Ansible Playbook to install (dual stack) TunSafe VPN: WireGuard with obfuscation

edited May 2020 in Technical

Ansible Playbook I wrote to setup a dual stack* (IPv4/IPv6) TunSafe VPN with obfuscation.

TunSafe is a fast and modern VPN based on the WireGuard protocol. It is a point-to-point VPN, which means it does not have a client-server architecture, but peers, and does not rely on a PKI, unlike OpenVPN.

Please note that TunSafe is not affiliated with the WireGuard project. No support from the WireGuard project will be available and no statements about security from the official WireGuard project apply to tunsafe, nor will it receive (security) updates from WireGuard's upstream. TunSafe is developed by Ludvig "Ludde" Strigeus, best known for developing software such as the BitTorrent client μTorrent, OpenTTD, and Spotify.

*The playbook will try to detect if IPv6 connectivity is available and if so enable it for use with TunSafe. Peers/clients will connect via IPv4.

Why TunSafe?
The WireGuard protocol is encrypted but not obfuscated. If you're behind a (corporate) firewall that does Deep Packet Inspection (DPI), the WireGuard protocol is very easy to detect and block. The Wireguard Project states that 'obfuscation should happen at a layer above WireGuard' but does not offer any examples/solutions to do so.

TunSafe has incorporated obfuscation in it's latest Release Candidate. The default setting is to just make everything look totally random. It can also be set to tls-chrome or tls-firefox to make the traffic look like HTTPS traffic..

Additionally, TunSafe supports two-factor authentication out of the box.



Sign In or Register to comment.