Proton VPN over MASQUE

Proton VPN with WireGuard over MASQUE

Wiki Home · English · 简体中文

Use Usque's chain proxy to reach a Proton VPN WireGuard server through Cloudflare WARP. This tutorial describes Usque v0.2.8 on Windows, Android and Android TV. It follows the released interface and implementation; it is not a report of a live Proton VPN connection or a leak test.

1. Understand the connection and prepare

Your application
    │  Usque VPN, SOCKS5 or HTTP output
    ▼
Cloudflare WARP / MASQUE
    │  carries the encrypted WireGuard connection
    ▼
Proton VPN / WireGuard
    │  final exit
    ▼
Internet destination

Usque builds the WARP leg first, then the WireGuard leg inside it. The Proton server endpoint and protocol traffic are reached through WARP. Traffic using the chain exits through Proton VPN; explicit direct and platform bypass rules still apply. VPN, SOCKS5 and HTTP share the exit, but HTTP CONNECT still only carries TCP.

Prepare:

• An official Usque package, verified using the installation guide, with a registered WARP account. Confirm ordinary WARP connectivity first.
• A Proton VPN account that can generate a WireGuard configuration for your chosen server. Available servers and options depend on your account.
• A private place to save the downloaded .conf file. It contains a client private key: do not publish it, include it in screenshots or attach it to an Issue.

Usque runs both legs. You do not need to activate the configuration in a separate Proton VPN or WireGuard app. Disconnect other VPN clients before using Usque's VPN output to avoid competing VPN connections; Android permits only one active VPN service for a user at a time.

The outer data plane must be CONNECT-IP, using Auto, HTTP/3 or HTTP/2. WireGuard needs UDP inside that tunnel and cannot use L4 (experimental). HTTP/2 CONNECT-IP can carry those IP packets even though its outer connection uses TCP.

2. Download your Proton VPN configuration

Follow Proton's official WireGuard configuration guide:

1. Sign in at account.protonvpn.com.
2. Open Downloads → WireGuard configuration.
3. Name the configuration, choose your platform and a server, and review the VPN options available to your account. Use Android for an Android TV device.
4. Select Create, then Download to save the .conf file.

Keep the downloaded PrivateKey, PublicKey, Address, DNS, Endpoint and AllowedIPs together and unchanged for the first import. A WireGuard configuration authenticates with its keys; this flow does not ask for your Proton account password or OpenVPN username/password. Use your own downloaded file, not somebody else's example.

Proton may update its account interface; its official guide is authoritative for the download process. Usque's next steps are specific to the v0.2.8 interface.

3. Import into Usque

1. Open Proxy → Chain proxy and choose WireGuard under Exit source. On a phone or narrow window, tap the source selector to open the list.
2. Choose Import file and select one downloaded .conf file. Usque checks it immediately. Alternatively, choose Paste configuration, paste the full text and select Check configuration. Android TV devices without a document picker can use this second path.
3. Review the server, tunnel addresses, DNS, allowed destinations and MTU. Give it a recognizable name, such as Proton VPN - Netherlands, and select Save configuration.

WireGuard accepts a custom provider configuration such as Proton's. WARP via WireGuard is the separate source for a WARP WireGuard exit; select WireGuard for this tutorial.

The check is offline validation, not a connectivity test. Saving adds the file to the library; it does not select the configuration or start a connection. Imported content is stored by Usque, so later edits to the original file do not update the saved entry. Import the updated file again when replacing its contents.

What the importer accepts

Item	Requirement
File	UTF-8 text, at most 128 KiB; one [Interface] followed by one [Peer].
Keys	Matching provider-issued keys, encoded as nonzero 32-byte Base64 values.
Interface fields	PrivateKey, Address, optional DNS and MTU.
Peer fields	PublicKey, Endpoint, AllowedIPs, optional PresharedKey and PersistentKeepalive.
Addresses and DNS	At most one interface address per IP family; DNS entries are IP addresses.
Unsupported settings	Multiple peers, hooks such as PostUp/PostDown, and platform-specific wg-quick routing directives such as Table.

If validation fails, read the field/line error and check that you downloaded a WireGuard .conf, selected the correct source and copied the entire file. Obtain a fresh standard configuration if necessary. Do not guess replacement keys or remove unfamiliar settings just to make the check pass.

4. Select, apply and connect

1. Turn on Enable chain proxy.
2. Select your Proton entry under Saved configurations. The source selector alone only changes the list you are browsing.
3. Select Apply changes. If already connected, the button reads Apply and reconnect; this interrupts existing application connections.
4. If L4 is selected, the entry shows Not available with L4. Use Turn off L4 and apply to switch to the compatible data plane and apply the exit.
5. If you were disconnected, go back to Home and connect. Applying while disconnected saves the selection and leaves the connection stopped.

Under VPN and local proxies, keep VPN enabled for system traffic, or enable SOCKS5/HTTP and configure your intended applications to use it. For a proxy-only setup, turn off VPN. If all outputs are disabled, the connection provides no application access. On Android, grant VPN consent when prompted and include the test application if Per-app proxy is enabled.

