Travel Router Obfuscation

I was out at a conference with my travel router and was having trouble connecting back to my VPN at home. I figured it was a blocked port on the network so I tried switching some ports around to no success. I think there was some packet inspection that broke the handshake between my wireguard client on the router and the server on my gateway.

Thus, I got angry. I proceeded to do some research on encrypting the handshake and decided on installing wstunnel on my proxmox node to encrypt the traffic between my router and home. Success! The VPN connects and I can go on my merry way.

This was a fun project to think about so I was wondering what other techniques network admins would use to screen for travel routers and block their traffic or flag the device. This is what I came up with in my research:

1. TTL – is this device consistently sending a TTL of 63 or 127? Configure the router to set all outbound packets to 64 for consistency.

2. MAC – is this the same device that executed the captive portal while it was running in hotspot mode? Spoof your phone/laptop MAC that you do captive portals with.

3. Ports – is this device sending on common VPN ports like 51820 for wireguard? Also solved with encryption like wstunnel, but can be more easily bypassed with an uncommon port assignment.

4. DPI – is this device sending packets that are obviously padded like a VPN? Further exacerbated by AI scanning that may make this even more difficult to work around in the future. Wstunnel seemed like the best solution for this.

5. Suspicious HTTPS traffic – wstunnel still looks weird on the network as one long, uninterrupted exchange between the device and a single https.

6. DNS – The first handshake still needs DNS resolution which sends at least one request to google or cloudflare, what have you. My unbound DNS won't resolve the DNS requests on my VPN until the handshake is completed. I don't think this would ever really get flagged but it's technically identifiable?

7. Device Traffic – If your router is scanning for firmware updates or time zones before being encrypted behind a VPN then that could be flagged. Especially if you're brand is showing in the URL. Simple to just set everything to manual instead of automatic. This could also come in the form of the DHCP lease request if you don't spoof your device name to match your captive portal device.

Curious what you all would add/change. I thought it was a fun experiment to think about and try to implement.