6 ms·
TrustTunnel: AdGuard VPN protocol goes open-source
- sillyfluke 8mo agoIt would be also nice if they could hold their implicit promise of having the AdGuard extension working on Safari iOS, it's broken for me even when I reinstal it. Anyone else have the same problem?
- ameshkov 8mo agoThis is not a common issue tbh. What sometimes may happen is that after an iOS update the content blockers in Safari becomes corrupted and the only thing that fixes it is not just a reinstall, but uninstall + reboot + reinstall after that. If even this doesn’t help please contact me at “am at adguard.com”, I will try to help.
- sillyfluke 8mo agoThanks for the suggestion! I'll definitely try the uninstall-reboot-reinstall flow. I was about to switch browsers on all the elderly devices.
- zx8080 8mo agoI'm surprised that the browser extension to block ads has a proprietary vpn-like protocol. WTF?
- ameshkov 8mo agoOne interesting thing I’ve noticed is that AdGuard means different things in different parts of the world. In some places, people know us primarily as an ad blocker, in others we’re best known for our DNS service and in some regions AdGuard is associated almost exclusively with our VPN. The reality is that AdGuard makes several different products, not just one.
- jabroni_salad 8mo agoOne of my first experiences with adguard was using it to block ads on an unrooted phone. It pipes your connection through a local vpn to do it.
- ameshkov 8mo agoHi, I’m one of the people working on this. One clarification that may not be obvious: open-sourcing this isn’t primarily about signaling or auditability. If that were the goal, a standalone protocol spec or a minimal reference repo would have been enough. Instead, we’re deliberately shipping full client and server implementations because the end goal is for this to become an independent, vendor-neutral project, not something tied to AdGuard. We want it to be usable by any VPN or proxy stack and, over time, to serve as a common baseline for stealthy transports — similar to the role xray/vless play today. Happy to answer questions or clarify design choices.
- vitorsr 8mo agoThanks for all impressive work on AdGuard. Any particular reason to adopt Rust for this project instead of Go as many of your other products? Because I think since you have quite extensive Go codebase I would imagine you had to rewrite possibly a significant amount of code.
- rcoder 8mo agoLikewise interested in the authoritative answer, but: if I needed to write a decent chunk of code that had to run as close to wire/CPU limits as possible and run across popular mobile and desktop platforms I would 100% reach for Rust. Go has a lot of strengths, but embedding performance-critical code as a shared library in a mobile app isn't among them.
- ameshkov 8mo agoPerformance reasons aside, TrustTunnel is developed by the team whose main language is C++ (and the client library is actually written in C++) so Rust was a more natural choice for them.
- eptcyka 8mo agoEmbedding Go code into other binaries sucks ass. Debugging is worse, it installs some signal handlers.
- rfv6723 8mo ago
- denkmoon 8mo agoWhat makes this worth using over something like vless? Work blocked my gatcha game so I've had to set up a xray/vless/xhttp/tls proxy and it works flawlessly. Gets through the corp firewall unscathed at full bandwidth and no appreciable increase in latency.
- subscribed 8mo agoCould you please drop names/links to the magic sauce if there's anything more than the names mentioned? I need to open ssh myself and for now I decided on tunnelling over http/3 terminated somewhere in aws/gcp/cf, but maybe your method is better.
- dfadsadsf 8mo agoJust use Amnezia VPN - it can masquerade as https.
- subscribed 8mo agoI can't, my endpoint runs software enforcing compliance. "no disallowed VPN software" is one of the rules. Besides, where's fun in it :)
- denkmoon 8mo agohttps://github.com/XTLS/Xray-core https://github.com/XTLS/Xray-core It won't help you get around the endpoint compliance software, I use this for my byod phone (Streisand is a nice ios client). VLESS is the proxy protocol, kinda like SOCKS I guess. It uses xhttp over TLS as the transport.
- subscribed 8mo agoThanks a lot. VPNs are forbidden but this might easily slip under the radar (I can even check the signatures on the endpoint protection and our office firewall :)) It's less about breaking the rules, more about getting around the limitations in case I need it and don't fancy waiting 2 days for approval. Might end up with pure http/3, but this tool is fascinating. Thanks!
- stefanha 8mo agoLink to the protocol specification: https://github.com/TrustTunnel/TrustTunnel/blob/master/PROTOCOL.md https://github.com/TrustTunnel/TrustTunnel/blob/master/PROTO... It's a thin HTTP/2 and HTTP/3 tunneling protocol for TCP, UDP, and ICMP traffic. It should be easy to write an independent implementation based on this specification provided you already have an HTTP/2 or HTTP/3 library. Pretty neat!