Wait for Current connection on the chain page to show the Proton configuration as connected. Home identifies the chain as WARP → <configuration name>. Saved selection describes the saved choice; Current connection describes what is running. WARP RTT measures only the WARP leg, not the whole chain.

5. Check the final exit

Perform these checks after the chain reports connected. The check destination must not match a direct rule. Use a fresh request after applying or reconnecting.

With VPN output

Open ip.me in a browser routed through Usque. On Android, the browser must be included if per-app filtering is enabled. Compare the reported public IP with Usque's final-exit information and the selected Proton server location.

With SOCKS5 output only

A browser that has not been configured to use the proxy is not testing the chain. On Windows, with the default local listener and no proxy authentication, run:

curl.exe --proxy socks5h://127.0.0.1:1080 --noproxy localhost https://ip.me

Use your configured listener address and port if you changed them. socks5h asks the proxy to resolve the destination name. --noproxy localhost keeps an existing NO_PROXY setting from bypassing the proxy for this check. If you enabled proxy authentication, use a client configured with those credentials; do not paste them into a public command or report. On Android/TV, use an app or browser that supports SOCKS5 with remote DNS, and make the request from that configured app.

The output is a public IP, which may differ from the WireGuard Endpoint address. Check it together with the live chain status; IP database names and country labels alone do not establish which tunnel was used. Unexpected ISP or Cloudflare-only results should be investigated using the table below.

An IPv4 result does not verify IPv6, DNS or Kill Switch behavior. A successful request is a connection check, not a comprehensive leak test.

6. DNS, IPv6 and MTU

• DNS: Keep Proton's configured DNS IPs. Usque sends remote queries through the final tunnel and checks that DNS addresses are reachable by its address families and AllowedIPs. Unusable explicitly configured DNS is not silently replaced by physical-network DNS. A connected tunnel can still lack usable DNS. Explicit local/proxy DNS settings and direct-rule DNS have their own policies; review any overrides you previously set.
• AllowedIPs and IPv6: 0.0.0.0/0 covers IPv4, and ::/0 covers IPv6. Working IPv6 also needs an assigned IPv6 tunnel address and server support; adding ::/0 alone is insufficient. Keep the provider's current settings. Partial ranges restrict the exit; uncovered proxy destinations are refused, while explicit direct rules retain their separate behavior. If an old configuration lacks IPv6, download a current one and check its addresses and ranges.
• MTU: Preserve the downloaded value initially. When omitted, Usque defaults the WireGuard interface to 1280; accepted explicit values are 1280–9000. The WARP leg uses its own 1280-byte MTU for a chain. Usque caps TCP MSS for WireGuard over H3, but that does not prove all UDP packet sizes work on every path. See the chain reference before changing MTU; editing the original file requires importing it again.

Country-based direct rules can send traffic outside both tunnel legs and use system DNS by default. Review Direct DNS and your bypass settings when interpreting a result.

7. Troubleshoot or change the exit

Symptom	Next step
Configuration is saved, but Home still shows ordinary WARP	Enable the chain, select the saved entry, apply it and connect. Confirm Current connection, not only Saved selection.
WireGuard source is unavailable	Check for a supported official Usque update; do not substitute WARP via WireGuard for a Proton configuration.
Import fails	Check the source, UTF-8 encoding, size and field/line error. Use one Interface and one Peer; download a fresh standard .conf if needed.
Not available with L4	Select Turn off L4 and apply. WireGuard needs CONNECT-IP H3/H2.
WARP connects, then the chain fails or times out	Read the chain's inline error. Check that the configuration is current and the selected server is available; download and select another Proton server configuration if necessary. WARP connectivity alone does not establish Proton connectivity.
Connected, but names do not resolve	Check the displayed DNS, address families and AllowedIPs, plus any local/proxy DNS overrides. Restore the provider's settings through a fresh import; do not remove DNS merely to fall back to the physical network.
Public IP appears unchanged or is not the expected exit	Check that the request used VPN or the explicit proxy, the browser is included on Android, and the destination is not bypassed. Recheck the live configuration and make a fresh request.
Some sites or large transfers stall	In Settings → Advanced network settings, select HTTP/2, apply and reconnect, then retry the same request. Review the MTU guidance; this changes the outer transport, not Proton's WireGuard endpoint.

For more context, open Network Doctor. Standard checks inspect local state; Deep checks require confirmation and send limited probes. Their result does not certify the full Proton chain.

To switch servers, import the other .conf, select it and apply. To return to ordinary WARP, turn off Enable chain proxy and apply; reconnect from Home if disconnected. Disabling the chain removes Proton VPN from the traffic path. To delete an entry, first clear or replace any draft/saved selection and end the connection using it. Deleting the saved entry does not delete your downloaded file.

A terminal chain failure stops the whole connection and retains the requested selection and error. Usque does not automatically continue in WARP-only mode. This is not a promise to block every application's network access after a VPN process exits. On Android, use system Always-on VPN and Block connections without VPN for that blocking policy; follow Android setup. Proxy-only mode does not provide a system-wide VPN Kill Switch.

This setup does not provide every Proton app feature or promise faster speeds or streaming access. Usque is not affiliated with Cloudflare or Proton. Report suspected leaks or credential exposure privately under the security policy, without attaching a private key or complete configuration.