From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Jason@zx2c4.com Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 5dae5fef for ; Sun, 15 Jan 2017 10:07:14 +0000 (UTC) Received: from frisell.zx2c4.com (frisell.zx2c4.com [192.95.5.64]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 54253bf4 for ; Sun, 15 Jan 2017 10:07:14 +0000 (UTC) Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 1b0b6c9f for ; Sun, 15 Jan 2017 10:07:14 +0000 (UTC) Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 3c47e59d (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128:NO) for ; Sun, 15 Jan 2017 10:07:13 +0000 (UTC) Received: by mail-ot0-f174.google.com with SMTP id f9so28644395otd.1 for ; Sun, 15 Jan 2017 02:17:35 -0800 (PST) MIME-Version: 1.0 In-Reply-To: References: <20170108224117.GB9445@tuxmachine.polynome.dn42> From: "Jason A. Donenfeld" Date: Sun, 15 Jan 2017 11:17:33 +0100 Message-ID: Subject: Re: [RFC] Handling multiple endpoints for a single peer To: Ameretat Reith Content-Type: text/plain; charset=UTF-8 Cc: WireGuard mailing list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Mon, Jan 9, 2017 at 9:46 AM, Ameretat Reith wrote: > Another use case would be circumventing some crazy state backed firewalls > that drop or throttle -mostly UDP- connections having high bandwidths. If > peer is being used as gateway and nameserver resolver, it can be used to > rotate server IPs too; yet another method to bypass kind of blockages. That's another neat use case indeed. Baptiste's auto RTT-sensing idea would automatically figure out which IPs the firewall has throttled. (I suspect, however, that WireGuard isn't designed long term to deal with state sponsored firewalls and such; it's fingerprintable, as discussed earlier on the mailing list. Good approaches to building "unblockable VPNs" probably include something like symmetric crypto only, so that there's no protocol or handshake, with large random nonces (XChaPoly), forming messages that are indistinguishable from random, which are then massaged into resembling valid gzip'd data, and then placed below a valid HTTP header on port 80... or something wild like this.)