FOR TECHNICAL USERS
Inspect traffic handling and classification.
- Review WireGuard ingress and transparent proxy handling as distinct stages of the traffic path.
- Inspect coarse traffic categories and the configured reasons behind connection handling.
ATHEROS SEARCH COMPONENT / OBSERVATION SOURCE
WireGuard ingress. Traffic classification.
The Rust proxy receives WireGuard traffic, applies configured connection policies, and publishes classified observations for Atheros Search. Coverage depends on the configured routing and available connection metadata.
WireGuard ingress
Receive traffic from configured peers.
Transparent handling
Inspect categories and configured decisions.
Audit publishing
Follow observations into the backend pipeline.
RCLabs VPN / Proxy / traffic review
Synthetic data01 / CHOOSE A FLOW
- 01WireGuard peerConfigured ingress
- 02Transparent proxyCategory and policy
- 03Audit publishingConfigured backend
02 / INSPECT THE DECISION
ads.example.test:443
- Traffic category
ads_tracker- Sample decision
- Block
The sample configuration blocks this destination. Its advertising/tracking category is a heuristic label, not proof of malicious traffic.
Inspect the sample audit record
Flow: sample-flow-001
Ingress: WireGuard / synthetic peer
Destination: ads.example.test:443
Category: ads_tracker
Decision: Block
Evidence: illustrative audit event
Traffic sent: noneTraffic categories are heuristics. Routing, inspection, and policy outcomes depend on deployment configuration. This synthetic sample establishes no VPN connection and sends no traffic.
Read all traffic categories as text
Advertising / tracker / ads_tracker
The sample configuration blocks this destination. Its advertising/tracking category is a heuristic label, not proof of malicious traffic.
Analytics / analytics
This fictional analytics destination matches a configured block rule in the sample. Other deployments may handle it differently.
Content delivery / cdn
The sample configuration forwards this content-delivery flow through its bypass path.
Essential API / essential_api
The sample configuration bypasses inspection for this application endpoint. The category does not guarantee that a service is essential in your environment.
Authentication / auth
A configured exception sends this sample authentication flow through the bypass path.
Unknown traffic / unknown
The sample has no matching category heuristic and uses a configured block rule. Unknown traffic is not automatically malicious or automatically blocked in every deployment.
Ingress, handling, and audit records
The sample follows one configured traffic path and its recorded decision. It does not establish a tunnel.
- 01 / Enter
Enter
- Input
- A configured WireGuard peer and traffic
- Processing
- Receive traffic through WireGuard ingress
- Output
- Traffic available to the configured proxy path
- 02 / Handle
Handle
- Input
- Destination and available connection metadata
- Processing
- Classify the flow and apply configured handling
- Output
- A connection decision with a recorded reason
- 03 / Inspect
Inspect
- Input
- Proxy observations and audit events
- Processing
- Publish evidence to the configured backend
- Output
- Records for operational review
Operating the proxy
Network and platform teams operating WireGuard ingress, transparent proxy policies, and traffic audit pipelines.
FOR OPERATORS AND REVIEWERS
Configure peers and audit publishing.
- Evaluate the proxy, administrative readiness surfaces, and the separate staged WireGuard key rotator.
- Plan for audit publishing through Redpanda and backend processing through Octopus. Persistence is owned by the backend.
Implementation details
Receive WireGuard traffic
The Rust proxy owns WireGuard ingress and tunnel transport. Peer setup and network routing are deployment prerequisites.
Classify destinations
Hostname and port heuristics group traffic as advertising/tracking, analytics, CDN, essential API, authentication, or unknown. A category is not a security verdict.
Inspect configured handling
The transparent proxy supports policy-driven connection handling, including blocking and bypass paths. The active configuration determines the outcome.
Publish audit evidence
The proxy publishes observations to the configured Redpanda pipeline. Octopus owns durable ingestion and maintained PostgreSQL projections.
Operate peer keys separately
The WireGuard key rotator supports staged server and peer key rotation as a separate operational component.
CONFIGURATION / COVERAGE
Traffic categories are heuristics. Routing, inspection, and policy outcomes depend on deployment configuration. This synthetic sample establishes no VPN connection and sends no traffic.
Sample flows and decisions are illustrative fixtures. No credentials, network connection, or live policy changes are involved.
Terms
- WireGuard
- A VPN protocol used here as a traffic ingress path for configured peers.
- Transparent proxy
- A proxy that receives traffic through configured network routing rather than an application-specific proxy setting.
- Traffic category
- A coarse label inferred from destination metadata. It does not prove whether traffic is safe or malicious.
- Policy decision
- The connection handling selected by the configured rules, with its recorded reason.
- Audit publishing
- Sending observations to a backend pipeline for processing and later review.