How I Built a Mesh VPN Without WireGuard

Short summary

A solo developer built a mesh VPN called TunTun using iroh (a Rust peer-to-peer library) instead of WireGuard, trading polished tunnel performance for built-in NAT traversal and peer discovery. Key technical challenges include TCP meltdown from double reliability layers (solved with QUIC datagrams) and syscall overhead as the real bottleneck (addressed via TSO/GRO batching). Not AI-related — focused on networking and VPN architecture.

• •Used iroh instead of WireGuard for built-in NAT traversal, relay fallback, and peer discovery
• •QUIC datagrams (RFC 9221) avoid TCP meltdown from double reliability layers
• •System calls, not encryption, are the real VPN bottleneck; TSO/GRO batching is the fix

Generated with AI, which can make mistakes.