[GH-ISSUE #3035] Feature request: self-hosted MASQUE CONNECT-IP profile #1391

New issue

Open

opened 2026-10-13 20:41:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:41:25 +00:00

Owner

Originally created by @Next1971 on GitHub (Aug 24, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3035

Summary

Please consider adding a self-hosted MASQUE CONNECT-IP profile type to
Amnezia VPN.

MASQUE CONNECT-IP is an IP tunnel over HTTP/3/QUIC, specified in RFC 9484.
This request is not about Cloudflare WARP or Cloudflare-managed endpoints.
The intended deployment model is self-hosted: the user operates their own
VPS, server endpoint and client credentials.

Why this may fit Amnezia

Amnezia already provides a self-hosted VPN workflow with desktop and mobile
clients. A CONNECT-IP profile could become an additional protocol option
for users who want full IP tunnelling over HTTP/3/QUIC while retaining
control over their own server and authentication material.

The egress location would be the location of the user's VPS, as with other
self-hosted Amnezia deployments.

Reference implementation

I maintain an experimental open-source end-to-end implementation:

https://github.com/Next1971/masque-vpn-mvp

Current components:

Go server implementing MASQUE CONNECT-IP over HTTP/3/QUIC
Mutual TLS authentication using a private CA
Android VPNService client
Windows client using Wintun
Self-hosted deployment and client-profile generation
Multi-client routing, reconnect handling and Android network handover

This is not a request to integrate or vendor this code directly. It is a
working reference implementation and a possible interoperability test
endpoint.

Suggested initial scope

A minimal first step could be limited to:

Importing a self-hosted CONNECT-IP profile and its client certificate.
Creating a TUN-based full tunnel.
Connecting to a CONNECT-IP server through HTTP/3/QUIC with mTLS.
Basic connect, disconnect and reconnect handling.

Cloudflare WARP compatibility, external subscription formats and automatic
server management can remain out of scope.

Offer

If this is interesting to the project, I can provide a sanitized test
deployment and test credentials for interoperability testing. I can also
help document the profile format and report Android/Windows client
behaviour.

Security note

The reference implementation is experimental and has not received a
third-party security audit.

Originally created by @Next1971 on GitHub (Aug 24, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3035 ## Summary Please consider adding a self-hosted MASQUE CONNECT-IP profile type to Amnezia VPN. MASQUE CONNECT-IP is an IP tunnel over HTTP/3/QUIC, specified in RFC 9484. This request is not about Cloudflare WARP or Cloudflare-managed endpoints. The intended deployment model is self-hosted: the user operates their own VPS, server endpoint and client credentials. ## Why this may fit Amnezia Amnezia already provides a self-hosted VPN workflow with desktop and mobile clients. A CONNECT-IP profile could become an additional protocol option for users who want full IP tunnelling over HTTP/3/QUIC while retaining control over their own server and authentication material. The egress location would be the location of the user's VPS, as with other self-hosted Amnezia deployments. ## Reference implementation I maintain an experimental open-source end-to-end implementation: https://github.com/Next1971/masque-vpn-mvp Current components: - Go server implementing MASQUE CONNECT-IP over HTTP/3/QUIC - Mutual TLS authentication using a private CA - Android VPNService client - Windows client using Wintun - Self-hosted deployment and client-profile generation - Multi-client routing, reconnect handling and Android network handover This is not a request to integrate or vendor this code directly. It is a working reference implementation and a possible interoperability test endpoint. ## Suggested initial scope A minimal first step could be limited to: 1. Importing a self-hosted CONNECT-IP profile and its client certificate. 2. Creating a TUN-based full tunnel. 3. Connecting to a CONNECT-IP server through HTTP/3/QUIC with mTLS. 4. Basic connect, disconnect and reconnect handling. Cloudflare WARP compatibility, external subscription formats and automatic server management can remain out of scope. ## Offer If this is interesting to the project, I can provide a sanitized test deployment and test credentials for interoperability testing. I can also help document the profile format and report Android/Windows client behaviour. ## Security note The reference implementation is experimental and has not received a third-party security audit.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1391

No description provided.

Rows
Columns