Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GotaTun – Mullvad's WireGuard Implementation in Rust

mullvad.net

Post reply on HN
Print view View original

81–90 of 142 posts

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#81

Post by jorvi »

wing-_-nuts wrote: post #72
jorvi wrote: post #29

Earlier quoted context omitted.

Yeah, their reasoning is solid (easy to abuse) but it is still a very useful feature. AFAIK, at the moment your choices are AirVPN and ProtonVPN. AirVPN has static port forwarding and Proton has UPNP port forwarding.

Currently using airVPN, but ye gods, their eddie client is atrocious on linux. I wind up using wg / nmcli, but then have to block traffic going outside of the vpn with iptable rules because it leaks for some reason. I miss mullvad dearly, and I might try proton after my 3y sub is up.

Not only Eddie, their account control panels and site in general look like something from the 90s, and it seriously hampers their business. I can't recommend them to anyone that isn't highly technical. And even then, as a technical user, why do I manually have to select one of 10-20 servers within a city or region, why am I being asked to manually load balance? Why is there no Wireguard over port 53 or 443?

It makes more sense when you know they're privacy activists first, businessmen second. But Mullvad shows you can be pro privacy and still offer great UX and a sleek site and client.

Btw, if you're managing things in CLI, you could take a look at their Hummingbird Suite. AFAIK it has a killswitch.

What sucks with Proton is that you can't share the VPN account with friends, because it is tied to your Proton account. They should create a vpn.proton.me subdomain that you can create a special managed account on that can only touch the VPN settings.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#82

Post by formerly_proven »

wyldfire wrote: post #57
vjerancrnjak wrote: post #32

Earlier quoted context omitted.

Same behavior on raspberry pi 5. Might be just lack of arm optimizations.

It's very likely that VPNs like this are not CPU-bound, even on somewhat whimpy CPUs. I'd wager even some microcontrollers could sling 500megabits/sec around without trouble.

You’re in for a surprise then once you actually go look at the performance.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#83

Post by [deleted] »

chneu wrote: post #55
Hakkin wrote: post #12

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will ran…

MTU strikes again. 1320.

[deleted]

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#84

Post by ekjhgkejhgk »

Hakkin wrote: post #12

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will ran…

I'm surprised by this comment. I have wireguard on 24/7 on my shitty Samsung A5 and it lasts forever. By comparison the Pixel 8 is a beast. Sounds like an Android bug more than wireguard.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#85

Post by zamadatix »

queuebert wrote: post #79
chneu wrote: post #55

Earlier quoted context omitted.

MTU strikes again. 1320.

Why 1320 and not larger?

For most any 5G network you should be safe to 1420 - 80 = 1340 bytes if using IPv6 transport or 1420 - 60 = 1360 bytes if using IPv4 transport.

For testing I recommend starting from 1280 as a "does this even work" baseline and then tweaking from there. I.e. 1280 either as the "outside" MTU if you only care about IPv4 or as the "inside" MTU if you want IPv6 to work through the tunnel. This leverages that IPv6 demands a 1280 byte MTU to work.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#86

Post by hashworks »

ekjhgkejhgk wrote: post #84
Hakkin wrote: post #12

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will ran…

I'm surprised by this comment. I have wireguard on 24/7 on my shitty Samsung A5 and it lasts forever. By comparison the Pixel 8 is a beast. Sounds like an Android bug more than wireguard.

What app are you using?

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#87

Post by ekjhgkejhgk »

hashworks wrote: post #86
ekjhgkejhgk wrote: post #84

Earlier quoted context omitted.

I'm surprised by this comment. I have wireguard on 24/7 on my shitty Samsung A5 and it lasts forever. By comparison the Pixel 8 is a beast. Sounds like an Android bug more than wireguard.

What app are you using?

It's just called WireGuard, by the "WireGuard Development Team" off google play.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#88

Post by gpm »

turblety wrote: post #54
throwaway894345 wrote: post #52

Earlier quoted context omitted.

Correct me if I’m wrong, but if you use LD_PRELOAD, presumably it will not work for applications that circumvent libc, such as Go binaries (at least those with CGo disabled)?

Yeah you are right. Can you think of any way we could capture that traffic too?

It would be a non-trivial amount of work but syscall user dispatch lets you intercept syscalls on modern linux if you really want to.

https://docs.kernel.org/admin-guide/syscall-user-dispatch.ht...

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#89

Post by wing-_-nuts »

jorvi wrote: post #81
wing-_-nuts wrote: post #72

Earlier quoted context omitted.

Currently using airVPN, but ye gods, their eddie client is atrocious on linux. I wind up using wg / nmcli, but then have to block traffic going outside of the vpn with iptable rules because it leaks for some reason. I miss mullvad dearly, and I might try proton after my 3y sub is up.

Not only Eddie, their account control panels and site in general look like something from the 90s, and it seriously hampers their business. I can't recommend them to anyone that isn't highly technical. And even then, as a technical user, why do I manually have to select one of 10-20 servers within a city or region, why am I being asked to manually load balance? Why is there no Wireguard over port 53 or 443? It makes…

>Btw, if you're managing things in CLI, you could take a look at their Hummingbird Suite. AFAIK it has a killswitch.

Hummingbird doesn't support wireguard iirc, which is a deal breaker

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#90

Post by puffybuf »

swexbe wrote: post #36
intsunny wrote: post #18

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

I wish I could use Mullvad. But their IPs are banned from many streaming services and they don't change them often enough so I am stuck with Nord.

I would just pirate at that point. You're paying for the streaming service anyways. Use mullvad to download the torrent :). I'm pretty sure they ignore dmca requests. Not that they even know their customer's names if you pay with Mullvad amazon card.
Post reply on HN