Documentation
QUIC VPN: the next-generation transport
VIGIL-MESH does not lay its tunnels on top of a traditional VPN protocol: every session between two machines IS a QUIC connection (TLS 1.3), the transport that powers HTTP/3. This yields a single UDP port 443 that gets through almost everywhere, a session that survives network changes, 0-RTT resumption, and a single layer of end-to-end encryption — reliable streams and real-time datagrams in the same connection.
What is a QUIC VPN?
QUIC is a modern transport (RFC 9000) that runs over UDP and underpins HTTP/3. It builds TLS 1.3 encryption into the transport itself, instead of stacking it on top. VIGIL-MESH uses it as the substrate of its mesh network: every session between two machines is a QUIC connection authenticated with raw public keys (RFC 7250, Ed25519 identities).
A QUIC VPN is therefore not a tunnel inside a tunnel: the encrypted QUIC packet is the universal unit, and the paths (direct, relay, peer chain) are merely interchangeable carriers. See also how the mesh network works at /en/docs/reseau-mesh.
Why QUIC for a VPN
- A single UDP port 443, like HTTPS and HTTP/3: the traffic looks like web traffic and gets through most firewalls and middleboxes.
- TLS 1.3 built into the transport: no separate encryption layer to negotiate or maintain.
- Connection migration: the session is identified independently of the IP address, so it survives a change of network, address or path — without re-establishing the tunnel.
- 0-RTT resumption: an already-known session can send data again from the very first packet.
- Reliable streams AND unreliable datagrams in the same connection: service streams travel in order, real-time traffic goes over datagrams with no head-of-line blocking.
- Hybrid post-quantum key exchange (X25519 + ML-KEM768) on every session — see /en/docs/vpn-post-quantique.
QUIC versus WireGuard, OpenVPN and IPsec
WireGuard, OpenVPN and IPsec are excellent protocols, proven and widely deployed. VIGIL-MESH simply makes a different transport choice. The table below compares facts, without value judgments.
| Criterion | VIGIL-MESH (QUIC) | WireGuard | OpenVPN | IPsec |
|---|---|---|---|---|
| Transport | QUIC / UDP (TLS 1.3) | UDP (Noise) | UDP or TCP (TLS) | UDP / ESP |
| Default port | 443 | 51820 (configurable) | 1194 (configurable) | 500 / 4500 |
| Looks like web traffic | Yes (like HTTP/3) | No | Partially (TLS) | No |
| Session migration (IP change) | Yes, at the connection level | Endpoint roaming | Reconnection | Reconnection / MOBIKE |
| Reliable streams + real-time datagrams | Yes, in one connection | Datagrams (IP layer) | Depending on the mode | Datagrams (IP layer) |
| Built-in post-quantum | Yes, hybrid by default | Not native | Not native | Implementation-dependent |
For a product comparison (Tailscale, ZeroTier, NetBird), see /en/docs/comparatif.
A single layer of encryption, end to end
Because the QUIC session is encrypted end to end between the two named machines, the infrastructure merely transports packets it cannot read. There is no double encryption on the relayed path: the blind relay (the “Vigie”) carries the very same QUIC packet, without the session key. Details at /en/docs/securite.