedom of information, human rights and democracy.but really they're founded by a bunch of US Naval Research guys who are basically tasked with building the "cyber" infrastructure to ideologically invade adversial countries so they can be psychologically colonized. They then launder that mission with discussions about free speech and democracy.

The original US Army's Psychological Operations Unit, was called the "Ghost Army" they used a patch with a ghost hovering over an implied target shooting electricity from its hands.

https://upload.wikimedia.org/wikipedia/commons/7/75/Ghostarm...

The ghost on the patch is symbolic for beaming in signals into enemy territory to brainwash, intimidate and control an enemy population.

The reason that China, Russia and Iran have nation state firewalls is because the US is so good at this, and the US wants to control any country who has any potential of competing with it. Its not because they hate freedom or something, its because anyone the US has deemed an economic or ideological opponent will be targeted in this way. We will beam signals through whatever means/protocol into a country to gain a psychological foothold in their culture, we will then convince them to kill their leaders and install US puppets.

I routinely say that Starlink should make its logo the Ghost Army patch, because thats what it was built for. While it functions as a cool business, and does provide value, it was created as the ultimate propaganda dissemination tool

(eventually atleast, it will be very hard to mitigate against if they can pull off some sort of cellular implementation of Starlink, which they're actively working towards).

TOR and VPN companies attempted to serve this purpose, when this paradigm failed to be a general purpose tool for bypassing nation state firewalls they had to find another way so they helped Elon bootstrap a literal satallite constellation for this purpose. Its literally the Ghost in the sky waving its hand over a population with few ways to prevent its use.

The VPN industry in China, Russia and Iran are weapons for this agenda.

Push western news narratives, propaganda, help dissidents/traitors. Cultural colonization.

Just because some people take issue with it doesn't mean it's wrong.