-
Konduit v0.1.0-beta.13 Pre-Release
eugen released this
2026-10-10 17:51:12 +00:00 | 1 commits to master since this releaseBeta 13 — Reconnect Fixes and Offline Map Hardening
Fixed
Client reconnection and endpoint management
- System DNS settings are now reverted before attempting to reconnect.
- Reconnection attempts now apply a backoff interval.
- The endpoint list is no longer emptied when dropping hostnames.
Offline location map
- Hardened offline location map handling with geotools v0.1.1.
Downloads
-
Konduit v0.1.0-beta.12 Pre-Release
2026-10-06 16:46:29 +00:00 | 1 commits to master since this releaseBeta 12 — Offline Location Map and Route Teardown Fixes
New
Offline location map in the GUI
The location map no longer depends on an online tile service. The previous map
used CARTO tiles, which now require an API key, so it could fail to render. The
map is now drawn on the device from built-in geographic data as an SVG: no tile
requests, no API key, and no third party learning where you are connecting. It is
zoomed out to a 26° span by default, andKONDUIT_MAP_SPAN_LAToverrides that.Fixed
Route teardown on Linux
- A netlink lookup that fails during teardown no longer skips the rest of the
cleanup. - A server host route left behind by an earlier run is now adopted, so the next
teardown removes it. Only routes that are unmistakably konduit's are adopted. - Another VPN's endpoint can be pinned to the physical gateway, so it is kept off
the tunnel. This is what lets an existing WireGuard VPN keep working alongside a
full tunnel.
GUI robustness
- The map is generated outside the UI build step, removing a short stutter on
screens that show it. - The map's native code is panic-safe and logs like the rest of the engine.
Downloads
- A netlink lookup that fails during teardown no longer skips the rest of the
-
Konduit v0.1.0-beta.11 Pre-Release
2026-07-25 15:04:01 +00:00 | 5 commits to master since this releaseBeta 11 — Linux Physical Gateway Detection Fix
Fixed
Reconnecting on Linux could pick the VPN's own tun interface as the "physical" gateway (recurrence of #36)
Physical default-gateway detection picked the route with the highest metric,
on the assumption that VPN routes always have a low metric and physical/DHCP
routes a high one. That assumption breaks when the kernel doesn't round-trip
the route's Priority attribute on a dump, or when a leftover default route
survives on a reused tun ifindex from an imperfectly torn-down previous
session — either can let the client's own tun interface win the metric
comparison. The client now excludes its own tun interface outright when
scanning candidates, rather than relying on metric comparison alone to steer
around it.Downloads
-
Konduit v0.1.0-beta.10 Pre-Release
2026-07-23 18:53:57 +00:00 | 6 commits to master since this releaseBeta 10 — Linux Full-Tunnel DNS/IPv6 Leak Fix
Fixed
Browsing broke intermittently while connected on Linux, despite the tunnel itself working
Full-tunnel connect never demoted the physical network interface as a
default DNS resolver in systemd-resolved, so DNS queries could be answered
by either the ISP's DNS or the VPN's DNS interchangeably — a split-brain
that produced inconsistent, sometimes partial (IPv6-only) answers. On top
of that, full-tunnel mode only installed an IPv4 default route, so any
destination that resolved to an IPv6 address leaked straight out the
physical interface instead of through the tunnel, or hung waiting on an
unreachable path — the exact failure mode that stalled page loads in
Chromium-based browsers while simple single-request tools (curl) still
appeared to work fine.The client now snapshots and blanks the physical interface's DNS servers
for the duration of the VPN session (restoring them exactly on disconnect),
and installs an IPv6 "unreachable" default route so IPv6 attempts fail
instantly and clients fall back to IPv4 through the tunnel instead of
stalling.Downloads
-
Konduit v0.1.0-beta.9 Pre-Release
2026-07-20 12:43:49 +00:00 | 8 commits to master since this releaseBeta 9 — TUN Device Recreation Fix
Fixed
Client fails to reconnect after the TUN adapter is dropped
If the TUN reader/writer task exited (e.g. the WinTun adapter was dropped on
