Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GotaTun – Mullvad's WireGuard Implementation in Rust

mullvad.net

Post reply on HN
Print view View original

51–60 of 142 posts

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#51

Post by jpeeler »

turblety wrote: post #6

Nice, I love WireGuard. I ended up building WrapGuard [1] to run applications without root access to the host and choose Go to write it in. I don't really know Rust, but does it make more sense for firmware/networking type software? Is there even a difference? 1. https://github.com/puzed/wrapguard

Very cool. I may use this, but also curious what the best choice would be if you don't need encryption. I'm specifically wanting to enable some local container networking using apple's new container tool [1]. I know I could just use Docker...

[1] https://github.com/apple/container/issues/670

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#52

Post by throwaway894345 »

turblety wrote: post #45
chjj wrote: post #31

Earlier quoted context omitted.

Very cool project. Is it always an LD_PRELOAD or can it function as a standalone SOCKS proxy similar to wireproxy?

Thanks chjj. Yeah it's always LD_PRELOAD. There is wireproxy [1] though that might do what you want? 1. https://github.com/whyvl/wireproxy

Correct me if I’m wrong, but if you use LD_PRELOAD, presumably it will not work for applications that circumvent libc, such as Go binaries (at least those with CGo disabled)?

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#53

Post by Gander5739 »

Philip-J-Fry wrote: post #43
intsunny wrote: post #18

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

Mullvad is great for privacy. But it's blocked by pretty much every VPN block list. NordVPN at the very least bypasses all the ones I regularly encounter. I do use Mullvad for most web browsing though. But Imgur for example is blocked on it, and it's blocked in the UK, so I need NordVPN if I want to see any images there. Most people's VPN usage is literally just geolocation restrictions and Nord is really good at tha…

Aren't proxies good enough for that purpose?

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#54

Post by turblety »

throwaway894345 wrote: post #52
turblety wrote: post #45

Earlier quoted context omitted.

Thanks chjj. Yeah it's always LD_PRELOAD. There is wireproxy [1] though that might do what you want? 1. https://github.com/whyvl/wireproxy

Correct me if I’m wrong, but if you use LD_PRELOAD, presumably it will not work for applications that circumvent libc, such as Go binaries (at least those with CGo disabled)?

Yeah you are right. Can you think of any way we could capture that traffic too?

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#55

Post by chneu »

Hakkin wrote: post #12

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will ran…

MTU strikes again. 1320.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#56

Post by holysoles »

imcritic wrote: post #10

I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.

The mullvad apps do offer obfuscation options (shadowsocks, etc) but i agree it would be nice if something was baked into wireguard itself. I recently went through setting up shadowsocks over wg for my homelab and it was a good bit of effort

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#57

Post by wyldfire »

vjerancrnjak wrote: post #32
Hakkin wrote: post #12

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will ran…

Same behavior on raspberry pi 5. Might be just lack of arm optimizations.

It's very likely that VPNs like this are not CPU-bound, even on somewhat whimpy CPUs. I'd wager even some microcontrollers could sling 500megabits/sec around without trouble.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#58

Post by throwaway894345 »

turblety wrote: post #54
throwaway894345 wrote: post #52

Earlier quoted context omitted.

Correct me if I’m wrong, but if you use LD_PRELOAD, presumably it will not work for applications that circumvent libc, such as Go binaries (at least those with CGo disabled)?

Yeah you are right. Can you think of any way we could capture that traffic too?

I have no idea. I’ve never messed with it, but maybe something like eBPF to intercept network syscalls? Not sure if that’s a thing—especially without root access? Mostly I was just thinking the project page could use a disclaimer since, in Go, it is common to bypass libc. :shrug:

This seems like a very cool, useful project though!

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#59

Post by kevincox »

nevi-me wrote: post #3

If anyone working on the implementation is here, was it not possible to upstream your changes to BoringTun? The blog mentions some changes but doesn't go into detail on that aspect.

BoringTun is unmaintained. There are various forks being developed.

I work at Obscura VPN and faced with boringtun bugs a few years ago we evaluated a few of the forks and switched our client to be based on top of NepTUN (https://github.com/NordSecurity/NepTUN).

I am curious why Mullvad started their own fork rather than building on top of one of the existing ones. It would be nice if there could be reconsolidation somewhere.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#60

Post by AJ007 »

Aurornis wrote: post #47
intsunny wrote: post #18

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

Mullvad seems to care and be competent about privacy, but most average VPN users aren’t seeking the most extreme privacy. They just want something cheap that lets them do geolocation things or access the most websites.

The average VPN user is knowledge-less. At best their internet usage data is being sold to third party analytics companies. At worst third parties are routing their own bots through their local connection.
Post reply on HN