How to Build a Mesh VPN Without WireGuard
Details on building a mesh VPN using iroh instead of WireGuard. How I overcame challenges like NAT traversal and peer discovery.
When starting to build TunTun, I initially planned to use WireGuard, but soon realized it was just a tunnel. The real challenge lies in enabling machines to discover each other and handle NAT traversal. Thus, I opted for the Rust library iroh, which allows connections via cryptographic keys instead of IP addresses.
The purpose of a VPN is for applications to remain unaware of its existence. I utilized a TUN device to route traffic seamlessly. The choice of QUIC datagrams was to avoid the issues of dual reliability layers in TCP. I discovered that the performance bottleneck stemmed not from encryption but from system calls, and I learned the importance of batching packets to enhance performance.