Implementing a Secure Data Transmission Channel Based on Mesh VPN Under Limited IPv4 Addressing

Abstract

The work explores the problem of organizing secure remote access to network nodes in conditions of IPv4 address shortage and widespread use of CGNAT technology. It examines modern approaches to building Mesh VPN networks using the WireGuard protocol and NAT Traversal mechanisms. Special attention is given to the principles for establishing a direct P2P connection between nodes via a coordination server and the UDP Hole Punching method, as well as backup relay mechanisms when a direct connection is not possible. As part of the study, an experimental environment was deployed using the Tailscale platform, which included nodes located in different network conditions (home NAT and mobile CGNAT). Testing was carried out on channel availability and latency, as well as checking the operation of an HTTP service through a secure tunnel. The results confirm that the mechanism for organizing secure inter-node communication works without using public IP addresses or manually setting up port forwarding. The proposed approach can be used for building remote monitoring systems, IoT solutions, and secure administration of distributed network infrastructures in situations with limited IPv4 addressing.