Repository navigation
Security Model
MASQUE VPN is a self-hosted system. Its security depends on the protocol design, the implementation, the deployed server, the client device, and the operational choices of the person running the service.
This page describes the intended trust model and practical responsibilities. For the project's vulnerability-reporting process, see the repository security policy.
Warning
MASQUE VPN is experimental software. It should be tested in your own environment and should not be treated as a guarantee of anonymity, censorship resistance, endpoint security, or protection against every threat.
MASQUE VPN uses QUIC, HTTP/3 CONNECT-IP, and mutual TLS (mTLS) to establish
an authenticated encrypted tunnel between a client and the MASQUE VPN server.
When configured and used correctly, this tunnel is intended to protect traffic in transit on the path between the client and server from passive observation and modification by networks located between those two endpoints.
The tunnel does not make every part of an Internet connection private or safe. Traffic still leaves the server and travels to its final destination.
A MASQUE VPN deployment has several separate trust boundaries:
Client device
|
| Encrypted and mutually authenticated tunnel
|
MASQUE VPN server / VPS
|
| Normal Internet routing
|
Destination service
| Component or path | You trust it for |
|---|---|
| Client device and OS | Protecting local traffic, credentials, and the VPN client itself |
| Client private key | Proving the client identity to the server |
| MASQUE VPN server | Accepting tunnel traffic and routing it as configured |
| Server administrator | Protecting server access, keys, configuration, and logs |
| VPS provider | Physical and virtual hosting infrastructure, subject to its operating model |
| Network between client and server | Transport reachability; the tunnel reduces what intermediaries can inspect |
| DNS infrastructure | Name resolution when DNS is configured outside the intended tunnel path |
| Destination service | Its own connection security, authentication, content handling, and data retention |
| Network after server egress | Transport from the VPS to the destination service |
A VPN moves the visible Internet egress point from the client network to the server network. It does not eliminate trust in the server, the server operator, the client device, or the services being accessed.
mTLS means that both sides present and verify certificates:
- The client verifies the server identity according to the deployed trust configuration.
- The server verifies that the connecting client has an authorized certificate and corresponding private key.
This gives the server a cryptographic way to distinguish authorized clients from unknown clients. It is stronger than sharing one password across all devices, but its protection depends on keeping private keys private.
Treat a client certificate and its private key as an access credential. Anyone who obtains a usable copy may be able to connect as that client until the credential is replaced or revoked according to the deployment's process.
Use these operational practices:
- Keep client and server private keys out of source repositories.
- Do not paste keys, configuration bundles, tokens, or raw credentials into issues, discussions, chats, screenshots, or public logs.
- Use a separate client identity for each device or person where practical.
- Transfer credentials only through a channel you trust.
- Protect backups containing certificates, keys, or configuration files.
- Remove or replace credentials when a device is lost, sold, repaired by an untrusted party, or suspected to be compromised.
- Restrict access to server-side credential material and administrative accounts.
- Keep an inventory of active devices and issued client credentials.
The exact credential format and management commands are release-specific. Follow the current documentation and release notes for your deployment.
Operating a self-hosted VPN server is also a server-administration task. The server owner should:
- Apply operating-system, package, and MASQUE VPN updates promptly after reviewing their release notes.
- Limit administrative access and use strong authentication for the VPS.
- Configure host and provider firewalls to expose only necessary services.
- Secure SSH and any management interfaces.
- Protect certificate authority material, server keys, and client credentials.
- Review logs carefully and avoid retaining unnecessary sensitive data.
- Monitor available disk space, CPU, memory, network use, and service health.
- Maintain backups that are encrypted, access-controlled, and periodically tested.
- Understand the policies and security features provided by the VPS vendor.
If an attacker gains privileged control of the server or its key material, they may be able to disrupt service, impersonate the server within the applicable trust configuration, access server-side configuration, or observe traffic that has already reached the server for routing.
The tunnel begins on the device. It cannot protect a device that is already compromised.
Use normal device-security practices:
- Keep the operating system and MASQUE VPN client updated.
- Protect the device with a screen lock and appropriate account security.
- Avoid installing untrusted applications, VPN profiles, or root certificates.
- Protect client credential files from other device users and applications.
- Review VPN permissions and connection status after system updates.
- Replace client credentials when the device's security status is uncertain.
A VPN does not protect data from malware running with sufficient access on the client device.
A tunnel protects traffic only according to the routes and DNS behavior actually configured by the client and server.
Verify your deployment's intended behavior for:
- Whether DNS queries use the intended resolver and path.
- Which traffic is routed through the tunnel.
- Whether any routes intentionally bypass the tunnel.
- How IPv4 and IPv6 traffic are handled.
- How applications behave when the VPN is disconnected or reconnecting.
Destination services can still identify you through application login, cookies, browser fingerprinting, payment data, device identifiers, or other application-layer information. MASQUE VPN does not remove those identifiers.
MASQUE VPN does not by itself guarantee:
- Complete anonymity.
- Availability from every network or country.
- Protection from a compromised client device or VPS.
- Safety of websites, applications, or services reached through the tunnel.
- Elimination of account-level, browser-level, or device-level tracking.
- Protection against mistakes in server configuration or credential handling.
- Compliance with local law, VPS-provider terms, or network policy.
Network reachability can be affected by local filtering, UDP treatment, firewall rules, routing, DNS, and the VPS provider. Read the censorship resistance documentation for project-specific context.
Do not open a public issue for a suspected security vulnerability that could put users or deployments at risk.
Follow the repository's security policy for the current reporting process and contact instructions.
- Architecture — protocol roles and traffic flow.
- Getting Started — first deployment path and prerequisites.
- Troubleshooting — safe first-pass diagnosis steps.
- FAQ — scope, privacy, and self-hosting questions.
- Repository documentation — current implementation-specific material.