Transport modes and settings

Six modes without mixing up the terms

The carrier is configured separately from the wire mode. That is why fake-tls and obfs work over both TCP and UDP, while reality is a fake-tls profile with client recognition and forwarding for foreign connections.

New Reality/H2 carrier and PACKET_MUX_V1

In 0.8.0 the mode name stays the same while its internal carrier changes: after REALITY TLS 1.3, reality-tls opens a genuine HTTP/2 stream. A shared recordizer is negotiated separately after AUTH and can run over any TCP/UDP carrier.

obf.mode = reality-tls
obf.recordizer.policy = prefer

Settings the server cannot push yet

Wire settings are needed for the handshake itself, so the client must know them in advance from qeli:// or client.conf. Server push arrives only after successful AUTH.

Ready server and client settings

Only transport keys are shown. TUN addresses, pool, users, NAT and DNS are added as usual and do not depend on the selected mode. Replace the example short IDs, server key and PSK with your own values.

bind.transport = tcp
obf.mode = reality-tls
obf.tls.server_name = www.microsoft.com
obf.tls.reality_proxy.enabled = true
obf.tls.reality_proxy.target = www.microsoft.com
obf.tls.reality_proxy.target_port = 443
obf.tls.reality_proxy.real_tls = true
obf.tls.reality_proxy.short_ids = 0123456789abcdef
obf.padding.enabled = false

proto = tcp
mode = reality-tls
key = <64-hex-server-key>
sni = www.microsoft.com
reality_sid = 0123456789abcdef

[profile:reality]
bind.transport = tcp
obf.mode = fake-tls
obf.tls.server_name = www.microsoft.com
obf.tls.reality_proxy.enabled = true
obf.tls.reality_proxy.target = www.microsoft.com
obf.tls.reality_proxy.real_tls = false
obf.tls.reality_proxy.short_ids = fedcba9876543210

[qeli]
proto = tcp
mode = fake-tls
key = <64-hex-server-key>
sni = www.microsoft.com
reality_sid = fedcba9876543210

[profile:obfs]
bind.transport = tcp
obf.mode = obfs
obf.obfs_key = <strong-shared-secret>
obf.obfs_fronting = websocket

[qeli]
proto = tcp
mode = obfs
obfs_key = <strong-shared-secret>
front = websocket

[profile:udp-quic]
bind.transport = udp
obf.mode = fake-tls
obf.quic.enabled = true

[qeli]
mode = udp-quic
mtu = 0

Client recognition and genuine TLS

REALITY settings belong to a profile. An unrecognised ClientHello is forwarded to the target; a recognised client gets either the regular Qeli data plane or genuine TLS 1.3 when real_tls=true.

Obfs, QUIC-shaped framing and AWG junk

Padding, fragmentation, heartbeat and multipath

These features sit on top of the base mode. They change record sizes and timing or the number of streams, but do not replace a correct transport/mode pair.

Client transport keys

Validate the config pair

Validate the server and client INI files separately, then compare the generated link with the selected profile.

$ sudo qeli check-config --config /etc/qeli/server.conf
$ qeli check-config --client --config /etc/qeli/client.conf
$ sudo qeli show-identity --config /etc/qeli/server.conf
$ sudo qeli add-client <user> --password '<strong-password>' --link --host vpn.example.com:443 \
    --link-profile <profile> --config /etc/qeli/server.conf

Full stage-by-stage troubleshooting →

Complete settings and ready-made profiles

Links are pinned to tag v0.8.1. The multiprofile example is the easiest practical starting point, while CONFIG.md and the dedicated recordizer page contain constraints and defaults.