https://github.com/erebe/wstunnel seems like the obvious solution.

Or maybe OpenVPN over normal TLS on port 443.

You could try to run Wireguard on a different port which would be otherwise used by some very common service, maybe there’s some general exemption for port 21, 22, 53, 80, 443…

Does netbird run on wg on on ovpn as well? Maybe that’s an option…

I’m not really an expert on VPN, but I believe solutions like Tailscale, Netbird, Pangolin all leverage the Wireguard protocol.

Yeah, WG is by far the best way to do this kind of networking.

NetBird is Wireguard yes.

OpenVPN is my current method. Got it running on port 443 with user certificate authentication, and tls-crypt on top of that to completely mask the protocol from VPN detectors.

Also technically prevents DoS attacks, but that wasn’t my primary goal.

Wow, wstunnel seems to be a very elegant solution, thanks! However I still need to figure out how to get to my server behind a NAT

Port forward your SSH-server. You can forward ports through SSH to access web services or others running on the server or anything else in the network.

But only allow access through keys. And maybe try to use a different port than 22. That usually gets hammered a lot, trying to find accounts with weak passwords.

Changing the port doesn’t actually accomplish much

Best practice is to just harden SSH so that not traffic gets nowhere

Yep, that a good option. But only with a key ! Not with a password.

Bot from everywhere will try to forcebrut attack with many password attempt.

I got in this situation in the past. Nothing wrong happened, but it was stressfull.

Self hosted networking! Legitimately one of my favourite topics

You won’t get around the requirement of a publicly reachable endpoint. That can either be a small server with a public ip or dynamic DNS to your home with port forwarding for the VPN.

A classic option is OpenVPN. You can run it on Port 443 in TCP mode and while it won’t be performant, it has a better chance of bypassing most simple blocks

Other than that I’m a fan of completely decentralized mesh VPNs.

The one I use and am most familiar with is Yggdrasil. Connections can be established over TCP, TLS or QUIC on any port you want.
I’ve written a somewhat lengthy comment under this post. One advantage to Yggdrasil would be its existing public network. If you can firewall of your home lab to the point where joining the public network doesn’t expose a security risk to your local network, you could use that to transport your traffic instead of having your own public node or port forwarding.

The same post also mentions Anywherelan, it’s intended to have better NAT handling out of the box by using community nodes.

Then there’s also EasyTier mentioned at the bottom, it is a Chinese project and those tend to have good censorship resistance.

Finally I’ll mention Nebula, it requires at least one coordination server but might also be an option

Thank you for your info, I’ll be checking out these projects.

Nebula might actually work as it doesn’t use Wireguard

That’s quite fascinating, didn’t realize Wireguard could be blocked in that way (although the WG traffic is pretty obvious looking, so it makes sense). The only solution I know of without a need for a VPS is hosting everything on Tor. Wildly private and secure, but also wildly slow. Beyond that, there are a number of ways of using a VPS to similar effect, I know people have used Cloudflare Tunnel to similar effect in the past.

Also, there are apparently quite a number of wiregaurd derivatives which protect better against detection and blocking methods. amnezia and wstunnel are the two that came up. Likewise, you will need a VPS, and might even be able to set up a tailscale-like coordination server that way (maybe with headscale, or maybe with one of its competitors like NetBird).

ZeroTier might also get the job done, but I really don’t know much about it.

Hope this helps, and good lucks!

Thanks! I do have a VPS. Can amnezia or wstunnel be used with headscale? That’d be amazing

In theory yes, in practice, I have no idea. My guess is you would need to soft-fork the project to get it using either project, or maybe be really, really nice to the devs and ask them to support additional protocols. Technically there is no reason it wouldn’t work, but whether or not there are enough people with your usecase for devs to justify implementing a new feature is another matter entirely.

Wow. Do they block VPNs inside your country too?

Anyway, there’s openvpn and there’s nebula (I think nebula doesn’t use wireguard… do double-check), or you look into things built specifically to hide traffic (keyword: “vpn obfuscation”).

No idea if VPN protocols other than wireguard may be blocked too (probably?).
No idea if trying too hard to circumvent government policies may get you added to some list you’d rather not be in.

From what I can tell, the issue with Wireguard is that the traffic is quite obvious. Other options might be blocked, but technically harder to implement said blocks.

Wireguard is effectively blocked in China, from my experience so far.

China uses deep packet inspection so that makes sense

I think the the great Firewall is less restrictive with QUIC traffic. It might be worth trying fragmented QUIC as from what I’ve read the GFW struggles to reconstruct the traffic

I use two services that do work and alternate between them: Mullvad with Obfuscation turned on, and Ghelper paired with Shadowrocket (China side ones used by Chinese devs)

Can you switch to IPv6? My ISP NATs me on IPv4 but I’m clear through on IPv6 and so that’s how I run everything.

