konduit/konduit-public
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

9 Releases 9 Tags

RSS Feed
  • v0.1.0-beta.11 11d5305d8c
    Compare

    Konduit v0.1.0-beta.11 Pre-Release

    eugen released this 2026-07-25 15:04:01 +00:00 | 0 commits to master since this release

    Beta 11 — Linux Physical Gateway Detection Fix

    Fixed

    Reconnecting on Linux could pick the VPN's own tun interface as the "physical" gateway (recurrence of #36)

    Physical default-gateway detection picked the route with the highest metric,
    on the assumption that VPN routes always have a low metric and physical/DHCP
    routes a high one. That assumption breaks when the kernel doesn't round-trip
    the route's Priority attribute on a dump, or when a leftover default route
    survives on a reused tun ifindex from an imperfectly torn-down previous
    session — either can let the client's own tun interface win the metric
    comparison. The client now excludes its own tun interface outright when
    scanning candidates, rather than relying on metric comparison alone to steer
    around it.

    Downloads
  • v0.1.0-beta.10 c2d7f8d8c6
    Compare

    Konduit v0.1.0-beta.10 Pre-Release

    eugen released this 2026-07-23 18:53:57 +00:00 | 1 commits to master since this release

    Beta 10 — Linux Full-Tunnel DNS/IPv6 Leak Fix

    Fixed

    Browsing broke intermittently while connected on Linux, despite the tunnel itself working

    Full-tunnel connect never demoted the physical network interface as a
    default DNS resolver in systemd-resolved, so DNS queries could be answered
    by either the ISP's DNS or the VPN's DNS interchangeably — a split-brain
    that produced inconsistent, sometimes partial (IPv6-only) answers. On top
    of that, full-tunnel mode only installed an IPv4 default route, so any
    destination that resolved to an IPv6 address leaked straight out the
    physical interface instead of through the tunnel, or hung waiting on an
    unreachable path — the exact failure mode that stalled page loads in
    Chromium-based browsers while simple single-request tools (curl) still
    appeared to work fine.

    The client now snapshots and blanks the physical interface's DNS servers
    for the duration of the VPN session (restoring them exactly on disconnect),
    and installs an IPv6 "unreachable" default route so IPv6 attempts fail
    instantly and clients fall back to IPv4 through the tunnel instead of
    stalling.

    Downloads
  • v0.1.0-beta.9 56201f6b72
    Compare

    Konduit v0.1.0-beta.9 Pre-Release

    eugen released this 2026-07-20 12:43:49 +00:00 | 3 commits to master since this release

    Beta 9 — TUN Device Recreation Fix

    Fixed

    Client fails to reconnect after the TUN adapter is dropped

    If the TUN reader/writer task exited (e.g. the WinTun adapter was dropped on
    Windows), the client would try to reuse the dead adapter on the next
    reconnect instead of recreating it. The client's persistent state now tracks
    the TUN task's JoinHandle and checks is_finished() before each reconnect
    attempt; if the task has exited, persistent state is reset so the next
    connect builds the TUN device from scratch.

    Notes

    This release also fills in the beta.8 Linux CLI build, which was missing
    from the previous release's binaries.

    Downloads
  • v0.1.0-beta.8 b160652737
    Compare

    Konduit v0.1.0-beta.8 Pre-Release

    eugen released this 2026-07-16 12:05:37 +00:00 | 4 commits to master since this release

    Beta 8 — SOCKS5 Chaining, Stealth Mode Removed, Throughput Fixes

    What's New

    SOCKS5 chaining (use_proxy / listen_socks)

    Stealth/camouflage mode is gone. In its place, Konduit now exposes plain SOCKS5
    hooks so it can be chained behind a dedicated proxy tool (e.g. Xray, sing-box)
    instead of reimplementing traffic obfuscation itself:

    • use_proxy — dial the server through an upstream SOCKS5 proxy (egress)
    • listen_socks — expose a local SOCKS5 listener after the tunnel is up, so
      other tools can route traffic through the VPN (ingress)

    Both are available as config fields and CLI flags, and are now surfaced in the
    admin-ui device creation form and generated client.toml.

    Download throughput bug fixed

    DL throughput was capped at ~130 Kbit/s in every configuration, independent of
    any TSPU/censorship interference — proven via an SSH-tunneled control test.
    Root cause: the server's TUN read path (Framed + BytesCodec) reused one
    buffer and truncated packets once free space dropped below MTU. Fixed with a
    fresh MTU-sized buffer per read plus an atomic single write. Clean-path DL is
    now 4-5 Mbit/s (was ~130 Kbit/s), 0 retransmits.

