dumbproxy VS VxWireguard-Generator

Or instead you can have HTTP proxy over TLS in just four steps: https://github.com/Snawoot/dumbproxy/wiki/Quick-deployment

You don't even need a client for this, any modern browser can work with it right away: https://github.com/Snawoot/dumbproxy#using-http-over-tls-pro...

Or just consider some HTTP over TLS proxy like this one: https://github.com/Snawoot/dumbproxy

It may appear a bit more flexible option, especially if forwarding all traffic to VPN entirely is undesirable.

[Unit] Description=Dumb Proxy Documentation=https://github.com/Snawoot/dumbproxy/ After=network.target network-online.target Requires=network-online.target [Service] EnvironmentFile=/etc/default/dumbproxy User=root Group=root ExecStart=/usr/local/bin/dumbproxy $OPTIONS TimeoutStopSec=5s PrivateTmp=true ProtectSystem=full LimitNOFILE=20000 [Install] WantedBy=default.target

Tinc was my goto for years, but there is a non-trivial performance penalty for it's userspace implementation.

If you can enumerate all your endpoints into wireguard, and squint, it'll kinda-sorta act like a mesh.

And if you want to go a little crazy with it, You can run https://github.com/m13253/VxWireguard-Generator + babeld, and get routing around failures in the mesh.

https://github.com/m13253/VxWireguard-Generator

I'm using that in production with Babel (managing dynamic routes) with great success. Tinc had been solid for us for years, but once I actually payed attention to the performance hit, it was worth a bit of hassle to make it work over wireguard.