3 posts
Brought the six-hop chain up. WireGuard handshakes were green on every container; pcaps proved every container was still talking to the real WAN through the Docker bridge, never the tunnels. Three config bugs, all in the routing layer. Diagnosis from pcaps and a one-shot patch.
Build-log series on a multi-hop WireGuard pinball machine — six Docker containers on one box, each NAT'd to a real country-AS prefix, designed to confuse local-segment observers doing IP-or-AS attribution.
I'm building a little computer spinner that sits next to my router and makes traffic look like it's pinballing through Russia, Canada, Taiwan, and Australia before hitting the internet. It's not a Mullvad replacement. Here's what it actually is, what the research turned up, and the five footguns I've hit or am about to.