2026-09-12 –, D.0.02
STUNMESH-go is an open-source tool that enables direct peer-to-peer WireGuard connections between devices behind NAT or CGNAT. It multiplexes STUN and WireGuard traffic on the same UDP port by interacting directly with the kernel WireGuard module, avoiding the overhead of userspace proxies. Originally Linux-only, we ported STUNMESH-go to FreeBSD and macOS. This talk covers the technical challenges we encountered: adapting from Linux raw sockets to BPF-based per-interface packet capture, porting the health monitoring and automatic reconnection system, and ensuring the plugin-based peer discovery mechanism works across platforms. We validated our work on OPNsense firewalls, VyOS routers, and mixed BSD/macOS/Linux full-mesh topologies.
Date Huang is the creator and maintainer of STUNMESH-go, an open-source WireGuard NAT traversal tool with FreeBSD and macOS support, and the maintainer of EZIO Project, a BitTorrent-based bare-metal deployment solution. As a Solution Architect with 7+ years of experience in datacenter and cloud networking, his work spans Kubernetes, SD-WAN, EVPN/VXLAN, and network automation. He has spoken at FOSDEM 2026 (Network devroom, on STUNMESH-go), AsiaBSDCon 2026, Open Source Summit North America, COSCUP, and various Kubernetes and open-source conferences across Asia.