-
Konduit v0.1.0-beta.5 Pre-Release
eugen released this
2026-06-25 11:16:21 +00:00 | 10 commits to master since this releaseKonduit 0.1.0-beta.5
Stealth Mode Rework — Real TLS Bypass
The stealth/bypass mode has been completely reworked. The previous fake-TLS implementation
(custom ClientHello/ServerHello) was detectable by Russia's TSPU deep packet inspection.
Stealth mode now uses real TLS 1.3 with a valid certificate, making VPN traffic
indistinguishable from normal HTTPS.How it works:
- HAProxy on the server terminates TLS on port 443 using a real certbot certificate
- The konduit client wraps its connection in real TLS (tokio-rustls / ring crypto)
- DPI sees valid TLS 1.3 to a real domain — no heuristic fingerprints
- Web traffic to the same domain still routes normally (HAProxy routes by first byte)
Config change:
stealth = truenow means real TLS bypass. Existing configs work
without modification. Servers must run HAProxy with TLS termination on port 443.Bug fixes:
- Android PrepareVPN path now correctly applies TLS wrapping
- SNI is preserved through DNS pre-resolution on all platforms
- Switched TLS crypto backend from aws-lc-rs to ring (faster builds, no C dependencies)
What's Next
- iOS support
- GUI toggle for bypass mode with server setup guide
Downloads