Mullvad VPN Introducing WireGuard over TCP and IPv6

tata71 wrote: post #4

kd913 wrote: post #3

There are very good reasons why it's a bad idea to run a VPN on top of TCP. https://www.youtube.com/watch?v=AAssk2N_oPk

For those that aren't loading such domains these days: brief (even incomplete) list of points appreciated.

Assuming you’re tunneling TCP inside of TCP, then in the event of non-perfect network conditions, you have two layers of the stack that are now trying to adjust the TCP flow parameters, re-transmit packets, etc. This will frequently end up in a situation where overall performance of the link is significantly worse than it needs to be.

Re: Mullvad VPN Introducing WireGuard over TCP and IPv6

#6

Post by 1_player » Wed, Nov 03, 2021, 2:09 PM UTC

Everybody commenting that WireGuard over TCP is a bad idea, and TFA explains why it exists:

"WireGuard out of the box works only over UDP. This can cause problems because UDP is blocked on many public networks like in cafes and on trains. That’s why we’re introducing a solution for WireGuard over TCP."

Yeah, it's a bad idea, but sometimes it's necessary.

Re: Mullvad VPN Introducing WireGuard over TCP and IPv6

#7

Post by kd913 » Wed, Nov 03, 2021, 4:17 PM UTC

1_player wrote: post #6

Everybody commenting that WireGuard over TCP is a bad idea, and TFA explains why it exists: "WireGuard out of the box works only over UDP. This can cause problems because UDP is blocked on many public networks like in cafes and on trains. That’s why we’re introducing a solution for WireGuard over TCP." Yeah, it's a bad idea, but sometimes it's necessary.

We understand why it exists. Although it would be nice if the issue was up front so people can be aware of the problem.

If they have an innovation that solved the TCP meltdown issue that would be interesting.

Re: Mullvad VPN Introducing WireGuard over TCP and IPv6

#8

Post by technerder » Wed, Nov 03, 2021, 5:25 PM UTC

The article mentions that places such as cafes and trains block UDP. What is the reasoning for this?

Re: Mullvad VPN Introducing WireGuard over TCP and IPv6

#9

Post by evgen » Wed, Nov 03, 2021, 5:36 PM UTC

technerder wrote: post #8

The article mentions that places such as cafes and trains block UDP. What is the reasoning for this?

For the most part, if I am providing wifi in a place like that the only thing I want you to do is browse the web. I am not interested in your desire to run a torrent client, stream netflix, or do something else that consumes a significant amount of bandwidth. Most UDP applications are also rather poor when it comes to congestion control and in general do not play nice with the other children. These companies have better things to do than to provide IT support for people trying to use the wifi, so you block all UDP and force re-direct port 53 UDP (DNS lookups) to go to a resolver that you are going to provide in the DHCP lease. This also means that wireguard is not an option for most people if they are on these networks.

Re: Mullvad VPN Introducing WireGuard over TCP and IPv6

#10

Post by technerder » Wed, Nov 03, 2021, 5:46 PM UTC

evgen wrote: post #9

technerder wrote: post #8

The article mentions that places such as cafes and trains block UDP. What is the reasoning for this?

For the most part, if I am providing wifi in a place like that the only thing I want you to do is browse the web. I am not interested in your desire to run a torrent client, stream netflix, or do something else that consumes a significant amount of bandwidth. Most UDP applications are also rather poor when it comes to congestion control and in general do not play nice with the other children. These companies have bet…

That actually makes a lot of sense, thank you!