# Detecting WG tunnelling? **URL:** \ **Category:** VPN, DNS, Leaks\ **Created:** [October 9, 2024, 1:33am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809 "2024-10-09T01:33:19Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![genki](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/43a26b/32.png) [@genki](https://forum.gl-inet.com/u/genki)\ **Post date:** [October 9, 2024, 1:33am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/1 "2024-10-09T01:33:19Z")
I'm trying to understand how WG tunnels are detected. Consider a topology like this. Laptop (BT, WiFI disabled, physically connected to Beryl WG tunnel) --- (Flint WG server at home internet connection in home country to internet) Laptop uses CompanyA VPN to connect (VPN within a VPN I guess) How could CompanyA "know" that the traffic originated via a country to country WG tunnel? I can't get my head around how the packet coming out at the head end router would show WG origination. I guess you could look at maybe RTT or TTL. I'm missing something here... EDIT: ipleak and all DNS checks show the endpoint "home country" so if you are WG from EMEA to US it does show the US address, and it's a home address not a VPN service. DNS is cloudflare. All is good... usually Please discuss ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 9, 2024, 4:47am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/2 "2024-10-09T04:47:40Z")
Under normal circumstances they can't. They will just see your home ip. The only indicator could be the added latency which is not really something you can change, but you can also tell them you are on bad wifi, tcp on the other hand maybe works a little better. the difference between udp and tcp is that udp does not have a keep alive mechanism, so if a packet is lost it is lost contributing to more latency, tcp resents the packet this way you may lag less because the home server must receive the packet. just to explain this further: vpns encapisulate hops, so your public ip turns into the companies one, and the endpoint visible at the remote company is your home ip from the server. It is not possible for them to do any of the deep packet inspection or look into your tunnel. ---
**Author:** ![genki](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/43a26b/32.png) [@genki](https://forum.gl-inet.com/u/genki)\ **Post date:** [October 9, 2024, 9:29pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/3 "2024-10-09T21:29:39Z")
Hi, Thank you for the response but if the tunnel is not detectable, how is [browserleaks.com](http://browserleaks.com) reporting it ? Is there a way to fix this? FlintA -- wg vpn -- FlintB -- Internet Perhaps something like changing the outgoing MTU to 1500 on the outgoing FlintB or something? See my test results below. ![image](https://forum-static.gl-inet.com/original/3X/5/b/5b8d664d54a2b576ecb4a393b3d2b5def03217f9.png) ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 9, 2024, 9:48pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/4 "2024-10-09T21:48:19Z")
That site looks to open common ports for vpn. To demonstrate im currently connected to a wireguard server on Mullvad, by chance the same ip also hosts a openvpn server, and it reports openvpn, even though i do not use it. This isn't a hard indicator, you could also say you portforwarded it for a game server for example the business would not know the difference only that it is a known commonality with vpn ports. You can also make it look closed by using udp protocol. wireguard is a much better option for this since the vpn does not respond, its faster aswell, although both should be fine aslong the protocol is set to udp. ---
**Author:** ![genki](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/43a26b/32.png) [@genki](https://forum.gl-inet.com/u/genki)\ **Post date:** [October 9, 2024, 10:06pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/5 "2024-10-09T22:06:40Z")
Thanks, not sure that I am following. Do you mean change the WG tunnel protocol to UDP? ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 9, 2024, 10:09pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/6 "2024-10-09T22:09:48Z")
Jup, the port which is open on the server needs to be only open for udp and the vpn needs to use udp protocol, it must not have tcp open because tcp can respond with a icmp packet that the port was unreachable, blocked that packet gives them knowledge that port is open. ---
**Author:** ![genki](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/43a26b/32.png) [@genki](https://forum.gl-inet.com/u/genki)\ **Post date:** [October 9, 2024, 10:22pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/7 "2024-10-09T22:22:54Z")
Thanks xize11. I hate to ask but how do I do that? Change the WG VPN to use UDP on the FlintB server side? Thx ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 9, 2024, 10:40pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/8 "2024-10-09T22:40:36Z")
Wireguard by default uses udp. However you need to check firewall rules. Please go to advanced settings -\> login (same credentials as gl ui) -\> network -\> firewall -\> traffic rules tab. can you see the rule of the vpn server with the open vpn port? what does the protocol say?, it must be udp only. If not i'd recommend making a copy of this rule and disable the generated one by gl firmware, im not sure if they automatic allow tcp too but for hiding a wireguard vpn server this needs to be udp onlyπŸ˜‰ ---
