BTH BUG Bleeding Into Regular Wireguard.

@anav, did you report a bug on this?


They may never… Part of why WG is fast is that it happens in the kernel, so dropping down to mangle likely be some performance hit. But I don’t know.

Kinda the reverse complaint of @DarkNate’s [Discussion] MikroTik configuration abstraction complexity where he’s advacating for more kernel-based datapaths, instead of mangle rules.

“Flexible” isn’t the problem, relying on Linux Netfilter framework for data plane is.

(translation: /ip/firewall/mangle == Linux Netfilter)