TrustTunnel: AdGuard VPN protocol goes open-source • Hacker News Board

rfv6723 wrote: post #20

gruez wrote: post #19

Earlier quoted context omitted.

>GFW has been able to filter SNI to block https traffic for a few years now. SNI isn't really the threat here, because any commercial VPN is going to be blocked by IP, no need for SNI. The bigger threat is tell-tale patterns of VPN use because of TLS-in-TLS, TLS-in-SSH, or even TLS-in-any-high-entropy-stream (eg. shadowsocks).

> because any commercial VPN is going to be blocked by IP, no need for SNI. Proxy server can hide behind CDN like Cloudflare via websocket tunnel. This is why GFW develops SNI filter, Cloudflare is too big to block.

>Proxy server can hide behind CDN like Cloudflare via websocket tunnel.

cloudflare doesn't support domain fronting so any SNI spoofing won't work.

Re: TrustTunnel: AdGuard VPN protocol goes open-source

#26

Post by dixie_land » Thu, Jan 22, 2026, 5:16 AM UTC

stefanha wrote: post #11

Link to the protocol specification: https://github.com/TrustTunnel/TrustTunnel/blob/master/PROTO... It's a thin HTTP/2 and HTTP/3 tunneling protocol for TCP, UDP, and ICMP traffic. It should be easy to write an independent implementation based on this specification provided you already have an HTTP/2 or HTTP/3 library. Pretty neat!

Looks very similar to the HBONE protocol the istio folks created for ambient mesh: https://istio.io/latest/docs/ambient/architecture/hbone/

Re: TrustTunnel: AdGuard VPN protocol goes open-source

#27

Post by nfgrep » Thu, Jan 22, 2026, 5:36 AM UTC

Super cool stuff! Excited to see what p2p between clients might look like, and how it compares on speed with Wireguard.

Re: TrustTunnel: AdGuard VPN protocol goes open-source

#28

Post by userbinator » Thu, Jan 22, 2026, 5:55 AM UTC

stefanha wrote: post #11

Link to the protocol specification: https://github.com/TrustTunnel/TrustTunnel/blob/master/PROTO... It's a thin HTTP/2 and HTTP/3 tunneling protocol for TCP, UDP, and ICMP traffic. It should be easy to write an independent implementation based on this specification provided you already have an HTTP/2 or HTTP/3 library. Pretty neat!

Basically a CONNECT proxy? That's definitely not a difficult thing to write.

Re: TrustTunnel: AdGuard VPN protocol goes open-source

#29

Post by kidfiji » Thu, Jan 22, 2026, 5:55 AM UTC

ameshkov wrote: post #7

zx8080 wrote: post #5

I'm surprised that the browser extension to block ads has a proprietary vpn-like protocol. WTF?

One interesting thing I’ve noticed is that AdGuard means different things in different parts of the world. In some places, people know us primarily as an ad blocker, in others we’re best known for our DNS service and in some regions AdGuard is associated almost exclusively with our VPN. The reality is that AdGuard makes several different products, not just one.

And AdGuard Home is a wonderful alternative to Pi-hole :)

Re: TrustTunnel: AdGuard VPN protocol goes open-source

#30

Post by ameshkov » Thu, Jan 22, 2026, 6:29 AM UTC

rfv6723 wrote: post #16

ameshkov wrote: post #6

Hi, I’m one of the people working on this. One clarification that may not be obvious: open-sourcing this isn’t primarily about signaling or auditability. If that were the goal, a standalone protocol spec or a minimal reference repo would have been enough. Instead, we’re deliberately shipping full client and server implementations because the end goal is for this to become an independent, vendor-neutral project, not s…

Does your team have Chinese memebers? GFW has been able to filter SNI to block https traffic for a few years now.

We do, and from what we know a bigger problem in China is detecting traffic patterns. SNI filtering is not that big of a deal, in order to block your domain it needs to first learn which one you’re using. What for the traffic patterns, people in China prefer to selectively route traffic to the tunnel. For instance, the client apps allow you to route *.cn domains (or any other domains) directly. It makes it harder to detect that you’re using a VPN.