sandwichsaregood

WG is not meant to be a stealthy protocol and is easy to detect at the ISP level. It has distinct characteristics that packet inspection tools can use to identify it by examining the traffic and block or flag it.

There are modified versions like AmneziaWG that make it stealthier, or alternative protocols built to evade traffic inspection like xray or sing-box. It’s a bit of an arms race for packet inspection tools to be able to reliably identify these intentionally stealthy protocols, but the advantage is generally strongly in your favor.

Sing-box is a VPN tool built to evade censorship github.com/SagerNet/sing-box .

See also, xray and v2ray, which are similar, but in my experience sing-box is a bit better documented (at least in English) and has better maintained client apps.

Is that a hot take? I see a lot of people saying this, including myself. Kubernetes solves problems at work, but is way overkill even for my moderately elaborate home setup that would cause more troubles than it solves. If people want to use k8s at home go ahead, but I don’t.

I agree that there is some value to obscurity generally, but Wireguard already evades port scans and fingerprinting. Unless a packet is signed with a known key, it gives no response to traffic, so scanners and fingerprinters see a closed port. You ISP can identify WG traffic while you are connected by inspecting your traffic, but random scanners won’t see anything. Look on shodan, you won’t see Wireguard.

I ended up building it myself, which may be the best option if you want to use other plugins. I have it set up in my own Forgejo with a CI configuration to auto build the binary and docker image. Forgejo let’s you also host container images, so I can just pull from the latest build wherever I need it.

Both those tools analyze service logs for suspicious activity and block based on patterns. If you aren’t hosting anything externally, they probably aren’t doing anything.

Tugtainer is pretty nice, and has a webui.