Windows), the client would try to reuse the dead adapter on the next
reconnect instead of recreating it. The client's persistent state now tracks
the TUN task'sJoinHandleand checksis_finished()before each reconnect
attempt; if the task has exited, persistent state is reset so the next
connect builds the TUN device from scratch.Notes
This release also fills in the beta.8 Linux CLI build, which was missing
from the previous release's binaries.Downloads
-
Konduit v0.1.0-beta.8 Pre-Release
2026-07-16 12:05:37 +00:00 | 9 commits to master since this releaseBeta 8 — SOCKS5 Chaining, Stealth Mode Removed, Throughput Fixes
What's New
SOCKS5 chaining (
use_proxy/listen_socks)Stealth/camouflage mode is gone. In its place, Konduit now exposes plain SOCKS5
hooks so it can be chained behind a dedicated proxy tool (e.g. Xray, sing-box)
instead of reimplementing traffic obfuscation itself:use_proxy— dial the server through an upstream SOCKS5 proxy (egress)listen_socks— expose a local SOCKS5 listener after the tunnel is up, so
other tools can route traffic through the VPN (ingress)
Both are available as config fields and CLI flags, and are now surfaced in the
admin-ui device creation form and generatedclient.toml.Download throughput bug fixed
DL throughput was capped at ~130 Kbit/s in every configuration, independent of
any TSPU/censorship interference — proven via an SSH-tunneled control test.
Root cause: the server's TUN read path (Framed+BytesCodec) reused one
buffer and truncated packets once free space dropped below MTU. Fixed with a
fresh MTU-sized buffer per read plus an atomic single write. Clean-path DL is
now 4-5 Mbit/s (was ~130 Kbit/s), 0 retransmits.Per-flow connection pinning
Concurrent flows now spread across the connection pool instead of piling onto
one connection: each inner flow (5-tuple hash) is pinned to one pooled
connection for both download (server-side) and upload (client-side), so
traffic no longer reorders and multiple flows use the pool in parallel.Removed
stealthconfig/CLI flag and everything it implied: fake-TLS, uTLS Chrome
fingerprinting, WebSocket camouflage, HTTP POST tunnel + padding, gRPC-shaped
traffic, burst shaping, IMAP IDLE camouflagessh_transport— real-SSH-carried tunnel mode; measured at ~10x below
baseline throughput with a DL/UL asymmetry that wasn't worth chasing further[stealth]config block — replaced by a plain[connection]block
(pool_enabled,pool_size,carry_duration)
Upgrade notes
Any
client.toml/server.tomlusing[stealth]fields (stealth,
reconnect_interval,tls_sni,tls_fingerprint,ssh_transport, etc.) must
be updated to the new[connection]block plususe_proxy/listen_socksas
needed — the old fields are no longer recognized.Downloads
-
Konduit v0.1.0-beta.6 Pre-Release
2026-06-25 18:52:18 +00:00 | 15 commits to master since this releaseKonduit 0.1.0-beta.6
Windows — Fixes & Installer
This release replaces the beta.5 Windows packages with working builds.
GUI elevation fix — the beta.5 GUI failed to connect due to a missing privilege
escalation step. The app now correctly requests admin rights on launch.CLI installer — a new
install-cli.ps1PowerShell script automates CLI setup:
registers konduit as a scheduled task so it runs elevated without a UAC prompt each time.Linux DNS fixes (also included):
get_default_gatewaynow picks the route with the highest metric (fixes multi-interface setups)- DNS revert via
resolvectlalways runs on disconnect, even if routes were already cleaned up restore_routesonly removes the VPN default route by interface (OIF), not all default routes- DNS override is skipped entirely in full-tunnel mode; WiFi DNS continues working
Installation
GUI: Extract
konduit-gui-0.1.0-beta.6-windows-x86_64.zipand runkonduit.exe— it will
prompt for elevation on first launch.CLI: Extract
konduit-cli-0.1.0-beta.6-windows-x86_64.zip, then runinstall-cli.ps1
from an elevated PowerShell prompt to register the scheduled task.Downloads
-
Konduit v0.1.0-beta.5 Pre-Release
2026-06-25 11:16:21 +00:00 | 15 commits to master since this releaseKonduit 0.1.0-beta.5
Stealth Mode Rework — Real TLS Bypass
The stealth/bypass mode has been completely reworked. The previous fake-TLS implementation
(custom ClientHello/ServerHello) was detectable by Russia's TSPU deep packet inspection.