- dixie_land 8mo agoLooks very similar to the HBONE protocol the istio folks created for ambient mesh: https://istio.io/latest/docs/ambient/architecture/hbone/ https://istio.io/latest/docs/ambient/architecture/hbone/
- userbinator 8mo agoBasically a CONNECT proxy? That's definitely not a difficult thing to write.
- ameshkov 8mo agoMore or less, built on top of it with added udp/icmp. When writing server and client a lot of time is consumed by additional features, not on implementing the spec itself. For instance, in order to be truly stealthy we have to make sure that it looks *exactly* like Chromium on the outside, and then maintain this similarity as Chromium changes TLS implementation from version to version. Or here’s another example: on the server-side we need to have an anti-probing protection to make it harder to detect what the server does.
- eptcyka 8mo agoQUIC CONNECT supports UDP too now.
- ameshkov 8mo agoWe support both H2 and H3 and this is necessary. QUIC is not bad, but there are places where it either does not work at all or works too slow. And one more thing, even though the code and spec is only published now, we’ve been using TrustTunnel for a long time, started before CONNECT_UDP became a thing. We’re considering switching to it though (or having an option to use it) just to make the server compatible with more clients.
- huflungdung 8mo ago[dead]
- mrbluecoat 8mo agoVery cool! Thanks for supporting open source (unlike a half-hearted attempt, like ExpressVPN's Lightway). Quick question: the website animated gif has no arrows from the website to the VPN server. Am I missing something? Update: just followed the quickstart and worked great; speed is virtually line speed - impressive!
- reader9274 8mo agoHow does this compare to Obscura
- mrbluecoat 8mo agoObscura is WireGuard-over-QUIC, not a new protocol. https://obscura.net/#faq-technical https://obscura.net/#faq-technical
- deleted 8mo ago[deleted]
- almaight 8mo agoDoes it support the mwss protocol?
- nfgrep 8mo agoSuper cool stuff! Excited to see what p2p between clients might look like, and how it compares on speed with Wireguard.
- mintflow 8mo agoIt’s great for you to open source the protocol and implementation, it written in rust which I will definitely consider to learn it add add to my vpn client in the future
- DrBurrito 8mo agoI like and use your products, so, first of all, thank you! that the protocol was not open was one of my main issues for not using the vpn service,?it is great to see. i look forward for the upcoming audits. one thing i would like to see more is info about the company. the team, the offices, etc. there have been rumors and contradictory infos over the years, and the blog always have a “stock photo”, shady vibe. putting your address in google maps brings you to a shady alley… improving the image of the company (in my opinion) as it is now would do lots to create and improve trust.
- ameshkov 8mo agoThere are no shady alleys in Cyprus:) We have only one office in Limassol, the company is mostly remote: https://maps.app.goo.gl/pounSEQqBvYftZGZ6?g_st=ic https://maps.app.goo.gl/pounSEQqBvYftZGZ6?g_st=ic (we are moving to a bit bigger office in the neighboring building, no nice photos on google yet) We do not have a dedicated team page on the website, but we’re not hiding our faces, the team can be found on Github. Members of the team often visit AFDS [1] [2], you can see some faces there (including mine). [1]: https://adfilteringdevsummit.com/ https://adfilteringdevsummit.com/ [2]: https://youtube.com/playlist?list=PL61EKVIQWizG0tIYqNDoenVaOWSiaAsyb&si=o2cd0YjVwdJyOUlw https://youtube.com/playlist?list=PL61EKVIQWizG0tIYqNDoenVaO...
- pandemic_region 8mo ago> https://adfilteringdevsummit.com/ https://adfilteringdevsummit.com/ Google sponsoring this summit is peak irony.
- ameshkov 8mo agoWell, Google is like a small country and some parts of it are very good guys that are genuinely interested in being a "user agent".
- DrBurrito 8mo agoright, thanks! nice to see. note that your legal address in the website points to another address, which is the one I mean. Maybe needs an update: https://adguard.com/en/contacts.html https://adguard.com/en/contacts.html
- GardenLetter27 8mo agoSo what are the reasons to use this over Wireguard?
- dmantis 8mo agoStandard wireguard is blocked by DPI in Russia, China, Iran, etc. The soluton in the post for VPNs as in "censorship bypass", not as in "virtual lan over the internet for businesses". Like AmneziaWG or VLESS protocols.
- Sir_Burpalot 8mo agoDoes anyone know if this protocol uses QUIC's RFC 9221 extension in order to eliminate overhead when tunnelling UDP over QUIC? According to their blog post, TrustTunnel does somehow avoid that overhead, but the actual protocol specification doesn't mention anything of that sort.
- ameshkov 8mo agoNo, but it's a very good point, we'll add it to the backlog
- Sir_Burpalot 8mo agoExcellent, thanks for the quick response! Are there any plans to add support for full-cone NAT as well, in order to improve compatibility with some games?