TCP-Native VPN. Works Where UDP Doesn't.

---

Konduit is a modern VPN built around a single principle: TCP transport that works when UDP is blocked.

WireGuard is excellent — until your ISP throttles or blocks UDP. Konduit solves that without the complexity of OpenVPN or the fragility of UDP-wrapping hacks. It runs fully in userspace, requires no elevated privileges, and gets out of your way.

Why Konduit?

Most VPNs treat TCP as a fallback. Konduit is designed for TCP from the ground up, which means:

• No HEAD-OF-LINE blocking from tunneling UDP into TCP
• Reliable behaviour on restrictive corporate and mobile networks
• WireGuard-level simplicity without the UDP dependency

Features

• TCP-native protocol — designed for TCP, not retrofitted
• Server-controlled routing — administrators enforce routing policy; clients cannot bypass it
• Userspace implementation — no kernel modules, no root required
• Hot config reload — update server configuration without dropping connections
• QR code provisioning — scan once, connect instantly
• Cross-platform — Linux, Windows, Android (macOS and iOS coming soon)
• Modern cryptography — X25519 key exchange, ChaCha20-Poly1305 data channel
• SOCKS5 chaining — egress-dial (use_proxy) to reach the server through your own proxy, or a post-tunnel listener (listen_socks) for per-app routing — see SOCKS Modes
• Memory safe — written entirely in Rust

Download

Releases are published on the Releases page. Each release includes:

Artifact	Platform	Purpose
konduit-server-*-linux-x86_64	Linux	VPN server
konduit-*-linux-x86_64	Linux	CLI client
konduit-ctl-*-linux-x86_64	Linux	Server provisioning tool
Konduit-*-x86_64.AppImage	Linux	GUI client (AppImage)
konduit-cli-*-windows-x86_64.zip	Windows	CLI client + wintun.dll
konduit-gui-*-windows-x86_64.zip	Windows	GUI client
konduit-*-android.aab	Android	Android app (sideload via bundletool)

Linux (CLI)

# Download konduit and konduit-ctl from the Releases page, then:
chmod +x konduit konduit-ctl

# Bootstrap a server
echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -

# Connect a client
./konduit connect --config client.toml

Linux (GUI)

Download the .AppImage, make it executable, and run it:

chmod +x Konduit-*-x86_64.AppImage
./Konduit-*-x86_64.AppImage

Windows

Extract the zip and run konduit.exe (CLI) or Konduit.exe (GUI). wintun.dll must remain alongside the executable.

Android

Download from Google Play or sideload the .aab using bundletool.

macOS · iOS

Coming soon.

Setup

GUI clients

• Linux GUI Quickstart — AppImage, privileges, autostart
• Windows GUI Quickstart — extract, UAC, WinTun, autostart

CLI & server

• Client Quickstart — download, configure, connect, run as a systemd service
• Server Quickstart — install, provision, NAT setup for iptables and firewalld
• SOCKS5 Modes — reach the server through a proxy, or expose a local SOCKS5 listener
• Connection Tuning — opt-in connection pooling for unstable links
• systemd units — service files for konduit-server, konduit (client), and konduit-admin-ui

Architecture

Flutter UI (Dart)
      │
flutter_rust_bridge (FFI)
      │
Konduit engine (Rust)
      ├── TUN device (userspace)
      ├── TCP tunnel protocol
      ├── Key exchange (X25519)
      └── Route manager

Layer	Technology
UI	Flutter / Dart
Core engine	Rust (Tokio async)
FFI bridge	flutter_rust_bridge
Cryptography	ring / rustls
TUN device	tun crate (userspace)

Openness Model

The konduit-platform crate is published here for transparency and security audit. It contains the cryptographic primitives, connection statistics, and platform networking layer (TUN device, DNS, routes) — everything an auditor needs to verify what runs on your machine. It is licensed under the PolyForm Noncommercial License 1.0.0 — free to read, study, and use for noncommercial purposes.

The VPN server and management UI are proprietary. Source review under NDA is available for enterprise partners.

Security

No UDP dependency: Konduit does not require UDP at any layer.

Key storage: Private keys are stored in the OS secure enclave on every platform (iOS Keychain, macOS Keychain, Android Keystore). They are never written to disk in plaintext.

Support

Bug reports, security vulnerabilities, and any other inquiries: use the contact form at www.k-ops.eu.

Contributing: Core development is handled internally. We do not currently accept external pull requests.

---

About

Created by Eugen Kaparulin.
Official binaries distributed by K-Ops Oy.

© Eugen Kaparulin. All rights reserved.
konduit-platform is published under the PolyForm Noncommercial License 1.0.0.
All other parts of Konduit are proprietary.
Privacy Policy