**Author:** ![genki](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/43a26b/32.png) [@genki](https://forum.gl-inet.com/u/genki)\ **Post date:** [October 9, 2024, 10:52pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/9 "2024-10-09T22:52:53Z")
Got it, yep it looks like this, ![image](https://forum-static.gl-inet.com/original/3X/7/2/72de595f6d03c6bfeea623c8cf6d4d868d940b2e.png) Thanks ---
**Author:** ![genki](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/43a26b/32.png) [@genki](https://forum.gl-inet.com/u/genki)\ **Post date:** [October 9, 2024, 11:06pm UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/10 "2024-10-09T23:06:52Z")
I edited the wgserver\_allow rule and removed TCP but it still shows as a **Generic tunnel or VPN** ![image](https://forum-static.gl-inet.com/original/3X/8/9/8977f531045f91f62f6b31bb551fffe5d37b2af5.png) ![image](https://forum-static.gl-inet.com/original/3X/b/9/b949f13ac487e87c7d357bfafdcd8b8e9133c740.png) Could it be the MTU is also the giveaway ? Thanks ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 10, 2024, 2:40am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/11 "2024-10-10T02:40:52Z")
The MTU is not issue, the mtu is not what browserleaks detect. But if you test it on the laptop with the corporate vpn active (which is openvpn likely), then the site reflects the corporate vpn and it sees a open port on their side πŸ™‚ ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [October 10, 2024, 5:33am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/12 "2024-10-10T05:33:01Z")
Unfortunately you are wrong with your assumption. MTU is the one they detect. Port detection isn't working like that. The MTU will give a pretty good hint. 1492 is the MTU for PPPoE, for example. 1420 for any VPN. 1380 for OpenVPN UDP ... πŸ˜‰ ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 10, 2024, 7:23am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/13 "2024-10-10T07:23:26Z")
How would a external site detect mtu? πŸ€” MTU is only for maximum transmission unit, how big a packet is allowed. I still think they look to common ports and then look to mtu. Browserleaks doesn't show a vpn for me on wireguard. However the firewall rule is generated with tcp open, this is subject to the detection. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [October 10, 2024, 7:25am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/14 "2024-10-10T07:25:05Z")
Don't know how, but they do. I tried it with different MTUs. ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 10, 2024, 7:31am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/15 "2024-10-10T07:31:17Z")
Just checked again πŸ˜‰ They look to the response from tcp port which supplies them the mtu. So if tcp is closed and udp does not respond like in wireguard it works. They also call it tcp/ip fingerprint that makes sense πŸ‘ ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [October 10, 2024, 7:35am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/16 "2024-10-10T07:35:18Z")
This can't be. I donβ€˜t expose any ports since I am using Mullvad via WireGuard. And even without VPN they detect the correct MTU on my side. ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 10, 2024, 7:36am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/17 "2024-10-10T07:36:19Z")
But mullvad hosts other servers aswell on their ip, these are tcp opened πŸ™‚ Mine says im using openvpn πŸ˜‹ ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [October 10, 2024, 7:37am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/18 "2024-10-10T07:37:03Z")
But without VPN they detect PPPoE on my side, but my router does not reply to ICMP nor any ports. πŸ˜… ---
**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\ **Post date:** [October 10, 2024, 7:47am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/19 "2024-10-10T07:47:03Z")
This is also false πŸ™‚ The site is trolling just tested it with 1500 mtu, it shows it as linux kernel 2.0 with 1492 mtu, also the location shows in braband when other sites say amsterdam. It looks to the next hop which likely has this exposed so it must be the pppoe server. Pppoe is also tcp πŸ‘ ---
**Author:** ![groentjuh](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/f17d59/32.png) [@groentjuh](https://forum.gl-inet.com/u/groentjuh)\ **Post date:** [October 10, 2024, 8:30am UTC](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809/20 "2024-10-10T08:30:30Z")
Looking at it, they seem to detect the MTU and hops on their server. It is very likely they simply have low level access to the webserver connections. Their webserver will of course need to figure out what MTU to use (using PMTUD), so it can send the biggest possible packages back. Hops is very likely result from TTYL. Based on the MTU they just guess it might be a VPN, because a VPN needs to have a lower MTU as it needs a bit for overhead to transmit its own data. [Next page](https://forum.gl-inet.com/t/detecting-wg-tunnelling/48809.md?page=2)