BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//2026.asiabsdcon.org//entry//PRCTQP
BEGIN:VTIMEZONE
TZID:CST
BEGIN:STANDARD
DTSTART:20000101T000000
RRULE:FREQ=YEARLY;BYMONTH=1
TZNAME:CST
TZOFFSETFROM:+0800
TZOFFSETTO:+0800
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-entry-XEZDKT@2026.asiabsdcon.org
DTSTART;TZID=CST:20260321T140000
DTEND;TZID=CST:20260321T144500
DESCRIPTION:The open-source tool STUNMESH-go helps devices create WireGuard
  connections when they all sit behind NAT or CGNAT networks. These network
  setups make it hard for devices to connect directly to each other. NAT an
 d CGNAT are common in many situations: home networks\, mobile networks\, a
 nd enterprise networks. The tool uses STUN protocol to help devices find t
 heir public IP addresses and ports. It has a special feature: it can use t
 he same port for both WireGuard and STUN traffic by working directly with 
 the WireGuard kernel module. This approach is more efficient than solution
 s using embedded wireguard-go with a proxy setup\, like Tailscale does. It
  means devices can connect directly without needing a central relay server
 . This saves bandwidth and reduces latency.\nSTUNMESH-go works well on Lin
 ux systems. This means it already supports popular network solutions like 
 VyOS and OpenWrt. However\, many network devices and firewalls use FreeBSD
 -based systems. pfSense and OPNsense are two popular firewall systems that
  run on FreeBSD. To support these important platforms\, we needed to add p
 roper FreeBSD support. Also\, macOS support is valuable for developers and
  network engineers who want to test and develop P2P VPN solutions on their
  computers. In this work\, we added full support for FreeBSD and macOS. Th
 is helps developers and network engineers who use BSD or Apple systems to 
 build P2P WireGuard networks\, even when they are behind NAT or CGNAT.\nWe
  explain the technical problems we met during this work. On Linux\, STUNME
 SH-go uses raw sockets with BPF filtering. This lets it watch all network 
 interfaces at the same time. But FreeBSD and macOS work differently. They 
 use BPF with interface-specific packet capture. We had to write code that 
 listens on all network interfaces for STUN messages\, but not on the WireG
 uard interface itself. This design works better when systems have multiple
  network connections or backup routes. We tested this with OPNsense virtua
 l machines to check that it works correctly in real firewall situations.\n
 We also added the health monitoring system to both platforms. This system 
 checks if the tunnel is working by sending ping messages to each peer. If 
 a connection fails\, it tries to reconnect automatically. It uses smart re
 try logic with exponential backoff. This means it waits longer between eac
 h retry attempt to avoid overloading the network. Each peer can have its o
 wn ping settings with different timeout and interval values. This feature 
 is very useful for mobile networks and changing network situations common 
 on BSD and macOS. In ideal conditions\, when network changes happen\, the 
 system can detect the connection problem and reconnect quickly.\nThe tool 
 has a plugin system that we also ported to these platforms. STUNMESH-go su
 pports different key-value storage backends through plugins. Users can eve
 n write custom plugins using the exec plugin interface. We made sure this 
 plugin system works on all platforms. Users can connect to various DNS pro
 viders or key-value storage services like Cloudflare. This helps with auto
 matic peer discovery and configuration sharing. When a peer's IP address c
 hanges\, it updates the DNS record automatically. Other peers can then fin
 d the new address and reconnect. This works well with WireGuard's built-in
  roaming capability. As the WireGuard documentation describes\, the server
  finds peer endpoints by checking where authenticated data comes from. If 
 endpoints change\, both client and server update their settings by learnin
 g from where they receive correctly authenticated data. This means there i
 s full IP roaming on both ends. STUNMESH-go uses this feature by helping p
 eers discover their new public addresses quickly through STUN and updating
  the shared configuration storage.\nWe successfully built and ran STUNMESH
 -go on FreeBSD and modern macOS versions. We set up full-mesh P2P networks
  with nodes behind NAT or CGNAT. We tested that direct P2P connections wor
 k reliably on these platforms. Our tests included VyOS routers with LTE mo
 dems\, OPNsense firewalls running on FreeBSD\, and mixed environments with
  BSD\, macOS\, and Linux nodes. We did not measure detailed performance li
 ke latency or speed. Our main goal was to check that connections work in r
 eal network conditions. The results show that BSD and macOS platforms can 
 run direct P2P WireGuard networks using STUNMESH-go reliably.\nWe share ou
 r experience and future directions. Important insights include how to hand
 le networking across different platforms in Go\, best ways to prepare buil
 d environments on Unix-like systems\, and why good documentation matters f
 or platform-specific setup. We also worked with BSD and macOS communities 
 to get feedback and support. This helped us find unusual problems and plat
 form-specific issues. Future work includes making the build process easier
 \, improving documentation for BSD and macOS users\, and helping more peop
 le in these communities use P2P network tools. We also plan to add support
  for more BSD variants and improve the testing framework for firewall plat
 forms like pfSense and OPNsense.
DTSTAMP:20260818T182645Z
LOCATION:Room A
SUMMARY:Porting STUNMESH-go to FreeBSD and macOS: Building Peer-to-Peer Wir
 eGuard Networks - Yu-Chiang (Date) Huang
URL:https://2026.asiabsdcon.org/entry/talk/XEZDKT/
END:VEVENT
END:VCALENDAR