Repository navigation
FAQ
MASQUE VPN is an experimental, self-hosted VPN project based on QUIC, HTTP/3
CONNECT-IP, and mutual TLS (mTLS).
You run the server on infrastructure you control, such as a VPS, and connect with a supported client application. MASQUE VPN is not a public commercial VPN service and does not operate shared exit servers for users.
See Architecture for a high-level explanation of the protocol stack and traffic flow.
Yes. MASQUE VPN is designed for self-hosting.
You are responsible for selecting and operating the VPS or server, including its firewall rules, network access, credentials, operating-system updates, server configuration, and ongoing maintenance.
The IP address seen by destination services is normally the egress address of your server, not the address of your client network.
See Getting Started for the first deployment path.
Current project materials cover these client platforms:
- Android
- Android TV
- Windows
For the current client status, installation guidance, compatibility notes, and platform-specific limitations, read the versioned client documentation.
Support can change between releases. Always check the latest release before deploying or reporting a problem.
MASQUE VPN uses MASQUE CONNECT-IP to carry IP traffic through an HTTP/3
connection. In practice, it is intended to provide VPN-style IP-layer traffic
tunneling between the client and your self-hosted server.
It is not simply a traditional HTTP proxy. Client applications integrate the tunnel with the operating system's VPN facilities, subject to the capabilities and limitations of each platform.
QUIC provides encrypted, multiplexed transport over UDP. HTTP/3 runs over QUIC
and provides the context for the MASQUE CONNECT-IP tunnel.
This protocol stack is a core part of the project design, but it also means that UDP reachability matters. Some Wi-Fi networks, mobile operators, captive portals, enterprise networks, or regional filtering systems may block, limit, or handle UDP traffic differently.
See Architecture and Censorship resistance for more context.
Mutual TLS means that both the client and the server authenticate with certificates.
The client verifies the intended server identity, while the server verifies that the client has an authorized certificate and corresponding private key. This helps prevent unknown clients from connecting to the server when credentials are managed correctly.
A client private key is an access credential. Keep it private and replace it if a device is lost, compromised, or no longer authorized.
See Security Model for credential handling and trust boundaries.
No. A VPN changes the network location from which traffic exits to the Internet, but it does not automatically provide complete anonymity.
Destination services may still identify you through accounts, cookies, browser fingerprinting, payment information, device identifiers, application telemetry, or other application-layer data. You also trust the server and the person or organization operating it.
See Security Model for details about the trust model and limitations.
No. Successful operation depends on your VPS, routing, firewall configuration, DNS behavior, client platform, local network conditions, and treatment of UDP traffic along the path.
A deployment may work from one network and fail from another. This does not always indicate a server configuration problem.
Test from the networks that matter to you and review the censorship resistance documentation before relying on a deployment in a restrictive environment.
No protocol can guarantee reachability across every restricted, filtered, or managed network.
MASQUE VPN may be affected by UDP filtering, IP blocking, DNS interference, traffic shaping, provider policy, captive portals, or other network controls. The effectiveness of any deployment depends on the specific network and can change over time.
Read the repository's censorship resistance documentation for the project's current guidance and limitations.
No. A VPN tunnel cannot protect data from malware or an attacker with sufficient access to the client device.
Keep the device and client application updated, use normal device-security practices, protect credentials, and avoid installing untrusted software, VPN profiles, or root certificates.
The encrypted MASQUE VPN tunnel protects traffic between the client and the MASQUE VPN server according to the deployment and client configuration.
After traffic leaves the server toward a destination, its protection depends on the protocols used by that destination. For example, HTTPS provides its own encryption between the client application and the website, while unencrypted application traffic remains unencrypted after it exits the VPN server.
MTU 1369 is a conservative interim default selected from the current MASQUE connection test matrix.
Several tested paths passed at MTU 1400, but Android mobile testing on MTS passed at MTU 1370 and showed 100% DF-probe loss at MTU 1380. Choosing 1369 preserves a small margin below the lowest successful tested boundary.
This is not a universal PMTU guarantee. It should be re-evaluated as testing expands to more carriers, devices, IP stacks, server locations, and network conditions.
See MTU Testing for the full data and decision log.
First, verify the server and client versions, endpoint, credentials, server service status, firewall rules, and whether the problem happens on another network.
Then consult Troubleshooting. It includes a safe diagnostic order and guidance on collecting sanitized logs.
Do not post private keys, certificates, complete configuration files, tokens, or unredacted logs in public issues or discussions.
Use the following channels:
- Issues for reproducible bugs and feature requests.
- Discussions for questions, deployment discussion, and community feedback.
- Releases for published builds and release notes.
- Repository documentation for current technical guidance.
Before opening a report, search existing issues and discussions, state your client and server versions, describe the affected network, provide the exact error message, and include only sanitized diagnostic information.
Do not publish a suspected vulnerability in a public issue or discussion.
Follow the repository security policy for the current vulnerability-reporting process.
MASQUE VPN is experimental software. Features, supported platforms, configuration formats, and behavior can change between releases.
Evaluate it in your own environment, maintain backups and credential hygiene, and do not rely on it as the only control for critical availability, anonymity, or security requirements.