Yet another Hacker News

rVPN – stealth VPN with end-to-end encryption

55 points michaelsbradley 3 hours ago 49 comments

dieseltech 2 hours ago | parent

> We believe privacy should be proven, not promised

Then instantly gives you a shell script that it pipes to `sudo bash`. The irony isn't lost here.

Carrok 2 hours ago | parent

Also the suggested installation method of at least: rust, bun, uv, deno, and homebrew

Such a tired trope. If you want to do it the hard way, you are welcome to build by hand https://github.com/PDG-Global/rVPN-core#building

drum55 2 hours ago | parent

Just because everyone else is doing it doesn't mean it's right.

TZubiri 32 minutes ago | parent

>Such a tired trope.

Criticism doesn't expire or saturate, if something is wrong, and people continue to do it, it's still wrong thereafter

hirako2000 2 hours ago | parent

That's also the cost of providing convenience AND something that can open port 443

PUSH_AX 2 hours ago | parent

There's only 4 mentions of Rust on the landing page. Are we sure this is memory safe enough?

cowlevel 2 hours ago | parent

To be extra sure I saved a copy on a spinning platter of iron oxide.

tptacek 2 hours ago | parent

Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it.

WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport.

We did this at Fly.io when we discovered that, for one reason or another, 5% of our users simply couldn't reliably use UDP. It was a one-day project to run it under WebSockets instead, and that was before coding agents.

drum55 2 hours ago | parent

Wireguard is both really useful and pretty frustrating as a user. As a developer it's amazing that you can do things like relay packets through a bouncer with authentication to get around NAT without ever having to think about the protocol level safety, as a user it's near impossible to configure without the confused "why are no packets working", and as you had here it just doesn't make it through a lot of restrictive networking conditions. I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them.

The parent is obviously just Claude making a fancy website and some sort of unreviewed networking protocol that's dressed up to look as if it's a real project. Github really needs to start showing commit cadence and repo birthdates.

joecool1029 2 hours ago | parent

> I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them.

netbird's a thing to check out if you want an alternative to tailscale you can self-host.

drum55 2 hours ago | parent

Netbird also, at least to me, has much too much stuff in it, perhaps even more. I would love to be able to connect to everything reliably no matter the network, the daemon doesn't need a reverse proxy, Ai agent routing and billing, in browser SSH client, it's all just attack surface. Tailscale allows you to compile a lot of it out as of a couple of weeks ago, but it's still an awful lot of code.

tamimio 1 hour ago | parent

Netbird doesn’t have proper network isolation, due to its shared policy space compared to one gateway interface per customer/organization. Which is not an issue if you are the only user, but if you are building a service for customers to use, and there’s a potential scale up, it will be an issue, either having multi account mode which will results in many resources you need to deploy or containers per customer, or, having them all shared policy that could potentially allow customer to customer access if misconfiguration happens, alternatively, building a gateway in the middle to broker it all but traffic must pass through which is operational cost plus extra latency, and even privacy concerns.

tamimio 1 hour ago | parent

Which is why I am building my stuff around iroh instead.

WhyNotHugo 2 hours ago | parent

> Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it.

Why TFA explains it, it's also in the title: "stealth". WireGuard is trivial to detect and block, and has no aspirations at being stealth.

ronsor 2 hours ago | parent

He literally acknowledged that:

> WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport.

UqWBcuFx6NV4r 1 hour ago | parent

Please read the full comment before replying.

nyeki 1 hour ago | parent

Yeah, I just forwarded my wireguard connection through websockets with this and even though it's way slower it works just fine. Not even 1000 loc i think.

https://github.com/nekidev/tow

tptacek 1 hour ago | parent

And even if you don't tunnel an existing WireGuard implementation (ideally, you would, to inherit the security track record of that implementation) you at least get the design right. Doing a brand new encrypted transport design for no good reason is a weird red flag for me.

aborsy 1 hour ago | parent

If you wrap wireguard or build a layer on top of it, it's no longer wireguard that first listens to packets on public interface, it's your wrapper. The security properties of wireguard don't hold (potential for RCE before packets reach wireguard). That's a problem with projects like wstunnel or udp2raw.