    Per-flow connection pinning

    Concurrent flows now spread across the connection pool instead of piling onto
    one connection: each inner flow (5-tuple hash) is pinned to one pooled
    connection for both download (server-side) and upload (client-side), so
    traffic no longer reorders and multiple flows use the pool in parallel.

    Removed

    • stealth config/CLI flag and everything it implied: fake-TLS, uTLS Chrome
      fingerprinting, WebSocket camouflage, HTTP POST tunnel + padding, gRPC-shaped
      traffic, burst shaping, IMAP IDLE camouflage
    • ssh_transport — real-SSH-carried tunnel mode; measured at ~10x below
      baseline throughput with a DL/UL asymmetry that wasn't worth chasing further
    • [stealth] config block — replaced by a plain [connection] block
      (pool_enabled, pool_size, carry_duration)

    Upgrade notes

    Any client.toml/server.toml using [stealth] fields (stealth,
    reconnect_interval, tls_sni, tls_fingerprint, ssh_transport, etc.) must
    be updated to the new [connection] block plus use_proxy/listen_socks as
    needed — the old fields are no longer recognized.

    Downloads
  • v0.1.0-beta.6 e63d41c153
    Compare

    Konduit v0.1.0-beta.6 Pre-Release

    eugen released this 2026-06-25 18:52:18 +00:00 | 10 commits to master since this release

    Konduit 0.1.0-beta.6

    Windows — Fixes & Installer

    This release replaces the beta.5 Windows packages with working builds.

    GUI elevation fix — the beta.5 GUI failed to connect due to a missing privilege
    escalation step. The app now correctly requests admin rights on launch.

    CLI installer — a new install-cli.ps1 PowerShell script automates CLI setup:
    registers konduit as a scheduled task so it runs elevated without a UAC prompt each time.

    Linux DNS fixes (also included):

    • get_default_gateway now picks the route with the highest metric (fixes multi-interface setups)
    • DNS revert via resolvectl always runs on disconnect, even if routes were already cleaned up
    • restore_routes only removes the VPN default route by interface (OIF), not all default routes
    • DNS override is skipped entirely in full-tunnel mode; WiFi DNS continues working

    Installation

    GUI: Extract konduit-gui-0.1.0-beta.6-windows-x86_64.zip and run konduit.exe — it will
    prompt for elevation on first launch.

    CLI: Extract konduit-cli-0.1.0-beta.6-windows-x86_64.zip, then run install-cli.ps1
    from an elevated PowerShell prompt to register the scheduled task.

    Downloads
  • v0.1.0-beta.5 e63d41c153
    Compare

    Konduit v0.1.0-beta.5 Pre-Release

    eugen released this 2026-06-25 11:16:21 +00:00 | 10 commits to master since this release

    Konduit 0.1.0-beta.5

    Stealth Mode Rework — Real TLS Bypass

    The stealth/bypass mode has been completely reworked. The previous fake-TLS implementation
    (custom ClientHello/ServerHello) was detectable by Russia's TSPU deep packet inspection.
    Stealth mode now uses real TLS 1.3 with a valid certificate, making VPN traffic
    indistinguishable from normal HTTPS.

    How it works:

    • HAProxy on the server terminates TLS on port 443 using a real certbot certificate
    • The konduit client wraps its connection in real TLS (tokio-rustls / ring crypto)
    • DPI sees valid TLS 1.3 to a real domain — no heuristic fingerprints
    • Web traffic to the same domain still routes normally (HAProxy routes by first byte)

    Config change: stealth = true now means real TLS bypass. Existing configs work
    without modification. Servers must run HAProxy with TLS termination on port 443.

