rVPN – stealth VPN with end-to-end encryption

dieseltech

> We believe privacy should be proven, not promised Then instantly gives you a shell script that it pipes to `sudo bash`. The irony isn't lost here.

PUSH_AX

There's only 4 mentions of Rust on the landing page. Are we sure this is memory safe enough?

tptacek

Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it. WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport. We did this at Fly.io when we discovered that, for one reason or another, 5% of our users simply couldn't reliably use UDP. It was a one-day project to run it under WebSockets instead, and that was before coding agents.

eric15342335

Why not Xray-core VLESS families? It sounds like your code is written by an LLM that is trained on Xray-core source code.

Sha1rholder

> Memory-safe in Rust > The core is written in Rust, so entire classes of vulnerability cannot occur. Hmm... It just ain't true. --- For those who need a "stealth VPN", use < https://github.com/XTLS/Xray-core/ > or its GUI version < https://github.com/2dust/v2rayN/ >

lxgr

> curl https://[...] | sudo bash > [...] verifies checksum [...] Phew, good thing it verifies that, otherwise piping unverified output to a sudo shell could be dangerous!

therein

I am all for exciting new VPN technologies but even the home page is vibecoded. > Many flows. One connection shape Shape, shape... shape. I feel up until AI, nobody with their right mind would refer to the shape of a connection.

jmclnx

>stealth VPN with end-to-end encryption Not sure what this means. AFAIK all VPNs have end-to-end encryption. Stealth ? will need to read to see what that means.

tonymet

i was needing this very thing while trying to do work from the infusion clinic with a very aggressive outbound firewall. Does anyone have a guide on getting wireguard + stunnel set up to evade DPS firewalls?

munro

I discovered recently Three UK is slowing down port 443, and if I started using 2000-3000 port range it increased my speeds 10x

amir734jj

Do you have a Docker image available? I want to run this on my Coolify server. I have a V2Ray for my family in Iran setup currently and I am wondering how this hold up.

f311a

It’s not enough to put everything in https if you really want to circumvent modern censorship technology.

rock_artist

> The mobile apps are paid. Development is fully funded by PDG Global Limited; revenue from app sales, together with donations, contributes towards development costs. The core remains open source under AGPLv3.

prima-facie

Proxyguard already fills this niche using Wireguard over HTTPS and is not a vibe-coded project. https://codeberg.org/eduVPN/proxyguard

breakwaterlabs

It is possible to write a TLS-on-443 VPN that is hard to distinguish from HTTPS. However, if someone claims (or as good as) that "encrypted over TLS on 443" intrinsically pos5esses this property, they demonstrate that they • do not understand the state-of-the-art in L7 firewalls as of 2010, let alone today • don't understand common enterprise and state-level controls like HTTPS decrypt (which instantly break this) • haven't read any of the last decade of papers on detecting protocols like obfsproxy • haven't even bothered to look at existing takes on this (like tor) and the compromises that they make --- From the whitepaper: > Desktop, CLI, and Android clients use BoringSSL to mimic a Chrome TLS 1.3 ClientHello fingerprint, helping evade deep-packet inspection. Do you set an SNI / eSNI? No? Trivially detectable. I believe Palo Alto AppID would flag this instantly as non-HTTPS masqueraded traffic. Go fire this up behind China's golden shield, and see how many minutes your tunnel stays performant before they tarpit you; then come write a whitepaper.

BatchJob

When I see stuff like this at first I think oh something I can use, and then the next thought is, wait is this to make it easier for bots to hammer the web undetected? Yes I think its really just the latter.