You want wireguard to be the software that takes the packets first.

tptacek 1 hour ago | parent

This isn't true. You don't lose the security properties of WireGuard just because you wrap it in some other transport. There is no particular virtue to it "taking the packets first".

aboardRat4 58 minutes ago | parent

>The security properties of wireguard don't hold

That's plain wrong. The first thing a normal wireguard faces is... the wild network of the Internet, with many servers and hordes of malicious agents. This is what makes is an "encrypted VPN", it's expected to withstand being transmitted by garbage media.

>potential for RCE before packets reach wireguard

There is no such thing as "rce packets". Moreover, every wireguard implementation has a different surface for RCEs (bugs), it's not a property of wireguard, it's a property of the implementation, of which there are at least three.

thadt 39 minutes ago | parent

> There is no such thing as "rce packets".

I mean, that depends quite a bit on the code reading the packets, no?

My interpretation of OP is that they trust Wireguard’s code to be secure - random wrappers, somewhat less so.

aborsy 33 minutes ago | parent

You didn't get it. It would be more clear if you implement it.

With these wrappers, peers also run wrapper and unwrapper services, to encapsulate udp packets into websocket frames and vice versa. For example, the software that proceses incoming packets from the internet could be wstunnel listening on 443/TCP. This layer converts the websocket TCP traffic to wireguard UDP, which wireguard would then decrypt. Wireguard could even listen to local host.

However, those layers could be insecure, and may lead to code execution on server before wireguard is even involved.

tptacek 30 minutes ago | parent

No, the parent commenter's logic is sounder than yours. WireGuard in its natural configuration can't trust incoming packets at all, so there's nothing to subtract by layering things on top of it.

Obviously, all software creates an opportunity for a bug, so even though this is pretty low-risk as attack surface goes, if you're making a choice between plain natural WireGuard and WireGuard wrapped in WebSockets, the "plain" version has marginally less attack surface.

But if your choice is between WireGuard wrapped in WebSockets or an entire new VPN protocol, clearly the new protocol drastically increases the attack surface.

In any case: wrapping WireGuard with something else does nothing at a design level to put WireGuard's security at risk. That's not how it works.

aborsy 20 minutes ago | parent

In your implementation, you wrote software that listens to public internet, takes as input websocket traffic and outputs UDP. Right there, there is potential for vulnerabilities and code execution. This piece has nothing to do with software that would next process UDP.

That's why wireguard over TCP is not as secure as wireguard UDP.

tptacek 13 minutes ago | parent

This makes no sense. It's marginally less safe to accept UDP packets than TCP packets, for which you at least need to complete a 3WH to deliver frames. I don't think you've thought this through.

justsomehnguy 9 minutes ago | parent

> You want wireguard to be the software that takes the packets first.

Congratulations, DPI marked your connection as... WireGuard and blocked it.

I'd say you are now double safe - there is could be no RCE if there is no packets at all.

eric15342335 2 hours ago | parent

Why not Xray-core VLESS families? It sounds like your code is written by an LLM that is trained on Xray-core source code.

Sha1rholder 2 hours ago | parent

> Memory-safe in Rust > The core is written in Rust, so entire classes of vulnerability cannot occur.

Hmm... It just ain't true.

---

For those who need a "stealth VPN", use <https://github.com/XTLS/Xray-core/> or its GUI version <https://github.com/2dust/v2rayN/>

TZubiri 37 minutes ago | parent

There's this naive view of security where you can just 'add' security to something like you are applying some medicine. You add rust to software to increase security, you install antiviruses to computers to make them more secure..

lxgr 2 hours ago | parent

> curl https://[...] | sudo bash

> [...] verifies checksum [...]