I’m assuming the NAT is your ISP’s, if it’s yours then ignore me.

Damn I haven’t thought of this, thanks!

www.defined.net

There is Nym

It’s not open source as far as I can tell

github.com/nymtech/nym-vpn-client

See if you can use ZeroTier. It doesn’t use wire guard but rather their own protocol as far as I know.

OpenVPN on port 443 would be my guess. Just regular nat or carrier grade nat.

I had luck with zerotier before switching to wireguard, but I imagine it has similar issues as talescale. Worth a try

Big Netbird fan, and they support a fully self hosted version.

netbird uses wireguard as vpn protocol

Possibly Tor? It supports TCP traffic so SSH should work

Outside of that I would look into censorship resistant protocols and techniques. What country are you in?

Tor is slow and… also blocked here 😁

I know of many working VPN protocols but I don’t know how to use them to route traffic through an intermediary VPS (bc my home server is behind a NAT)

You can use Tor snowflakes or bridges to bypass restrictions

First, you need to verify whether you actually have a public IP or if your ISP has you stuck behind CG-NAT, because that dictates your options.

​If you’re behind CG-NAT, ​Cloudflare Tunnel (cloudflared): This is usually the easiest path if you are mostly trying to access web-based services (HTTP/HTTPS) on your server. Your home server initiates the outbound connection to Cloudflare, so CG-NAT doesn’t matter. You just set up a domain (or subdomains) for each service you want to reach. If you need full network-level or SSH access rather than just web apps, check out ZeroTier.

​If you have a direct public IP (even a dynamic one), you can run a reverse proxy like Caddy paired with a free DDNS provider like DuckDNS or FreeDNS. One nice thing about Caddy is that it handles getting and renewing real, valid Let’s Encrypt SSL certificates automatically, so you don’t have to deal with manual or self-signed certs at all.

​Dealing with the WireGuard block, if your country’s ISP is using Deep Packet Inspection (DPI) to identify and drop WireGuard traffic, traditional VPNs like OpenVPN might get blocked pretty quickly too. If you still want a true VPN setup, look into AmneziaWG (it’s a fork of WireGuard specifically modified to scramble packet signatures and bypass DPI) or obfuscated proxy protocols like V2Ray / Xray or Shadowsocks.

Can you port forward on the router?

Sure, but they shouldn’t.

Why? wireguard doesn’t respond if the keys are wrong.

WireGuard doesn’t work at all because it is blocked in OP’s country. OP wants an alternative. Dumping all security and encryption is certainly an alternative, but I am certain that this is counter to what OP is trying accomplish, given their initial choice of Tailscale (WireGuard on steroids).

Not really, but I wouldn’t directly expose my server anyways

AmneziaWG is a Wireguard fork built against deep packet inspection, try that.

Neat, I might have to set this up for myself. It sounds like it could get around some of the VPN blocking I’ve seen while traveling through airports.

Yes it’s what I use for normal VPN, but I need to get around the NAT somehow. There’s been a PR for NetBird that implements AWG but it was never merged

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters CGNAT Carrier-Grade NAT DNS Domain Name Service/System ISP Internet Service Provider NAT Network Address Translation SSH Secure Shell for remote terminal access TLS Transport Layer Security, supersedes SSL Unifi Ubiquiti WiFi hardware brand VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)

9 acronyms in this thread; the most compressed thread commented on today has 18 acronyms.

[Thread #84 for this comm, first seen 21st Aug 2026, 16:20] [FAQ] [Full list] [Contact] [Source code]

OpenVPN in TCP mode wrapped around Stunnel. That’s the thing that works.

I have it set up to bypass VPN restrictions in some networks, but it also serves to bypass a lot more stuff if you know what you’re doing.

DPI will only see TLS traffic, and assume it’s HTTP. You can even try to fool it by modifying the packet headers, so dumb enough DPI will think you’re connecting to the site you choose.

We have had success with this on port 443 and it appears to do a good job on networks that only allow browsing. Usual problems with TCP based VPN still apply.

I’m new to all this, how is wireguard banned and enforced? Seems odd

I’m an expert at nothing, but I would imagine that different VPN like WireGuard have different detectable signatures, much like different browsers have different signatures that can be detected. Also, for commercial VPNs, the IPs that the VPN company uses are easily identifiable.

WG is not meant to be a stealthy protocol and is easy to detect at the ISP level. It has distinct characteristics that packet inspection tools can use to identify it by examining the traffic and block or flag it. Blocking it completely is trivial for any ISP, much less a nation.

There are modified versions like AmneziaWG that make it stealthier, or alternative protocols built to evade traffic inspection like xray or sing-box (these two are really more like protocol frameworks that have multiple protocols you can use). It’s a bit of an arms race for packet inspection tools to be able to reliably identify these intentionally stealthy protocols, but the advantage is generally in your favor as long as you are using your own servers and not public VPNs. Though even then you need to take care to camouflage your traffic to be truly safe, like if you are shoving all of your traffic through one remote server that has approximately the same amount of traffic going out immediately etc that is something that can also be identified.