    Bug fixes:

    • Android PrepareVPN path now correctly applies TLS wrapping
    • SNI is preserved through DNS pre-resolution on all platforms
    • Switched TLS crypto backend from aws-lc-rs to ring (faster builds, no C dependencies)

    What's Next

    • iOS support
    • GUI toggle for bypass mode with server setup guide
    Downloads
  • v0.1.0-beta.4 9eb9b39f77
    Compare

    Konduit v0.1.0-beta.4 Pre-Release

    eugen released this 2026-06-22 18:46:06 +00:00 | 12 commits to master since this release

    Konduit 0.1.0-beta.4 — Android fix

    Changes

    Android

    • Fix: corrected JNI name mangling for KonduitVpnService (eu_k_1ops instead of eu_kops) — resolves crash on VPN session start

    Downloads

    File Description
    konduit-0.1.0-beta.4-android.aab Android app bundle
    Downloads
  • v0.1.0-beta.0 7be38783b5
    Compare

    Konduit v0.1.0-beta.0 Pre-Release

    eugen released this 2026-06-17 09:15:11 +00:00 | 16 commits to master since this release

    Konduit 0.1.0-beta.0 — First public beta

    Konduit is a TCP-native VPN designed to work on networks where UDP is blocked or throttled.
    No kernel modules, no root, no head-of-line blocking.

    What's included

    Server

    • konduit-server: VPN server with server-controlled routing, hot config reload, and stealth mode
    • konduit-ctl: server provisioning tool — bootstrap, add clients, generate QR codes
    • Stealth mode: port 443 deployment behind HAProxy; the server is indistinguishable from a normal HTTPS site to DPI scanners

    Client — Linux

    • konduit: CLI client (static binary)
    • Konduit AppImage: desktop GUI with connection map, traffic graphs, and QR-code provisioning

    Client — Windows

    • konduit-cli: CLI client (konduit.exe + wintun.dll)
    • Konduit GUI: desktop GUI (Konduit.exe + wintun.dll); requires UAC elevation on launch

    Client — Android

    • Konduit for Android: available on Google Play

    Cryptography

    • X25519 ephemeral key exchange
    • ChaCha20-Poly1305 data channel
    • Ed25519 identity keys
    • Argon2id key derivation from server mantra

    Getting started

    Known limitations

    • macOS and iOS clients are in development
    • AppImage requires cap_net_admin — granted automatically via polkit on first launch
    • Windows GUI requires administrator privileges for WinTun driver
    • This is a beta: the wire protocol may change before 1.0

    Downloads

    File Description
    konduit-server-0.1.0-beta.0-linux-x86_64 VPN server (Linux)
    konduit-0.1.0-beta.0-linux-x86_64 CLI client (Linux)
    konduit-ctl-0.1.0-beta.0-linux-x86_64 Provisioning tool (Linux)
    Konduit-0.1.0-beta.0-x86_64.AppImage Desktop GUI (Linux)
    konduit-cli-0.1.0-beta.0-windows-x86_64.zip CLI client (Windows)
    konduit-gui-0.1.0-beta.0-windows-x86_64.zip Desktop GUI (Windows)
    konduit-0.1.0-beta.0-android.aab Android app bundle
    Downloads
  • v0.1.0-beta 68b3a7fc26
    Compare

    Konduit v0.1.0-beta Pre-Release

    eugen released this 2026-06-08 10:48:47 +00:00 | 20 commits to master since this release

    Konduit 0.1.0-beta — First public beta

    Konduit is a TCP-native VPN designed to work on networks where UDP is blocked or throttled.
    No kernel modules, no root, no head-of-line blocking.

    What's included

    Server

    • konduit-server: VPN server with server-controlled routing, hot config reload, and stealth mode
    • konduit-ctl: server provisioning tool — bootstrap, add clients, generate QR codes
    • Stealth mode: port 443 deployment behind HAProxy; the server is indistinguishable from a normal HTTPS site to DPI scanners

    Client — Linux

    • konduit: CLI client (static binary)
    • Konduit AppImage: desktop GUI with connection map, traffic graphs, and QR-code provisioning

    Cryptography

    • X25519 ephemeral key exchange
    • ChaCha20-Poly1305 data channel
    • Ed25519 identity keys
    • Argon2id key derivation from server mantra

    Getting started

    See the server setup guides in the repository:

    • docs/server-quickstart.md — install, provision, NAT setup
    • docs/stealth-setup.md — HAProxy + camouflage configuration

    Known limitations

    • macOS, Android, and iOS clients are in development
    • AppImage requires cap_net_admin — granted automatically via polkit on first launch
    • This is a beta: the wire protocol may change before 1.0

    Downloads

    File Description
    konduit-server-0.1.0-beta-linux-x86_64 VPN server
    konduit-0.1.0-beta-linux-x86_64 CLI client
    konduit-ctl-0.1.0-beta-linux-x86_64 Provisioning tool
    Konduit-0.1.0-beta-x86_64.AppImage Desktop GUI (Linux)
    Downloads