Stealth mode now uses real TLS 1.3 with a valid certificate, making VPN traffic
indistinguishable from normal HTTPS.How it works:
- HAProxy on the server terminates TLS on port 443 using a real certbot certificate
- The konduit client wraps its connection in real TLS (tokio-rustls / ring crypto)
- DPI sees valid TLS 1.3 to a real domain — no heuristic fingerprints
- Web traffic to the same domain still routes normally (HAProxy routes by first byte)
Config change:
stealth = truenow means real TLS bypass. Existing configs work
without modification. Servers must run HAProxy with TLS termination on port 443.Bug fixes:
- Android PrepareVPN path now correctly applies TLS wrapping
- SNI is preserved through DNS pre-resolution on all platforms
- Switched TLS crypto backend from aws-lc-rs to ring (faster builds, no C dependencies)
What's Next
- iOS support
- GUI toggle for bypass mode with server setup guide
Downloads
-
Konduit v0.1.0-beta.4 Pre-Release
2026-06-22 18:46:06 +00:00 | 17 commits to master since this releaseKonduit 0.1.0-beta.4 — Android fix
Changes
Android
- Fix: corrected JNI name mangling for
KonduitVpnService(eu_k_1opsinstead ofeu_kops) — resolves crash on VPN session start
Downloads
File Description konduit-0.1.0-beta.4-android.aab Android app bundle Downloads
- Fix: corrected JNI name mangling for
-
Konduit v0.1.0-beta.0 Pre-Release
2026-06-17 09:15:11 +00:00 | 21 commits to master since this releaseKonduit 0.1.0-beta.0 — First public beta
Konduit is a TCP-native VPN designed to work on networks where UDP is blocked or throttled.
No kernel modules, no root, no head-of-line blocking.What's included
Server
- konduit-server: VPN server with server-controlled routing, hot config reload, and stealth mode
- konduit-ctl: server provisioning tool — bootstrap, add clients, generate QR codes
- Stealth mode: port 443 deployment behind HAProxy; the server is indistinguishable from a normal HTTPS site to DPI scanners
Client — Linux
- konduit: CLI client (static binary)
- Konduit AppImage: desktop GUI with connection map, traffic graphs, and QR-code provisioning
Client — Windows
- konduit-cli: CLI client (konduit.exe + wintun.dll)
- Konduit GUI: desktop GUI (Konduit.exe + wintun.dll); requires UAC elevation on launch
Client — Android
- Konduit for Android: available on Google Play
Cryptography
- X25519 ephemeral key exchange
- ChaCha20-Poly1305 data channel
- Ed25519 identity keys
- Argon2id key derivation from server mantra
Getting started
- Linux GUI Quickstart
- Windows GUI Quickstart
- CLI Client Quickstart
- Server Quickstart
- Stealth Mode Setup
Known limitations
- macOS and iOS clients are in development
- AppImage requires cap_net_admin — granted automatically via polkit on first launch
- Windows GUI requires administrator privileges for WinTun driver
- This is a beta: the wire protocol may change before 1.0
Downloads
File Description konduit-server-0.1.0-beta.0-linux-x86_64 VPN server (Linux) konduit-0.1.0-beta.0-linux-x86_64 CLI client (Linux) konduit-ctl-0.1.0-beta.0-linux-x86_64 Provisioning tool (Linux) Konduit-0.1.0-beta.0-x86_64.AppImage Desktop GUI (Linux) konduit-cli-0.1.0-beta.0-windows-x86_64.zip CLI client (Windows) konduit-gui-0.1.0-beta.0-windows-x86_64.zip Desktop GUI (Windows) konduit-0.1.0-beta.0-android.aab Android app bundle Downloads