WebSocket based VPN instead of OpenVPN?

[scscsc]

We deploy to a lot of very restrictive corporate networks where outbound traffic is inspected (even if still encrypted) and many of those outbound gateways can tell the differences between HTTP over TLS and OpenVPN using port 443.

Would be great to have support for GitHub - Doridian/wsvpn: VPN over WebSocket and WebTransport or some other VPN that uses proper HTTP WebSockets instead of OpenVPN. Has this been considered?

This thread seems similarly resolved by adding support for this:

Access to Balena cloud on networks with VPN blocking

Hi, We have a device deployed with a customer. The device is connected to an open network, but it appears the network has a firewall on it, which we do not control and it’s unlikely the customer would turn the firewall off. Having said that, we know the device can easily access any other HTTPS service - so it appears that the firewall specifically blocks VPN over 443. Is there a way for the device (running BalenaOS) to reach BalenaCloud, most importantly for diagnostics and software upgrades, …

[krix]

We have the same issue: Customers where VPN traffic is blocked due to SSL inspection.
For example with firewall product ZScaler.

[scscsc]

I get that OpenVPN handles a bunch of funky routing on both the edge side and the balena-vpn server side, but I don’t see the edge doing anything that isn’t easily doable over a standard WebSocket, and a standard WebSocket would be fully compliant with virtually any corporate firewall or MITM requirement…

[scscsc]

Replace OpenVPN with a standard WebSocket · Balena Roadmap