Nardi Nardi
Undergraduate Program in Applied Instrumentation Meteorology Climatology Geophysics, STMKG, Tangerang, Indonesia

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

A WireGuard Mesh Overlay Resisting Internet Provider Port Policing Aviv Maghridlo; Nardi Nardi; Marzuki Sinambela
Jurnal Info Sains : Informatika dan Sains Vol. 16 No. 02 (2026): Info sains, 2026
Publisher : SEAN Institute

Show Abstract | Download Original | Original Source | Check in Google Scholar

Abstract

Overlay networks built on WireGuard can make dispersed devices appear to share one local network, but two obstacles remain: endpoints behind address translation are not directly reachable, and WireGuard's fixed default port is an obvious target for provider traffic discrimination. This study aims to design and empirically evaluate a hybrid overlay that mitigates both. We built WireGuard Manager, a single-binary Windows application combining a hub-and-spoke baseline with an opportunistic direct mesh over an in-process WireGuard data plane and host-orchestrated hole punching, and evaluated it on three physical nodes across two cities and three providers using throughput, latency, and packet-loss measurements. Results show that carrying the tunnel over the default port collapsed throughput to roughly 1–4% of a control port over the identical link (from 7.6–22.1 Mbps to at most 0.33 Mbps), while a randomized stealth port restored it; direct and relayed paths were validated independently through the observed time-to-live, and a live trace captured the automatic failover between them. A secondary result is that a direct path is not always superior to a well-provisioned relay. We conclude that provider port discrimination is a decisive, reproducible factor for such overlays and that a stealth-port strategy is an effective, low-cost mitigation, within the limits of a three-node case study.