6. Network architecture

6.1 Two operating modes and endpoint enforcement

The endpoint Mullvad app remains the load-bearing control (P3), with Lockdown enabled on Debian. The router adds an outer tunnel only in nested mode. Tests support two profiles rather than one full-feature stack: endpoint-only obfuscation for low signature, or endpoint QUIC inside router WireGuard for defence in depth. The outer tunnel hides the inner connection from the access network, but exposes its own recognisable WireGuard flow. Extra nesting also adds overhead and another failure point.

Low-signature mode. GL.iNet router VPN OFF. Debian Mullvad QUIC + DAITA + Multihop + Lockdown ON. HOTEL-TEST observed high-volume UDP/443, with no outbound TCP or UDP/53 in the final capture. Destination reputation and flow behaviour remain observable.

Nested / defence-in-depth mode. GL.iNet Mullvad WireGuard ON with Kill Switch ON. Debian QUIC + Lockdown ON; DAITA OFF; Multihop OFF. The access network sees the outer WireGuard tunnel. Router-generated services need their own routing checks.

Switching modes. Change the router VPN and endpoint DAITA/Multihop settings; QUIC and Lockdown stay enabled. A router toggle alone does not select the validated profile. Check the actual underlay and tunnel status after every transition.

6.2 Why plain WireGuard is insufficient as the visible layer

WireGuard provides confidentiality while leaving a recognisable protocol and observable destination IP. The HOTEL-TEST capture showed the router’s outer Mullvad WireGuard connection whenever that tunnel was on. Inner QUIC does not disguise the outer protocol. Low-signature operation therefore uses endpoint-only QUIC in the validated build; an obfuscated outer hop is a future option requiring its own tests.

6.3 The obfuscation and traffic-analysis stack

Control	Mechanism	Threat addressed
QUIC obfuscation	Obfuscates endpoint WireGuard as QUIC traffic; the tested endpoint-only path appeared as UDP/443	Raises the cost of casual protocol identification (T1); no invisibility guarantee
Router-side obfuscation	Future AmneziaWG/self-hosted outer transport; separate configuration and empirical validation required	May reduce outer-hop fingerprinting; not part of the validated plain-WireGuard build
DAITA	Padding and cover traffic alter packet sizes/timing; enabled only in the validated endpoint-only profile	Traffic-analysis resistance; classifier effectiveness not measured in this lab
Multihop	Entry and exit on different servers; entry sees source, exit sees destination, neither sees both	Separates relay roles within one provider; not independent-provider anonymity

DAITA addresses information encryption alone leaves visible: packet sizes and timing. It adds padding and cover traffic at a bandwidth cost. The tested endpoint-only Debian profile combined DAITA with QUIC, Multihop, and Lockdown. DAITA and Multihop were disabled in the stable nested profile. The capture confirms transport behaviour and usability in this lab; it is not a measurement of resistance to every traffic classifier.

6.4 Provider selection and the single-provider trade

Decision. Mullvad on endpoints; plain Mullvad WireGuard on the GL.iNet only in nested mode. Endpoint-only mode leaves the router VPN off. Proton remains a possible regional fallback, with separate configuration and validation; no Shadowsocks outer hop was part of the validated build.

Rationale. Mullvad combines account-number signup with endpoint QUIC, DAITA, and Multihop in one app. The lab used those endpoint features in low-signature mode and the router’s supported WireGuard client with Kill Switch in nested mode. A shared account is acceptable within the same persona; each router/endpoint requires its own device/key registration.

The trade, stated honestly. Two Mullvad layers are not independent providers. Account and provider compromise remain shared risks; Multihop separates entry and exit roles but is off in the validated nested profile. The router and endpoints must use different actual relays, not merely different location labels. AmneziaWG to a self-hosted compatible server is a future outer-hop option; verify firmware support and validate the complete stack before adopting it. Self-hosting changes endpoint reputation and trust assumptions but does not guarantee undetectability. Plain router WireGuard provides an additional encrypted layer and client fail-closed backstop, without outer-hop concealment.

