<![CDATA[Overlay networks built on WireGuard can make dispersed devices appear to share one local network, but two obstacles remain: endpoints behind address translation are not directly reachable, and WireGuard's fixed default port is an obvious target for provider traffic discrimination. This study aims to design and empirically evaluate a hybrid overlay that mitigates both. We built WireGuard Manager, a single-binary Windows application combining a hub-and-spoke baseline with an opportunistic direct mesh over an in-process WireGuard data plane and host-orchestrated hole punching, and evaluated it on three physical nodes across two cities and three providers using throughput, latency, and packet-loss measurements. Results show that carrying the tunnel over the default port collapsed throughput to roughly 1–4% of a control port over the identical link (from 7.6–22.1 Mbps to at most 0.33 Mbps), while a randomized stealth port restored it; direct and relayed paths were validated independently through the observed time-to-live, and a live trace captured the automatic failover between them. A secondary result is that a direct path is not always superior to a well-provisioned relay. We conclude that provider port discrimination is a decisive, reproducible factor for such overlays and that a stealth-port strategy is an effective, low-cost mitigation, within the limits of a three-node case study.]]>
Copyrights © 2026
