Qeli (Quick Easy Link IP) — a self-hosted VPN with its own L4 protocol and built-in obfuscation over TCP or UDP. It aims at resilience against passive / signature-based DPI while keeping the convenience of a classic full-tunnel TUN VPN, and ships with a web admin panel.
Документация на русском → docs/ru/index.md · Documentation in English → docs/eng/index.md
- A TUN VPN, with optional per-app routing: routing and DNS are handled at the OS level. The default covers every application; Windows, macOS and Android can also include or exclude selected applications without replacing qeli with an application-layer SOCKS/HTTP proxy. Full-tunnel and split-tunnel are both first-class.
- Wire modes:
plain·fake-tls(TLS 1.3 mimicry) ·obfs(ChaCha20 stream + WebSocket fronting) ·reality·reality-tls(REALITY TLS 1.3 + a genuine HTTP/2 carrier) · QUIC-shaped compatibility masking for UDP (not real QUIC/HTTP3). - Post-quantum handshake: hybrid X25519 + ML-KEM-768, ChaCha20-Poly1305 data plane.
- Web admin panel with
qeli://link / QR issuance, Argon2id login, native HTTPS. - Server: Linux (TUN/TAP). Clients: Linux CLI · Windows · macOS · Android · Keenetic / OpenWrt routers — plus iOS, which is feature-complete but has never been run on a device and ships nothing yet (details).
Qeli is built for networks where ordinary VPN protocols (WireGuard, OpenVPN, IKEv2) are
fingerprinted and blocked — Iran, China (the Great Firewall) and Russia (TSPU). The
reality-tls carries the private qeli stream through one long-lived genuine HTTP/2 request
inside a real TLS 1.3 exchange shaped from a configured third-party target; connections without
a valid qeli token are bridged to that target. This removes the former inner fake-TLS
choreography and reduces known passive and active-probing tells, but does not make the flow
universally indistinguishable. The shipped Reality profiles disable the periodic qeli heartbeat
and enable bounded randomized idle cover; the schema baseline for non-stealth profiles remains
unchanged. Statistical DPI resistance is a measured property, not a guarantee.
In spirit a self-hosted alternative to Xray / V2Ray / sing-box (REALITY/VLESS) setups, but with its own protocol, native GUI clients and a post-quantum handshake.
A repeatable two-VM lab run covered 34 VPN modes, with three passes for 25 masked modes. Across all 12 Qeli profiles, average four-stream TCP throughput was 1220 Mbit/s; the five fast TCP profiles averaged 1767 Mbit/s, while every Qeli profile ran with Recordizer in required mode. These figures compare throughput and processing cost on one controlled lab, not the probability of bypassing an external DPI system. See the full Qeli 0.8.0 cross-protocol report in English or the Russian version, plus the maintained English methodology/history.
One command on a clean Linux server (Debian/Ubuntu), as root:
curl -fsSLO https://raw.githubusercontent.com/litvinovtd/qeli/main/install-qeli-server.shReview it, then run bash install-qeli-server.sh. Download-then-run (rather than
curl … | bash) exists so the script can be read before it executes as root; the installer
itself verifies the .deb against its SHA256.
The script installs the .deb from Releases,
asks for the profile and the listen port (default 443), writes a config with full-tunnel
NAT, creates users and prints ready-to-use qeli:// links. Three profiles are offered:
| Profile | When to pick it |
|---|---|
reality-tls |
Installer default. REALITY TLS 1.3 + genuine HTTP/2 on TCP:443; unauthenticated probes are bridged to the configured target. |
fake-tls |
Cheaper on CPU; enough against passive/signature DPI. |
udp-quic |
A UDP path with QUIC-shaped datagrams — useful where TCP:443 is throttled, reset or otherwise degraded. |
For a non-interactive run set the answers up front:
QELI_PROFILE=reality-tls|fake-tls|udp-quic and/or QELI_PORT=<1-65535>.
Then install a client from Releases and paste or scan the link.
Prefer to do it step by step?
- Install the server and create the first user — Getting started (EN) · Установка с нуля (RU).
- Configure it — CONFIG (EN) · CONFIG (RU).
- Enable and verify dual-stack or IPv6-only operation — IPv6 guide (EN) · Руководство по IPv6 (RU).
- Issue a
qeli://link or QR from the web panel and import it into a client — PANEL (EN) · PANEL (RU).
Something went wrong? → Troubleshooting (EN) · Диагностика (RU).
| Path | What it is |
|---|---|
qeli/ |
Rust daemon: server, client CLI, protocol core, web panel |
qeli-win/, qeli-mac/ |
Desktop GUI clients (C#/.NET, shared core in qeli-shared/) — Windows · macOS |
qeli-android/ |
Android client (Kotlin) — README |
qeli-ios/ |
iOS client (Swift), feature-complete but untested on a device — README · MDM |
qeli-openwrt/ |
Router build (Keenetic / OpenWrt) — README |
docs/ |
Documentation — start at docs/ru/index.md / docs/eng/index.md |
release/ |
Packaging: Docker, deb, release artefacts |
site/ |
Project website |
Current beta release: qeli 0.8.1 — a consolidation of the 0.8 network architecture focused on UDP throughput, continuity across network changes, deployable IPv6 and safer operational state. See the bilingual release notes for the outcome, upgrade steps and artifacts.
Pre-1.0 / beta — the data plane is stable and covered by unit + end-to-end tests, but the
protocol may still change between minor versions. Release builds are published on the
GitHub Releases page and are not committed to git. The client native cores are the
exception: libqeli.so / qeli.dll / libqeli.dylib (plus third-party wintun.dll) are
committed under native-libs/ and mirrored into each client tree, so the platform CI jobs
need only their own toolchain. Their hashes are pinned in native-libs/SHA256SUMS and
checked by the native-libs CI gate. This is an explicit trade-off against reproducibility
— see THREAT-MODEL §4 ·
Модель угроз §4.
- Changes: CHANGELOG.md
- Security policy: SECURITY.md
- Contributing: CONTRIBUTING.md
- Licensing: LICENSE · LICENSING.md
This is a monorepo with per-directory licences: the core and server (qeli/) are
AGPL-3.0-only, the clients (qeli-android/, qeli-win/, qeli-mac/, qeli-ios/) are
MPL-2.0.
The full map, including the libqeli/AGPL note, is in LICENSING.md.
Contributions use a DCO sign-off, no CLA — see CONTRIBUTING.md.
Keywords: self-hosted VPN, anti-censorship VPN, censorship circumvention, anti-DPI, DPI bypass, deep packet inspection, REALITY, Reality TLS, TLS camouflage, SNI, active-probing resistant, traffic obfuscation, fake-TLS, obfs, QUIC VPN, post-quantum VPN, ML-KEM-768, X25519, ChaCha20-Poly1305, Rust VPN, Android VPN, iOS VPN, Windows VPN, macOS VPN, Keenetic, OpenWrt, WireGuard alternative, Xray / V2Ray / sing-box alternative, VPN for Iran, VPN for China / Great Firewall, VPN for Russia / TSPU.