11 comments

  • mrbluecoat6 hours ago
    Very cool! Thanks for supporting open source (unlike a half-hearted attempt, like ExpressVPN&#x27;s Lightway). Quick question: the website animated gif has no arrows from the website to the VPN server. Am I missing something?<p>Update: just followed the quickstart and worked great; speed is virtually line speed - impressive!
  • stefanha8 hours ago
    Link to the protocol specification: <a href="https:&#x2F;&#x2F;github.com&#x2F;TrustTunnel&#x2F;TrustTunnel&#x2F;blob&#x2F;master&#x2F;PROTOCOL.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;TrustTunnel&#x2F;TrustTunnel&#x2F;blob&#x2F;master&#x2F;PROTO...</a><p>It&#x27;s a thin HTTP&#x2F;2 and HTTP&#x2F;3 tunneling protocol for TCP, UDP, and ICMP traffic.<p>It should be easy to write an independent implementation based on this specification provided you already have an HTTP&#x2F;2 or HTTP&#x2F;3 library. Pretty neat!
    • dixie_land2 hours ago
      Looks very similar to the HBONE protocol the istio folks created for ambient mesh: <a href="https:&#x2F;&#x2F;istio.io&#x2F;latest&#x2F;docs&#x2F;ambient&#x2F;architecture&#x2F;hbone&#x2F;" rel="nofollow">https:&#x2F;&#x2F;istio.io&#x2F;latest&#x2F;docs&#x2F;ambient&#x2F;architecture&#x2F;hbone&#x2F;</a>
    • userbinator2 hours ago
      Basically a CONNECT proxy? That&#x27;s definitely not a difficult thing to write.
      • ameshkov1 hour ago
        More or less, built on top of it with added udp&#x2F;icmp.<p>When writing server and client a lot of time is consumed by additional features, not on implementing the spec itself. For instance, in order to be truly stealthy we have to make sure that it looks *exactly* like Chromium on the outside, and then maintain this similarity as Chromium changes TLS implementation from version to version. Or here’s another example: on the server-side we need to have an anti-probing protection to make it harder to detect what the server does.
        • eptcyka58 minutes ago
          QUIC CONNECT supports UDP too now.
          • ameshkov43 minutes ago
            We support both H2 and H3 and this is necessary. QUIC is not bad, but there are places where it either does not work at all or works too slow.<p>And one more thing, even though the code and spec is only published now, we’ve been using TrustTunnel for a long time, started before CONNECT_UDP became a thing.<p>We’re considering switching to it though (or having an option to use it) just to make the server compatible with more clients.
  • ameshkov9 hours ago
    Hi, I’m one of the people working on this.<p>One clarification that may not be obvious: open-sourcing this isn’t primarily about signaling or auditability. If that were the goal, a standalone protocol spec or a minimal reference repo would have been enough.<p>Instead, we’re deliberately shipping full client and server implementations because the end goal is for this to become an independent, vendor-neutral project, not something tied to AdGuard.<p>We want it to be usable by any VPN or proxy stack and, over time, to serve as a common baseline for stealthy transports — similar to the role xray&#x2F;vless play today.<p>Happy to answer questions or clarify design choices.
    • rfv67236 hours ago
      Does your team have Chinese memebers?<p>GFW has been able to filter SNI to block https traffic for a few years now.
      • ameshkov1 hour ago
        We do, and from what we know a bigger problem in China is detecting traffic patterns. SNI filtering is not that big of a deal, in order to block your domain it needs to first learn which one you’re using. What for the traffic patterns, people in China prefer to selectively route traffic to the tunnel. For instance, the client apps allow you to route *.cn domains (or any other domains) directly. It makes it harder to detect that you’re using a VPN.
        • eptcyka57 minutes ago
          How do you do this on iOS?
          • ameshkov41 minutes ago
            You mean in TrustTunnel apps? You can create a routing profile there and select which domains&#x2F;ips are bypassed, and then select that routing profile in the vpn connection settings.
      • gruez5 hours ago
        &gt;GFW has been able to filter SNI to block https traffic for a few years now.<p>SNI isn&#x27;t really the threat here, because any commercial VPN is going to be blocked by IP, no need for SNI. The bigger threat is tell-tale patterns of VPN use because of TLS-in-TLS, TLS-in-SSH, or even TLS-in-any-high-entropy-stream (eg. shadowsocks).
        • rfv67234 hours ago
          &gt; because any commercial VPN is going to be blocked by IP, no need for SNI.<p>Proxy server can hide behind CDN like Cloudflare via websocket tunnel.<p>This is why GFW develops SNI filter, Cloudflare is too big to block.
