Abstract: This disclosure describes a secure tunneling mechanism with DoS mitigation operating in a VPN-based mesh network. The mechanism uses a combination of static and temporal cookies to enable a server to identify peers while still retaining anonymity, and without requiring the server to perform expensive asymmetric cryptography (D-H) operations. In this approach, peers are identifiable by just performing hashes and using symmetric cryptography. The mechanism implements a generalized method of packet handling that provides for data scattering and gathering, thereby enabling encrypted frames conforming to a packet format and communicated by a peer to be spread across multiple physical packets both during a handshake, as well as during the exchange of data (between peers) during the session.