Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GotaTun – Mullvad's WireGuard Implementation in Rust

mullvad.net

Post reply on HN
Print view View original

21–30 of 142 posts

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#21

Post by rlpb »

swiftcoder wrote: post #19
ur-whale wrote: post #15

Earlier quoted context omitted.

I meant at a global level (think as if you're attacking all wireguard users, not a single one)

The increased attack surface mostly only affects that one particular implementation though. So, yes, twice as many implementations that may contain exploitable bugs, but each new implementation could only be used to exploit a fraction of the total user base

> could only be used to exploit a fraction

If anything this is a even a good thing, since it means that each individual vulnerability an attacker finds is less valuable to them.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#23

Post by tumdum_ »

intsunny wrote: post #18

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

You do know that NordSec maintains its own rust fork of BoringTun: https://github.com/NordSecurity/NepTUN ? :)

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#24

Post by eatbitseveryday »

intsunny wrote: post #18

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

It became less of a choice for many after they sadly had to disable port forwarding.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#25

Post by DANmode »

imcritic wrote: post #10

I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.

Known Limitations

WireGuard is a protocol that, like all protocols, makes necessary trade-offs. This page summarizes known limitations due to these trade-offs.

Deep Packet Inspection

WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however.

tl;dr Read the docs.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#26

Post by Hendrikto »

razighter777 wrote: post #13
imcritic wrote: post #10

I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.

That's more of a job for an encapsulating protocol. (shadowsocks or similar) Wireguard isn't designed to be obfuscating alone. It's just a simple l3 udp tunnel with a minimal attack surface.

> It's just a simple l3 udp tunnel

Wait, isn’t UDP L4? Am I missing something?

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#27

Post by wasmitnetzen »

alias_neo wrote: post #22

Is there any way to switch to this implementation for generic WireGuard users? I tried downloading their Android app, but it's not generally usable for people who host our own WireGuard, which is fair enough.

The github repo is linked in the post which has build instructions: https://github.com/mullvad/gotatun

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#28

Post by Hasnep »

Hakkin wrote: post #12

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will ran…

Oh, this is the reason the Mullvad app on my Pixel 6a was suddenly able to connect in less than a second where before it would take 5-10 seconds, nice!

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#29

Post by jorvi »

eatbitseveryday wrote: post #24
intsunny wrote: post #18

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

It became less of a choice for many after they sadly had to disable port forwarding.

Yeah, their reasoning is solid (easy to abuse) but it is still a very useful feature.

AFAIK, at the moment your choices are AirVPN and ProtonVPN. AirVPN has static port forwarding and Proton has UPNP port forwarding.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#30

Post by eurg »

Hendrikto wrote: post #26
razighter777 wrote: post #13

Earlier quoted context omitted.

That's more of a job for an encapsulating protocol. (shadowsocks or similar) Wireguard isn't designed to be obfuscating alone. It's just a simple l3 udp tunnel with a minimal attack surface.

> It's just a simple l3 udp tunnel Wait, isn’t UDP L4? Am I missing something?

Yes, but it tunnels arbitrary IP packets encapsulated in UDP.
Post reply on HN