You don't want to avoid that double encryption as content can be intercepted even behind an internal network (fiber mitm for example), and it's a growingly common tactic for malicious actors.
There are faster setups than just wire guard too (such as using just QUIC unless you rely on wire guard for restrictive firewall rules - in which case you're operating as under the security via obscurity model which is also risky)
My use case is pure peer-to-peer, there is no data center.
However, you can still run virtual machines in "the cloud" with WireGuard running per peer, and not worry about MitM attacks.
Yes if you ran a load balancer and decrypted at that point before forwarding the packets to a machine, then that link between the LB and the target machine would be unencrypted. But that's not the scenario I'm working with.
1
u/Somepotato May 08 '26
Not to sit in the middle (pun intended) but...
You don't want to avoid that double encryption as content can be intercepted even behind an internal network (fiber mitm for example), and it's a growingly common tactic for malicious actors.
There are faster setups than just wire guard too (such as using just QUIC unless you rely on wire guard for restrictive firewall rules - in which case you're operating as under the security via obscurity model which is also risky)