Documentation hub · 0.8.1 beta

Qeli documentation

Ready-made scenarios, installation, networking basics, roaming, IPv6, the recordizer, the key reference, routing and troubleshooting. The main guidance lives on this site; source links point to tag v0.8.1.

Searches the sections below by parameter, symptom and platform.
0.8.0

Install and update

Installer, .deb, source builds, Docker, clients, routers and safe server updates.

installupdateSHA256
recipes

Ready-made scenarios

Verified patterns for a full-tunnel VPS, home-network access, multiple profiles, a backup transport, split routing and unstable connections.

full-tunnelmulti-profilesite-to-site
learn

Networking basics and resources

IP, CIDR, routes, TUN, TCP/UDP, DNS, MTU and Qeli cryptography: concise explanations, practical commands, textbooks and primary sources.

IP/CIDRroutingRFC
reference

Configuration reference

Server, user and client keys: defaults, scope and how changes take effect.

[profile:*][auth][qeli]
wire modes

Transport modes

Matrix for plain, fake-tls, obfs, reality, reality-tls and udp-quic, required key pairs and shaping settings.

obf.modereality_proxyquic
0.8.0

Session roaming

How Qeli preserves a logical session across Wi-Fi, cellular, NAT or outer-IP changes; policies, limits and troubleshooting.

roaming=autohandoverPMTU
0.8.0

IPv6 and dual stack

Outer IPv4/IPv6 carriers, inner dual-stack TUN, ULA/GUA, NetworkPlan v2, NAT66, routing, DNS and leak controls.

tun.ip_modenat66ipv6=auto
0.8.0

PACKET_MUX recordizer

What the recordizer changes before encryption, how PACKET_MUX_V1 is negotiated, and which settings control batching, record size and reassembly.

preferbatchreassembly
deep dive

Routing and push

Full and split tunnel, server push, IP/CIDR lists from route_file, ACLs, networks behind clients, site-to-site and DNS.

routeroute_fileclient_subnet
Linux

Exit node

Send client internet traffic through a separate Linux node: roles, configuration, iptables, verification and cleanup.

exit_nodeclient_to_clientiptables
desktop/mobile

Per-app routing

apps_mode on Windows, macOS and Android: identifiers, full/split tunnel interaction and platform limits.

apps_modeincludeexclude
integration

External TUN and dev_attach

Attach the Linux CLI to an existing TUN/TAP, with the external-owner contract, QELI_TUNIP_FILE and Keenetic OpkgTun.

dev_attachQELI_TUNIP_FILEOpkgTun
checklists

Troubleshooting

Symptom-based checks for the service, handshake, routes, NAT, MTU, DNS, web panel and clients.

journalctlQELI_TRACE403
access

Users and access

Create and reissue links, groups, access profiles, static IPs, sessions, bandwidth and quotas.

share-linkmax_sessionsprofiles
admin

Web panel

Loopback, public HTTPS and reverse proxy, login protection, backup and restore, and server management.

allowed_ipscsrfbase_path
platforms

Clients and platforms

0.8.1 builds, file verification, and notes for Linux, Windows, macOS, Android and routers.

WindowsAndroidOpenWrt
security

Security

Identity pinning, H-1, REALITY, secret storage, security boundaries and the threat model.

keyH-1password_enc
Before you start

What knowledge level Qeli requires

Installing a personal VPN only requires confident computer use and the ability to follow instructions. Complex routing and non-standard topologies require system administration experience.

Basic level confident computer user

Install and use Qeli

Suitable for your own VPS, a regular full-tunnel VPN and personal devices. You do not need to understand the protocol internals.

  • VPS: understand that it is a remote server, rent one and obtain its IP address and access credentials.
  • Linux: connect over SSH, run terminal commands, and copy and paste text.
  • Instructions: run the installation command and configure a client step by step using a link or configuration.
Start installation → Choose a ready-made scenario →
Advanced level system administrator / DevOps

Flexible configuration and complex topologies

Needed for exit nodes, multiple networks or offices, external TUN, complex routing and independent troubleshooting.

  • Networking: IP, CIDR, forward and return routes, DNS, MTU, firewalls and nftables.
  • Configuration: Qeli INI files, key scope and how changes take effect.
  • Transports: differences between plain, fake-tls, obfs, reality-tls and udp-quic.
  • Linux: systemd, logs, network interfaces, Docker and filtering rules.
Study networking basics → Open the key reference → Compare transports →
Primary sources

Documentation and configs on GitHub

Links are pinned to tag v0.8.1 so examples match the released beta and do not drift with main. The site provides operator guidance; GitHub provides full implementation detail.

Server and protocol

Full CONFIG.md → GETTING-STARTED.md → 10 ready-made profiles → Threat model →

Operations

Error catalogue → Update and rollback → Full panel guide → Security policy →

Platforms

Docker → Keenetic → OpenWrt → Conformance suites →
Important: some release documents contain historical examples for older versions. Use the corrected site instructions for install commands, passwords and the web panel; use the GitHub links as an in-depth implementation reference.