Documentation

HTTP/3 VPN: a tunnel that looks like ordinary web traffic

On a locked-down corporate network, a hotel Wi-Fi or a filtered 4G/5G connection, a VPN's first problem is not speed: it is getting through at all. Firewalls recognize WireGuard, OpenVPN or IPsec by their port and their signature, and cut them off. VIGIL-MESH takes the opposite path: its tunnels are QUIC sessions encrypted with TLS 1.3, sent to UDP port 443 — exactly what a browser emits when it speaks HTTP/3 to YouTube or Google. Seen from the network, the tunnel is ordinary web traffic.

HTTP/3, the perfect camouflage

HTTP/3 is the most recent version of the web's protocol. Unlike HTTP/1.1 and HTTP/2, it no longer runs over TCP but over QUIC, a transport built on UDP that bakes in TLS 1.3 encryption from the very first frame. The web's biggest players — Google, YouTube, the major CDNs — serve it by default: a considerable share of everyday Internet traffic is already QUIC to UDP port 443.

That is what makes it an ideal camouflage for a tunnel. With QUIC, almost everything is encrypted, including the transport headers that TCP used to leave in the clear. A deep packet inspection (DPI) appliance watching a QUIC session sees a machine talking to a server on UDP port 443 — and nothing more. It cannot tell a video call from a YouTube stream from a VPN tunnel: blocking one means blocking the entire modern web.

Why classic VPNs get blocked

Legacy VPN protocols share a common flaw: they announce themselves. A dedicated port, an exotic IP protocol or a recognizable handshake is all it takes for a corporate firewall, a hotel captive portal or a mobile carrier to identify them — and a “only the web gets out” policy eliminates them without even trying.

Protocol	What the network sees	Fate on a locked-down network
WireGuard	UDP to a dedicated port (51820 by default)	Blocked as soon as only web ports go out
OpenVPN	Recognizable handshake, even disguised as TCP 443	Identified and cut by common DPI appliances
IPsec/IKEv2	ESP protocol and UDP ports 500/4500	Filtered by most restrictive firewalls
HTTP/3 VPN (VIGIL-MESH)	A QUIC session to UDP port 443, like a browser	Gets through wherever the modern web does

OpenVPN over TCP 443 illustrates the problem well: borrowing the web's port is not enough if the conversation itself does not look like the web. Inspection appliances recognize its handshake and tell it apart from a genuine HTTPS session. An HTTP/3 VPN does not play that game: it speaks the same protocol as the web, not a protocol in disguise.

What VIGIL-MESH actually does

One outbound port, zero inbound ports

All VIGIL-MESH traffic leaves through UDP port 443, and no node opens an inbound port. Nothing to ask the IT department, nothing to forward on the router or the firewall: if the machine can watch a video, it can join the mesh.

End-to-end encrypted, even when relayed

Every session is an end-to-end QUIC/TLS 1.3 connection, authenticated with raw Ed25519 keys. When traffic transits through a relay (the vigie), the relay is structurally blind: it does not hold the keys and never sees the content — and you can host your own vigie.

Post-quantum, starting today

Key establishment is a hybrid X25519 + ML-KEM exchange: even if recorded today, the traffic resists future decryption by a quantum computer.

Seamless migration and 0-RTT resumption

QUIC can migrate a connection without breaking it: the session starts through the vigie and switches to the direct path as soon as one exists, without interruption. After a network change, 0-RTT resumption re-establishes the tunnel without a full new handshake.

1
The node goes out like a browserThe client establishes an encrypted QUIC session to UDP port 443 — the same move as a browser tab loading a page over HTTP/3.
2
The tunnel switches to directAs soon as a peer-to-peer path is established, the connection migrates from the relay to the direct path without interrupting the flows in progress.
3
The full network followsOn top of this transport also travel near-L2 broadcast and encrypted multicast (mDNS, SSDP, WS-Discovery): device discovery crosses the tunnel along with everything else.

This behavior is the same on every client — Windows, Linux, Android, Jetson, and all the way to the browser thanks to the WASM core: everywhere, the mesh presents itself to the local network as outbound web traffic.

The limits, honestly

An HTTP/3 VPN gets through wherever the modern web gets through — no more, no less. Two situations are worth knowing about before relying on it.

A network that blocks UDP 443 also blocks HTTP/3. Some very strict firewalls only allow TCP out. In that case QUIC cannot establish and the tunnel has to fall back — and the HTTP/3 camouflage advantage disappears with it.
QUIC can be slowed down by some carriers. A few networks, mobile ones in particular, throttle or degrade UDP/QUIC traffic as a whole. The tunnel remains indistinguishable, but it then receives the same treatment as the rest of HTTP/3 traffic.

Frequently asked questions

Is an HTTP/3 VPN detectable?

At the transport level, no: a VIGIL-MESH session is a QUIC connection encrypted with TLS 1.3 to UDP port 443, exactly like an HTTP/3 session to YouTube or Google. An inspection appliance cannot tell it apart from web traffic without blocking all of HTTP/3. The network does, however, still see the metadata: destination address, timing and traffic volumes.

What is the difference between an HTTP/3 VPN and a QUIC VPN?

It is the same transport seen from two angles. “QUIC VPN” describes the internal technology: multiplexing, connection migration, 0-RTT resumption, built-in TLS 1.3. “HTTP/3 VPN” describes the effect on the network side: since HTTP/3 runs over QUIC and UDP port 443, the tunnel is indistinguishable from a web session and crosses locked-down networks. VIGIL-MESH is both at once.

Do I need to open a port on my firewall?

No. Every VIGIL-MESH node only establishes outbound connections to UDP port 443 and opens no inbound port. There is nothing to forward on the router, nothing to ask the IT department: if the machine can browse the web, it can join the mesh.

Does it work on hotel networks and over 4G/5G?

Yes, as long as the network lets the modern web through: the tunnel uses UDP port 443 like any HTTP/3 session. The remaining cases are networks that block all outbound UDP — the tunnel then has to fall back — and some carriers that slow down QUIC traffic as a whole.

Does the HTTP/3 camouflage cost performance?

No, because it is not an added layer: VIGIL-MESH does not encrypt twice and does not wrap a VPN inside fake web traffic. The tunnel natively is a QUIC/TLS 1.3 session — the camouflage is a property of the transport itself, with seamless connection migration and 0-RTT resumption on top.