Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it.
WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport.
We did this at Fly.io when we discovered that, for one reason or another, 5% of our users simply couldn't reliably use UDP. It was a one-day project to run it under WebSockets instead, and that was before coding agents.
Wireguard is both really useful and pretty frustrating as a user. As a developer it's amazing that you can do things like relay packets through a bouncer with authentication to get around NAT without ever having to think about the protocol level safety, as a user it's near impossible to configure without the confused "why are no packets working", and as you had here it just doesn't make it through a lot of restrictive networking conditions. I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them.
The parent is obviously just Claude making a fancy website and some sort of unreviewed networking protocol that's dressed up to look as if it's a real project. Github really needs to start showing commit cadence and repo birthdates.
Netbird also, at least to me, has much too much stuff in it, perhaps even more. I would love to be able to connect to everything reliably no matter the network, the daemon doesn't need a reverse proxy, Ai agent routing and billing, in browser SSH client, it's all just attack surface. Tailscale allows you to compile a lot of it out as of a couple of weeks ago, but it's still an awful lot of code.
> WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport.
Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it.
WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport.
We did this at Fly.io when we discovered that, for one reason or another, 5% of our users simply couldn't reliably use UDP. It was a one-day project to run it under WebSockets instead, and that was before coding agents.
Wireguard is both really useful and pretty frustrating as a user. As a developer it's amazing that you can do things like relay packets through a bouncer with authentication to get around NAT without ever having to think about the protocol level safety, as a user it's near impossible to configure without the confused "why are no packets working", and as you had here it just doesn't make it through a lot of restrictive networking conditions. I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them.
The parent is obviously just Claude making a fancy website and some sort of unreviewed networking protocol that's dressed up to look as if it's a real project. Github really needs to start showing commit cadence and repo birthdates.
> I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them.
netbird's a thing to check out if you want an alternative to tailscale you can self-host.
Netbird also, at least to me, has much too much stuff in it, perhaps even more. I would love to be able to connect to everything reliably no matter the network, the daemon doesn't need a reverse proxy, Ai agent routing and billing, in browser SSH client, it's all just attack surface. Tailscale allows you to compile a lot of it out as of a couple of weeks ago, but it's still an awful lot of code.
> Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it.
Why TFA explains it, it's also in the title: "stealth". WireGuard is trivial to detect and block, and has no aspirations at being stealth.
He literally acknowledged that:
> WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport.
> Memory-safe in Rust > The core is written in Rust, so entire classes of vulnerability cannot occur.
Hmm... It just ain't true.
---
For those who need a "stealth VPN", use <https://github.com/XTLS/Xray-core/> or its GUI version <https://github.com/2dust/v2rayN/>
i was needing this very thing while trying to do work from the infusion clinic with a very aggressive outbound firewall.
Does anyone have a guide on getting wireguard + stunnel set up to evade DPS firewalls?
Why not Xray-core VLESS families? It sounds like your code is written by an LLM that is trained on Xray-core source code.
>stealth VPN with end-to-end encryption
Not sure what this means. AFAIK all VPNs have end-to-end encryption. Stealth ? will need to read to see what that means.
a vpn that bypasses deep-packet-inspection firewalls by simulating common HTTPS traffic
> We believe privacy should be proven, not promised
Then instantly gives you a shell script that it pipes to `sudo bash`. The irony isn't lost here.
That's also the cost of providing convenience AND something that can open port 443
Also the suggested installation method of at least: rust, bun, uv, deno, and homebrew
Such a tired trope. If you want to do it the hard way, you are welcome to build by hand https://github.com/PDG-Global/rVPN-core#building
Just because everyone else is doing it doesn't mean it's right.
> curl https://[...] | sudo bash
> [...] verifies checksum [...]
Phew, good thing it verifies that, otherwise piping unverified output to a sudo shell could be dangerous!
There's only 4 mentions of Rust on the landing page. Are we sure this is memory safe enough?
To be extra sure I saved a copy on a spinning platter of iron oxide.
I am all for exciting new VPN technologies but even the home page is vibecoded.
> Many flows. One connection shape
Shape, shape... shape.
I feel up until AI, nobody with their right mind would refer to the shape of a connection.
That's how you know there's nothing exciting here. Just some ordinary technology rehyped by AI phrasing.
Yeah. Sounds like just wstunnel would be equivalent in many ways.
https://github.com/erebe/wstunnel