rVPN: open-source Rust protocol disguises VPN traffic as ordinary HTTPS

A VPN designed to look like a website

The rVPN project, which reached Hacker News's front page on November 10, is an open-source VPN protocol built around one idea: make VPN traffic indistinguishable from ordinary encrypted web browsing. According to the project's website, rVPN carries user traffic over WebSocket connections protected by TLS on port 443. A censor watching the wire sees what appears to be a normal visit to a website, with no distinctive handshake or protocol fingerprint to flag, which the project says allows it to keep working on networks where VPN protocols are detected and blocked.

Answering active probes

Blending in passively is not enough on its own, because filtering systems can interrogate a suspected proxy server directly. rVPN's answer, per the project site, is decoy behaviour: when an active probe reaches a node, the node responds the way an ordinary website would, serving a real decoy page and returning a standard 200 OK. The prober receives no confirmation that a VPN is present and no clear signal to act on.

Encryption and transport

For session security the protocol uses well-known building blocks from the Signal ecosystem: an X3DH handshake establishes keys, and a Double Ratchet rotates them for every message. That provides forward secrecy in both directions, so a key compromised at one point in time cannot decrypt traffic from before or after.

The transport design is unusual too. The project site argues that opening one TLS connection per flow forces busy clients to hold hundreds of parallel sessions to a single server, which is both slow to establish and a traffic shape worth flagging. rVPN instead multiplexes all flows over a small pool of long-lived connections, defaulting to a pool of four, with credit-based flow control so bulk transfers cannot starve interactive ones and a 256 KiB flow window. Dropped connections resume in a single round trip using TLS 1.3 session tickets and a pre-shared key.

Verifiable by design

rVPN is free software under the AGPLv3, its core is written in Rust for memory safety, and the project leans heavily on auditability rather than trust. The source code is published on GitHub, and releases are intended to be reproducible: the site invites users to clone the repository, check out the current release tag (v1.4.0 at the time of writing), build the binary themselves and confirm that its checksum and signature match the published release. Development is funded by PDG Global Limited, with sales of the iOS and Android apps plus donations contributing to costs; the project states the code will remain open.

Availability

Native apps cover iOS, Android, macOS, Linux and FreeBSD, alongside a command-line client for servers, and any user can run their own node. On Unix-like systems an installation script auto-detects the operating system and verifies a checksum before installing.

Why it matters

Networks that block VPNs increasingly rely on both passive fingerprinting and active probing, and most commercial VPNs advertising similar obfuscation or stealth modes are closed-source, so users have to take those claims on faith. rVPN's pitch is that every property it advertises — the encryption design, the decoy behaviour, the memory safety — maps to public code that anyone can read, build and run. That makes it relevant to journalists, dissidents and anyone on a restrictive network who needs censorship resistance they can verify rather than trust. The obvious caveat is that all of the technical claims above originate from the project itself: the site describes reproducible builds but does not point to an independent security audit, and stealth transports are typically judged in an ongoing cat-and-mouse game with censors rather than settled once and for all.