MASQUE VPN

unsigned

Self-hosted VPN: you run the server on your VPS and issue configs only to your own devices. The tunnel rides inside HTTP/3 (IETF MASQUE CONNECT-IP), so it looks like ordinary web traffic rather than a classic VPN handshake. Clients authenticate with mutual TLS — the server accepts only certificates you signed.

This is not a commercial VPN brand and not an audited enterprise client. It is a working personal or family server with open source. Treat it as experimental: GitHub Actions compile and test the tree; that is not a third-party penetration test.

Why people pick it

Your machine, your keys. Traffic exits at your VPS. You keep the CA; only issued client certs can connect. HTTP/3 transport. QUIC + CONNECT-IP is harder to fingerprint than default OpenVPN or WireGuard. It does not promise to bypass any particular national firewall. Real clients. Phone, TV, and Windows installers from GitHub Releases — not a CLI-only toy. One bundle per device. Reconnect (sleep, Wi-Fi → LTE, long airplane mode) keeps a stable tunnel address.