Have you tried ipop/social-vpn[0]? It uses libjingle (stun, turn, etc) to get through firewalls. I don't know much about it's security though, or if it has been audited.

[0] http://ipop-project.org/

I looked at tinc yesterday, but it seems there are two options:

1. the stable release which only supports RSA-2048 keys (giving it RSA-4096 keys resulted in really bizarre errors like "read public key file failed: Operation now in progress"), and

2. the unstable release which does not compile on my system because of broken dependencies (and even if I got it to work, I have huge reservations about using unstable releases of cryptographic systems).

Am I missing something?

It's a small open source project that works very well for a lot of people. If you need stronger keys for your use case you'll have to wait for 1.1 to be stable. For me VPNs are not about security they're about getting connectivity working between my machines in a uniform way on top of networks that have restrictions. For security I always assume the network is hostile, even if it is my own LAN or VPN.

Question: I've looked at tinc and really want to use it, but I have reservations about running a daemon as root on publicly accessible ports without being very confident in its security. I couldn't seem to find any mention of them ever being audited, although http://www.tinc-vpn.org/goals/ lists it as a goal. They do have a distinct lack of CVEs, but I can't tell if that's secure code or nobody looking. Any chance you (or another commenter) can make a case that it's safe to run tinc?

I hadn't looked at my config in a while and you're absolutely right, running as root is a big warning flag. Just fixed it with the tincd "--user" flag. Created a new tinc user that owns all of /etc/tinc and set "--user=tinc" in /etc/default/tinc. Runs fine.

> How well does it overcome firewalls?

I don't believe this is something wireguard cares about. It looks like they're aiming for doing in-kernel build-your-own routing VPN solution for servers where the networking is completely within your control. If you need a solution for privacy / working around provider limitations, then other software may be better.

There is a brief section dedicated to this: https://www.wireguard.com/quickstart/#nat-and-firewall-trave...

tl;dr keepalives and the expectation of a statefull firewall keeping things open.

Combined with touting IP roaming as a feature, I think it is something wireguard cares about.

With sslh you can use port 443 for both tinc and https. https://github.com/yrutschle/sslh

Also you can configure haproxy to do the same.