6.5 DNS

DNS handling depends on the mode. In nested Mullvad mode, router DNS can use the in-tunnel resolver 10.64.0.1; that address is not a working router resolver when the router tunnel is off. In endpoint-only mode, keep endpoint DNS inside its Mullvad tunnel and verify router bootstrap/housekeeping separately. AdGuard Home was off during the comparisons, so its behaviour across mode changes was not validated. No outbound UDP/53 was observed in the final IPv4 capture; this is an observation for that workload, not proof that every DNS path or IPv6 path is safe.

6.6 Persistent-identifier taxonomy and rotation policy (P4)

The design’s attribution resistance reduces to disciplined management of the identifiers below. Rotating relays alone does not provide unlinkability: it changes the visible VPN endpoint while leaving other identifiers and timing/volume available for correlation. The table records what actually rotates and why.

Identifier	Visible to	Rotate	Basis
Mullvad account #	Mullvad only	Optional / per-deployment	Anonymous & cash-paid; low value to rotate, safe to keep
Cape MSISDN + account	Carrier, contacts, payer	Per user / on compromise	Most identity-bearing object in the kit
IMSI	Carrier, SS7	Daily (automatic, Cape)	Breaks long-horizon IMSI tracking; IMEI still constant
IMEI	Every tower	Cannot	Hardware-permanent; swap handset for a new one
Router SSID / WAN MAC	Every joined network	Per trip	Cheap; defeats cross-venue device tracking & the GL.iNet OUI tell
Signal / Molly reg.	Contacts, provider	On compromise only	Number-bound; stable channel is a feature
SimpleX identity	Peers only	On compromise	No number; re-exchange links to rotate
Payment instrument	Vendors, processors	Rarely	Anchors the payer linkage; use privacy cards where possible

6.7 Empirical validation / lab results

Test network. A UDM Pro Max HOTEL-TEST VLAN with a captive portal simulated a hostile hotel network. Raw tcpdump/PCAP on br8 is ground truth for packets visible at that observation point. UniFi Flows may attach higher-level application/domain attribution; its labels are not literal hotel-visible destination connections.

Router-only failure and recovery. With a controlled client’s endpoint VPN off, the router VPN and Kill Switch stayed on while the upstream lab blocked the active Mullvad endpoint. Observed client traffic failed closed. Removing that block restored the tunnel and client connectivity automatically. Deliberately switching the VPN client off is a mode change, not this failure test.

Router housekeeping. Some packets may leave outside the tunnel, depending on service routing and “Services from GL.iNet Use VPN”. ICMP/NTP and a direct firmware-service HTTPS exchange appeared in the lab captures. The setting must not be treated as a guarantee for every router service; the post-NAT capture also limits process attribution. The validated claim concerns client fail-closed behaviour, not “nothing leaves”.

Three-phase result. With Debian continuously behind GL.iNet, nested → endpoint-only → nested worked. The final capture covered about 8 minutes 18 seconds and showed outer WireGuard in the first and last phases, high-volume endpoint UDP/443 in the middle, and no observed outbound TCP or UDP/53. These observations apply to the captured workloads and transitions.

Failed combination and false positive. Full endpoint QUIC + DAITA + Multihop did not remain stable inside router WireGuard while Debian was actually behind GL.iNet. Earlier apparent success came from silent reconnection to home Wi-Fi. The supported nested profile therefore disables DAITA and Multihop. This result does not prove universal incompatibility across other hardware or software.

Limits and repeatability. The filter “host 192.168.10.165” validated the observed IPv4 path only. IPv6 requires a separate capture and failure/recovery test. Disable fallback Wi-Fi/uplinks and verify the physical default route points to GL.iNet (192.168.8.1 in the lab) before interpreting results. Phone profiles, AdGuard, future obfuscated outer hops, and longer-term stability need their own validation.

Interactive simulator / v2.2