          • eptcyka56 minutes ago
            CDN traffic is quite expensive, don’t believe it would be feasible to provide a VPN product for that. But for individuals, sure.
          • gruez4 hours ago
            &gt;Proxy server can hide behind CDN like Cloudflare via websocket tunnel.<p>cloudflare doesn&#x27;t support domain fronting so any SNI spoofing won&#x27;t work.
    • vitorsr8 hours ago
      Thanks for all impressive work on AdGuard.<p>Any particular reason to adopt Rust for this project instead of Go as many of your other products?<p>Because I think since you have quite extensive Go codebase I would imagine you had to rewrite possibly a significant amount of code.
      • ameshkov1 hour ago
        Performance reasons aside, TrustTunnel is developed by the team whose main language is C++ (and the client library is actually written in C++) so Rust was a more natural choice for them.
      • eptcyka55 minutes ago
        Embedding Go code into other binaries sucks ass. Debugging is worse, it installs some signal handlers.
      • rcoder7 hours ago
        Likewise interested in the authoritative answer, but: if I needed to write a decent chunk of code that had to run as close to wire&#x2F;CPU limits as possible and run across popular mobile and desktop platforms I would 100% reach for Rust.<p>Go has a lot of strengths, but embedding performance-critical code as a shared library in a mobile app isn&#x27;t among them.
  • denkmoon8 hours ago
    What makes this worth using over something like vless? Work blocked my gatcha game so I&#x27;ve had to set up a xray&#x2F;vless&#x2F;xhttp&#x2F;tls proxy and it works flawlessly. Gets through the corp firewall unscathed at full bandwidth and no appreciable increase in latency.
    • subscribed7 hours ago
      Could you please drop names&#x2F;links to the magic sauce if there&#x27;s anything more than the names mentioned?<p>I need to open ssh myself and for now I decided on tunnelling over http&#x2F;3 terminated somewhere in aws&#x2F;gcp&#x2F;cf, but maybe your method is better.
      • dfadsadsf5 hours ago
        Just use Amnezia VPN - it can masquerade as https.
        • subscribed20 minutes ago
          I can&#x27;t, my endpoint runs software enforcing compliance. &quot;no disallowed VPN software&quot; is one of the rules.<p>Besides, where&#x27;s fun in it :)
  • nfgrep2 hours ago
    Super cool stuff! Excited to see what p2p between clients might look like, and how it compares on speed with Wireguard.
  • almaight4 hours ago
    Does it support the mwss protocol?
  • reader92744 hours ago
    How does this compare to Obscura
    • mrbluecoat4 hours ago
      Obscura is WireGuard-over-QUIC, not a new protocol.<p><a href="https:&#x2F;&#x2F;obscura.net&#x2F;#faq-technical" rel="nofollow">https:&#x2F;&#x2F;obscura.net&#x2F;#faq-technical</a>
  • zx80809 hours ago
    I&#x27;m surprised that the browser extension to block ads has a proprietary vpn-like protocol. WTF?
    • ameshkov9 hours ago
      One interesting thing I’ve noticed is that AdGuard means different things in different parts of the world. In some places, people know us primarily as an ad blocker, in others we’re best known for our DNS service and in some regions AdGuard is associated almost exclusively with our VPN. The reality is that AdGuard makes several different products, not just one.
      • 0x1ch7 hours ago
        I&#x27;m an American. I knew about the VPN service, but mostly associate your brand with the DNS services and lists you provide (thank you!).
      • kidfiji2 hours ago
        And AdGuard Home is a wonderful alternative to Pi-hole :)
        • ameshkov1 hour ago
          Yay, thank you! :)<p>I wish we finish with redesigning it nicely this year and finally after all those years we will finally call it v1.0
          • figmert25 minutes ago
            Wow! Am I about to live to see the day?! I&#x27;ve been following the releases fairly closely, and looking forward to it.
    • jabroni_salad9 hours ago
      One of my first experiences with adguard was using it to block ads on an unrooted phone. It pipes your connection through a local vpn to do it.
  • huflungdung7 hours ago
    [dead]
  • sillyfluke11 hours ago
    It would be also nice if they could hold their implicit promise of having the AdGuard extension working on Safari iOS, it&#x27;s broken for me even when I reinstal it. Anyone else have the same problem?
    • ameshkov9 hours ago
      This is not a common issue tbh. What sometimes may happen is that after an iOS update the content blockers in Safari becomes corrupted and the only thing that fixes it is not just a reinstall, but uninstall + reboot + reinstall after that. If even this doesn’t help please contact me at “am at adguard.com”, I will try to help.
      • sillyfluke9 hours ago
        Thanks for the suggestion! I&#x27;ll definitely try the uninstall-reboot-reinstall flow. I was about to switch browsers on all the elderly devices.