Knowledge base · networking and Qeli
Networking basics and resources
A concise explanation of IP, subnets, routes, TUN, transports and cryptography, mapped to Qeli settings and backed by curated primary sources for further study.
What to read and in what order
| Level | Outcome | Resource |
|---|---|---|
| 1 · Start | Understand IP, masks, gateways, LANs and ports | Debian Administrator’s Handbook · networking (Russian edition) |
| 2 · Routes | Read a routing table and configure a return path | Debian Reference · network setup |
| 3 · System | Understand Linux TUN, forwarding and firewalls | Linux Kernel · TUN/TAP |
| 4 · Standards | Verify exact protocol and primitive behavior | RFC Editor · NIST |
Do not start with an RFC. An RFC is a precise implementation and verification specification, not the best first textbook. Begin with an introductory resource, then return to a standard for a specific question.
IP addresses, subnets and CIDR
An IPv4 address is a 32-bit address assigned to a network interface. 192.168.50.34/24 combines a host address and a network-prefix length: the first 24 bits identify the network and the remaining 8 identify an address inside it.
192.168.50.34 | The address of one interface |
|---|---|
/24 | Prefix length; equivalent to mask 255.255.255.0 |
192.168.50.0/24 | The entire subnet; in a conventional /24, host addresses are .1–.254 |
0.0.0.0/0 | Any IPv4 address; used by a default route |
RFC 1918 private ranges are not routed on the public Internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Qeli pools and home LANs must be distinct and non-overlapping.
An IP belongs to an interface, while a CIDR describes a network.
10.9.0.7 is one client address; 10.9.0.0/24 is the entire VPN pool. Confusing the two expands one route to hundreds of addresses.How a computer selects a route
For a destination address, the system finds the most specific match in its routing table. 192.168.50.0/24 is more specific than 0.0.0.0/0, so it wins. For equal prefix lengths, the metric and platform policy are considered.
| Field | Meaning |
|---|---|
| Destination | The IP or CIDR covered by the entry |
| Next hop | The router that receives the packet next |
| Interface | The physical NIC or virtual TUN used to send the packet |
metric | Priority among otherwise equivalent matching routes |
ip -br address
ip -4 route
ip route get 192.168.50.10
Communication is always bidirectional. A forward route delivers the request, but the reply needs a return path. For a LAN behind the Qeli server, the home router must know a route to
pool.cidr through the server's LAN address.Routing and NAT are not the same thing
| Routing | NAT | |
|---|---|---|
| What it does | Selects the next path and preserves addresses | Changes the source or destination address |
| Return path | Must be explicitly known by the network | Connection state hides the internal network |
| Where to use it | LANs, site-to-site and managed networks | Private-pool Internet egress or an external network you cannot change |
| Trade-off | All required routes must be configured | Source addresses and log transparency are lost |
Rule for Qeli documentation: when both networks can be managed, show routing and the return route. Use NAT for Internet egress or identify it as a forced fallback.
How networking concepts map to Qeli
| Key | Role |
|---|---|
tun.address | Address of the server side of the virtual network |
pool.cidr | VPN subnet and client address range |
route | A route the server pushes to a profile or user |
gateway | Client-local choice: split tunnel or a default route through Qeli |
include / exclude | Local networks placed inside or outside the tunnel |
client_subnet | A network located behind a specific client |
allowed_networks | ACL: destinations to which a user may send packets |
routing.forward_private | Allows the server to forward packets between TUN and private networks without NAT |
routing.nat.enabled | Source-address translation for Internet egress; not a replacement for routes |
TUN and a packet's path through Qeli
TUN gives a program Layer-3 IP packets; TAP gives it Layer-2 Ethernet frames. A normal Qeli tunnel uses TUN: the operating system routes a packet into the virtual interface, then Qeli reads, encrypts and sends it over TCP or UDP.
| 1 | An application creates a packet for a destination IP |
|---|---|
| 2 | The routing table selects the Qeli TUN |
| 3 | The Qeli client encrypts the packet and places it in a transport |
| 4 | The server decrypts the packet and routes it onward |
| 5 | The reply follows the same logical path in reverse |
A transport does not replace a route. TCP/UDP carries encrypted data between client and server, but the operating system's routing table still decides which packets enter the tunnel.
TCP, UDP, QUIC and ports
| Term | Meaning | In Qeli |
|---|---|---|
| TCP | A reliable, ordered byte stream with retransmission | reality-tls, fake-tls, obfs, plain |
| UDP | Independent datagrams with no delivery or ordering guarantee | udp-fake-tls, udp-quic, udp-obfs |
| Port | A service number within TCP or UDP; the protocol is part of the address | bind.port; TCP 443 and UDP 443 are different entry points |
| QUIC | A standardized secure transport over UDP | udp-quic uses QUIC-like traffic presentation; it is not a general-purpose HTTP/3 server |
MTU, MSS, PMTU and DNS
| MTU | The largest IP packet an interface can carry without fragmentation; a tunnel has less room because of outer headers |
|---|---|
| MSS | The maximum TCP payload in one segment; usually MTU minus IP and TCP headers |
| PMTU | The smallest usable MTU across the path; a wrong value often stalls large transfers |
| DNS | The system that maps names to IP addresses; routing acts on the resulting address |
Safe Qeli starting point: use
mtu = 0; for UDP keep mtu_probe = true. Server-side MSS clamping protects TCP from PMTU black holes. The Qeli DNS proxy resolves names but does not turn a domain name into a routing rule.Cryptographic systems used by Qeli
| Primitive | Purpose | Standard |
|---|---|---|
| X25519 | Classical elliptic-curve key agreement | RFC 7748 |
| ML-KEM-768 | Post-quantum key-encapsulation mechanism | NIST FIPS 203 |
| ChaCha20-Poly1305 | AEAD: packet encryption and integrity verification | RFC 8439 |
| Argon2id | Brute-force-resistant derivation and storage of password values | RFC 9106 |
| TLS 1.3 | The standard secure channel used by reality-tls mode | RFC 8446 |
A primitive's standard is not a product audit. RFCs and FIPS explain the algorithm; Qeli security also depends on implementation, key management, configuration, platform and threat model.
Commands to start with
ip -br address
ip -4 route
ip route get 1.1.1.1
ss -lntup
tracepath 1.1.1.1
Get-NetIPAddress -AddressFamily IPv4
Get-NetRoute -AddressFamily IPv4
Test-NetConnection vpn.example.com -Port 443
Read the result in order: interface address → matching route → next hop → port reachability → Qeli log. A
tcpdump capture is useful later, but it can contain sensitive addresses and unencrypted local packets.Textbooks, guides and standards
For a Qeli server, current Debian Reference and Debian Manpages take priority. The Russian Debian 11 Administrator’s Handbook is useful for fundamentals; general sources remain for protocol concepts and diagnostics on other client platforms.