How much precaution is actually warranted depends on where you are and what the potential consequences are. You don’t have to go to a full tinfoil hat paranoia level setup to avoid most blocking.

I’ll recommend this new VPN thing :

rayfish.xyz

Its new so its evolving quickly with weekly releases and nightly builds.

Lots of people have told me about their grievance list due to AI having a big part in the development. It’s a bunch of guys in the team, so there’s the human element there.

As for my opinion, it’s the only VPN I’ve managed to get working on my own.

I lost connection yesterday and I am not sure what happened but my home computer and my phone were on the same VPN constantly for a week. Jumping from the house WiFi to 5g didn’t break the VPN connection but it did take a few seconds the first time I did it.

My other option would be Tailscale.

Update on the lost connection. I had restarted my computer and that changed my firewall device name for the VPN. So it was not rayfish related. It’s been pretty steady since.

vibecoding and security don’t pair well.

You’re right. It’s kind of how Michael Jackson music doesn’t mix well with orchestra music:

www.youtube.com/watch?v=RXbdLfzGwHU

Looks promising, but the ai part throws me off too. But I’ll give it a try

Wireguard is blocked in my country

RIP

So this has been interesting to me as I’m travelling at the moment and wireguard has been blocked on the guest wifi I’ve been on across the hotels, I’ve had to rely on cellular instead.

I’ve just tried Teleport on my Unifi router and that works. I believe it uses wireguard, and it is taking up to 20secs to connect, but I’m now curious as to what it’s doing to bypass the VPN restrictions that are blocking plain wireguard.

How is this even a thing? Businesses can’t just have open network connections.

You could set up wireguard via stunnel maybe to port 22

Run ssh on an Onion Service.

Best solution is to organize revolution to kick out the fascist that censored the internet by protocol

So helpful! Bet you’re fun at parties.

The phrase “fun at parties” has been banned from my sight. I cast Quickened Spell: 1000 Downvotes

That’s an ideal solution. The best solution is what works immediately and within your capabilities.

that is neither easy nor quick.

Nothing worth having ever is.

Well you’d still depend on someone else’s will to provide you with robust and uncensored internet connection. The actual solution is to build a decentralised people-owned network using Reticulum for example. Reticulum over WiFi HaLow already works very well for small-scale local networks.

Sing-box is a VPN tool built to evade censorship github.com/SagerNet/sing-box . It is extremely resilient and stealthy.

See also, xray and v2ray, which are similar, but in my experience sing-box is a bit better documented (at least in English) and has better maintained client apps.

Setting any of these up can be complicated, but LLMs can get you pretty far if you have safe access.

Could use SSH tunnel to an entry point

Yes, I’ve tried that, but it’s not robust enough. This is what I’ll eventually resort to, if I don’t find a better solution.

Tor Hidden Services, easy to set up on the server side, can be annoying on the client side but HTTP and SSH are fine. Can be a bit slow but IMHO still usable.

Your NAT or CGNAT? If you control it, then you can allow your incoming connection. Tailscale is only needed if you don’t have control of NAT, like an ISP implementing CGNAT.

Alternatively, do you have an IPv6 address?

I haven’t tried it myself but I’ve been looking at NetBird.

Elevator pitch page

Maybe others who’ve used it or know more can chime in on if this is a good idea or not?

It’s also wireguard…

Yes, that’s what I used to use! Love it, but wireguard is blocked

Have you tried replacing your country?

Witrguard

Can you set your NAT to port forward a port to your ssh host?

I’m currently using yggdrasil to deal with this problem, though I’ve also used tor hidden services.

This is what I do. For best security practice, make sure to use public key authentication and disable password authentication so nobody can even try to guess your password.

Unfortunately I’m behind CGNAT and yggdrasil is also partly blocked here (works super slow)

You might try adding more gateways to the conf file?

Or if you’ve got a host your trying to connect to I think I’ve seen people get a VPN connection through ssh? wiki.archlinux.org/title/VPN_over_SSH

Zerotier. They have their own protocol, and there’s a free tier that lets you connect up to ten machines to make a network.

Also possible to selfhost, although I haven’t done it.

Thanks! But zerotier is also blocked here 😅

Based on what you planning to do, maybe mTLS could be a solution.

I have successfully setup trojan / trojan-go on my server. It uses port 443 and will return a standard website if the connection is not recognized as an authorized trojan-go client. As stealth as it can get.

azadzadeh.github.io/trojan-go/en/

Thanks! Will look into it

Does amnezia work? Its obfuscated wireguard and is, according to their github, resistant to deep packet inspection and such