Qeli is a full VPN for your own server: all device traffic goes through an encrypted channel via your own server, with no middlemen and no subscriptions. Modern cryptography and metadata privacy.
The released 0.8.1 beta consolidates the 0.8 network architecture: it removes a measured UDP bottleneck, improves mobile recovery, adds a safe NDP proxy and makes desktop routing stricter.
Linux and Android receive and send ready datagrams in batches of up to 32. A same-window A/B on the two-core lab reached 694.7 Mbit/s upload and 697.5 Mbit/s download; this is a specific test result, not a promise for every device.
Android and iOS do not spend reconnect backoff without Wi-Fi or cellular and resume as soon as the carrier returns. Android preserves the fail-closed TUN for an unchanged plan, while multipath no longer remaps healthy flows.
In routed mode Qeli can answer upstream Neighbor Solicitations only for IPv6 addresses and subnets owned by live sessions. It is off by default; auto/required are only for provider on-link layouts.
Windows/macOS accept repeatable CIDR and OpenVPN route lines with a 250,000-route bound and stop on errors. Per-app, macOS cleanup, firewall transactions and backup validation are also hardened.
Status: 0.8.1 was released as a beta on 10 September 2026. The set contains 17 payload files plus SHA256SUMS for Linux, Windows, macOS, Android, OpenWrt and Keenetic. It passed 1,041 Rust tests and 20 mandatory automated IPv6/roaming cases. Qeli still has no stable release; the first stable line is planned as 1.0.
An ordinary commercial VPN routes your traffic through someone else's servers. Qeli is built for those who want to keep privacy and the whole infrastructure under their own control — on their own server.
Off-the-shelf commercial VPNs route all your traffic through someone else's servers — you don't know who owns the infrastructure, whether logs are kept, or who they're shared with. Your credentials, history and metadata end up with a third-party service.
Qeli runs on your own server: keys, traffic and logs stay with you, with no middlemen and no subscriptions. Modern cryptography (X25519, ChaCha20-Poly1305), metadata privacy, and in reality-tls mode — genuine TLS 1.3.
VLESS, V2Ray, Shadowsocks and most popular network tunnels are proxies: they only route traffic from apps that are specially configured. Qeli creates a real network tunnel and protects the entire device.
First, the architecture: what Qeli is built from and why it's self-contained. Then, what it does for your security and connection stability.
Several transport modes are built into the protocol itself, no third-party tools needed. The flagship one is reality-tls (real TLS 1.3); the rest switch with a single setting.
TCP, UDP and REALITY at once in a single service — each with its own key, its own users and separate access.
Tunnel keys are derived from a hybrid of X25519 + ML-KEM-768 (post-quantum) — the key exchange is designed to resist a future quantum computer under current cryptographic assumptions. Used in every mode except plain. ChaCha20-Poly1305 encryption, no exposed counter in packets.
Full control from the browser: all profile settings, users, routes and server-key rotation — no SSH or file editing. Built-in HTTPS and an IP allowlist let you expose the panel safely without nginx; connection links and QR codes, a Russian/English interface.
A real L3 VPN: reach the LAN behind the server and join whole subnets and sites into a single fabric. A proxy can't do this — it only forwards individual apps' traffic.
Network-joining scenarios →The mode determines the traffic shape and is configured by a matching pair of profile and client settings. The installer deploys reality-tls by default; the built-in config default is fake-tls. Other modes suit trusted networks, compatibility and fallback channels.
Qeli's flagship mode: the client sends a browser TLS 1.3 handshake (JA4 fingerprint t13d1516h2_8daaf6152771), and the server terminates real TLS 1.3 (realtls), carrying the tunnel inside. On the wire this is genuine TLS 1.3, not a mimicry; inside it carries the qeli tunnel, while trust rests on the pinned server key. It works on Linux, Android, iOS, Windows and macOS through the shared realtls engine.
ClientHello (Chrome JA4) → TLS 1.3 (realtls)
encrypted flight → tunnel inside real TLS
Qeli does not have one speed for every use case: fast TCP, more processing-intensive TCP and native UDP profiles solve different problems. The practical reference and the composition of the overall result are therefore shown separately.
Use this figure when assessing the throughput of Qeli's fast TCP line. It combines upload and download over both IPv4 and IPv6.
They answer different questions. 1.77 Gbps describes only the fast TCP group, while 1.22 Gbps is the mean across all twelve heterogeneous profiles.
(5 × 1767 + 3 × 1274 + 4 × 496) ÷ 12
The aggregate 1220 Mbps describes the complete line, but it is not the expected speed of any one selected profile.
This is lab throughput, not a speed promise for every VPS. A real connection depends on routing, CPU, provider, loss and the selected transport.
All 12 profiles and methodology →Do not choose a transport mode by the longest benchmark bar alone. Throughput, masking level and the behavior of the actual network all matter.
Compare profiles within the same class. TCP and UDP are measured differently and target different network conditions.
Unmasked modes reveal the testbed ceiling but are not direct competitors to modes that reshape the connection's external profile.
Loss, mobile NAT, UDP availability and Wi-Fi/cellular changes can matter more than peak laboratory throughput.
The full technical breakdown: the handshake, all six transport modes, cryptography, measured benchmarks and the comparison matrix.
Every client is wire-compatible with the server and sends the same real TLS 1.3 (reality-tls) through the shared realtls engine. A link or QR code carries the connection parameters (server, mode, key) in one tap; local settings — routes, DNS, MTU, kill-switch — are configured in the client itself.
Rust
C# · Avalonia · .NET 10
C# · .NET
Kotlin
Swift
Rust · KeeneticOS
Rust · procd / UCI / LuCI
All the code is open — the protocol, server and clients for Linux, Windows, macOS, Android, iOS and routers. Study it, build it yourself, report issues and suggest improvements.
A full self-host VPN with its own network protocol and private transport — HTTPS, WebSocket, QUIC-shaped UDP and reality-tls.
$ git clone https://github.com/litvinovtd/qeli.git