Add support for per-route multihop by dlon · Pull Request #105 · mullvad/gotatun

dlon · 2026-03-06T17:23:26Z

This adds several adapters for chaining WireGuard devices: we can have an inner device whose encrypted traffic is routed through an outer device, but only for certain destination prefixes. I.e. multihop with "routing".

How it works (simplified)

See the multihop-router example for actual usage.

We essentially need NAT and routing. NAT to ensure that the IP address is translated between the tunnel IP address of the actual TUN device and any "inner" userspace device. Routing to determine whether packets written to the TUN device should first take a detour via the inner device, and same for incoming UDP packets.

Inbound packets

                  Outer WG device
   UDP ────────────decapsulate()────────────► route by source address
  recv()                                       |
                                 ┌─────────────┴──────────────┐
                                 │                            │
                            inner tunnel                  everything
                             endpoint                        else
                                 │                            │
                                 ▼                            ▼
                           Inner WG device               TUN device write()
                            decapsulate()      (app receives stuff on its sockets)
                                 │
                                 ▼
                        DNAT: rewrite dest IP
                          (inner → outer)
                                 │
                                 ▼
                             TUN device write()
                 (app receives stuff on its sockets)

Data comes in from entry hop. It's decapsulated by the outer WG device.
("Device" is fully in userspace here, not an actual TUN device.)
If source IP of the packet is the inner WG endpoint, pass it to the inner device.
Otherwise, pass it to the TUN device.
Inner WG device: Decapsulate again and NAT it (its tunnel device).
This replaces the tunnel IP used for the inner VPN tunnel with the IP assigned to the TUN
device.

Outgoing packets

                             TUN device
                               read()
                          (default route)
                                 │
                                 ▼
                     route by destination address
                                 │
                  ┌──────────────┴───────────────┐
                  │                              │
             inner tunnel                    everything
             allowed IPs                        else
                  │                              │
                  ▼                              ▼
           NAT: rewrite src IP            Outer WG device
           (outer → inner)             encapsulate() ──► UDP
                  │                                     send()
                  ▼
            Inner WG device
            encapsulate()
                  │
                  ▼
            Outer WG device
            encapsulate() ──► UDP send()

Packets arrive at our TUN device (route 0.0.0.0/0 to TUN).
If an IP packet's destination is included in our inner tunnel's allowed IPs:
The tunnel IP is replaced (NAT'd) with that of the inner VPN. It is encapsulated by the
inner WG device.
The packet is encapsulated with the outer WG device and sent to the first hop.

This change is

The multihop-router demonstrates how this can be used.

Packets whose source IPs overlap with those of the inner tunnel must be blocked, since there's only a single TUN device. Otherwise, the other tunnel can impersonate the inner tunnel.

dlon · 2026-05-04T09:06:58Z

+    pub fn payload(&self) -> Option<&[u8]> {
+        match self.as_v4_or_v6()? {
+            Either::Left(ipv4) => ipv4.payload(),
+            Either::Right(ipv6) => Some(&ipv6.payload),


Check if ipv6.payload works when there are extension headers.

dlon · 2026-05-04T09:09:12Z

+    /// Create a new `MergingIpRecv` that merges packets from `a` and `b`.
+    ///
+    /// `pool` is used as the packet buffer pool when receiving from `b`.
+    pub fn new(a: A, b: B, pool: PacketBufPool) -> Self {


Can we get rid of the extra pool?

dlon · 2026-05-04T09:10:43Z

+    }
+
+    fn mtu(&self) -> MtuWatcher {
+        // TODO


Remove TODO or fix this.

dlon · 2026-05-04T09:16:15Z

+                };
+
+                if tx.send(packet).await.is_err() {
+                    // TODO: Should we only stop if all channels have been dropped?


This is probably fine for now.

dlon · 2026-05-04T09:17:02Z

+                Ok(packets) => packets,
+                Err(e) => {
+                    log::error!("TUN router recv error: {e}");
+                    // TODO: Must stop if TUN goes down, but is this always unrecoverable?


We could use is_fatal_tun_error here.

dlon · 2026-05-04T09:22:45Z

+                    .into();
+        }
+        IpNextProtocol::Tcp => {
+            // TCP checksum is at byte offset 16 in the TCP header.


Consider merging Tcp type from #10

dlon marked this pull request as draft March 6, 2026 17:31

dlon force-pushed the add-split-multihop branch 2 times, most recently from 161c06c to 7d4dc7b Compare March 6, 2026 18:04

dlon changed the title ~~Add support for route-based multihop~~ Add support for per-route multihop Mar 9, 2026

dlon force-pushed the add-split-multihop branch from 7d4dc7b to e0e8d2e Compare March 27, 2026 08:28

dlon force-pushed the add-split-multihop branch from 9689483 to 9737ac8 Compare April 23, 2026 09:53

dlon requested a review from MarkusPettersson98 April 23, 2026 12:37

dlon marked this pull request as ready for review April 23, 2026 12:37

dlon requested a review from hulthe April 28, 2026 12:34

dlon commented Apr 29, 2026

View reviewed changes

Comment thread gotatun/examples/multihop-router.rs

dlon added 11 commits May 4, 2026 10:56

Add incremental checksum utils

a4f128e

Add adapters to support "per-route" multihop

765a472

The multihop-router demonstrates how this can be used.

fixup: ignore pcap on windows

b0da482

fixup: deps

17fb202

Add add_routes function

5742669

fixup: docs for NatIp*

1e9563c

fixup: unused deps

958aa43

fixup: required feats for example

5d3536c

Prevent outer VPN tunnel from impersonating the inner tunnel

33444fe

Packets whose source IPs overlap with those of the inner tunnel must be blocked, since there's only a single TUN device. Otherwise, the other tunnel can impersonate the inner tunnel.

fixup

c97672d

TMP: Hide potentially invalid IPv4 payload (when IHL>5)

7354b6d

dlon force-pushed the add-split-multihop branch from e0ba93b to 7354b6d Compare May 4, 2026 08:58

fixup: lint

72d47c2

dlon commented May 4, 2026

View reviewed changes

Comment thread gotatun/src/tun/merge.rs

}

fn mtu(&self) -> MtuWatcher {

// TODO

Copy link
Copy Markdown

Member Author

dlon May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove TODO or fix this.

dlon commented May 4, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for per-route multihop#105

Add support for per-route multihop#105
dlon wants to merge 12 commits intomainfrom
add-split-multihop

dlon commented Mar 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

dlon May 4, 2026

Uh oh!

dlon May 4, 2026

Uh oh!

dlon May 4, 2026

Uh oh!

dlon May 4, 2026

Uh oh!

dlon May 4, 2026

Uh oh!

dlon May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dlon commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How it works (simplified)

Inbound packets

Outgoing packets

Uh oh!

Uh oh!

dlon May 4, 2026

Choose a reason for hiding this comment

Uh oh!

dlon May 4, 2026

Choose a reason for hiding this comment

Uh oh!

dlon May 4, 2026

Choose a reason for hiding this comment

Uh oh!

dlon May 4, 2026

Choose a reason for hiding this comment

Uh oh!

dlon May 4, 2026

Choose a reason for hiding this comment

Uh oh!

dlon May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dlon commented Mar 6, 2026 •

edited

Loading