Phew, good thing it verifies that, otherwise piping unverified output to a sudo shell could be dangerous!

therein 2 hours ago | parent

I am all for exciting new VPN technologies but even the home page is vibecoded.

> Many flows. One connection shape

Shape, shape... shape.

I feel up until AI, nobody with their right mind would refer to the shape of a connection.

cowlevel 2 hours ago | parent

That's how you know there's nothing exciting here. Just some ordinary technology rehyped by AI phrasing.

therein 1 hour ago | parent

Yeah. Sounds like just wstunnel would be equivalent in many ways.

https://github.com/erebe/wstunnel

jmclnx 1 hour ago | parent

>stealth VPN with end-to-end encryption

Not sure what this means. AFAIK all VPNs have end-to-end encryption. Stealth ? will need to read to see what that means.

tonymet 1 hour ago | parent

a vpn that bypasses deep-packet-inspection firewalls by simulating common HTTPS traffic

TZubiri 30 minutes ago | parent

I read that as destination hosts being unable to distinguish a VPN user from a regular user.

The typical use case for this is usually malicious btw, and the means to do this are residential proxies, which again are usually maliciously obtained

tonymet 1 hour ago | parent

i was needing this very thing while trying to do work from the infusion clinic with a very aggressive outbound firewall.

Does anyone have a guide on getting wireguard + stunnel set up to evade DPS firewalls?

munro 1 hour ago | parent

I discovered recently Three UK is slowing down port 443, and if I started using 2000-3000 port range it increased my speeds 10x

amir734jj 1 hour ago | parent

Do you have a Docker image available? I want to run this on my Coolify server. I have a V2Ray for my family in Iran setup currently and I am wondering how this hold up.

f311a 1 hour ago | parent

It’s not enough to put everything in https if you really want to circumvent modern censorship technology.

rock_artist 1 hour ago | parent

> The mobile apps are paid. Development is fully funded by PDG Global Limited; revenue from app sales, together with donations, contributes towards development costs. The core remains open source under AGPLv3.

lifeisloving 1 hour ago | parent

I cant find anything on this company, but I got to say im sussed out by any VPN who's three language options are English, Russian and Chinese. It screams spook activity.

petu 1 hour ago | parent

Throw in Iran/Farsi and you've probably covered >80% of the stealth VPN market/users. Normal protocols get blocked in those countries, so.

aboardRat4 54 minutes ago | parent

>im sussed out by any VPN who's three language options are English, Russian and Chinese. It screams spook activity.

Not at all. China, Russia, and Iran are the three biggest markets for VPNs.

In China about 150 million people use a VPN, in Russia about 60 million, about half the population

gruez 53 minutes ago | parent

>It screams spook activity.

Like, it's a FBI honeypot or it's a CIA op to help dissidents?

prima-facie 47 minutes ago | parent

Proxyguard already fills this niche using Wireguard over HTTPS and is not a vibe-coded project. https://codeberg.org/eduVPN/proxyguard

breakwaterlabs 26 minutes ago | parent

It is possible to write a TLS-on-443 VPN that is hard to distinguish from HTTPS.

However, if someone claims (or as good as) that "encrypted over TLS on 443" intrinsically pos5esses this property, they demonstrate that they

• do not understand the state-of-the-art in L7 firewalls as of 2010, let alone today

• don't understand common enterprise and state-level controls like HTTPS decrypt (which instantly break this)

• haven't read any of the last decade of papers on detecting protocols like obfsproxy

• haven't even bothered to look at existing takes on this (like tor) and the compromises that they make

---

From the whitepaper:

> Desktop, CLI, and Android clients use BoringSSL to mimic a Chrome TLS 1.3 ClientHello fingerprint, helping evade deep-packet inspection.

Do you set an SNI / eSNI? No? Trivially detectable. I believe Palo Alto AppID would flag this instantly as non-HTTPS masqueraded traffic.

Go fire this up behind China's golden shield, and see how many minutes your tunnel stays performant before they tarpit you; then come write a whitepaper.