FCFlenkchy/FCAE_VPN

A censorship circumvention client designed for heavily restricted networks. It automatically discovers reachable routes, establishes an encrypted tunnel, and exposes a local SOCKS5/HTTP proxy for your applications.

Built on top of Aether with native GUI frontends for Windows, Linux, macOS, and Android.

FCAE VPN connects to Cloudflare's WARP network — the same infrastructure behind Cloudflare's 1.1.1.1 DNS service. Here's the flow:

1. Account provisioning — On first launch, the client creates a WARP device identity and obtains dedicated IPv4/IPv6 addresses plus WireGuard keypairs from Cloudflare's registration API.
2. Endpoint scanning — The client probes a list of Cloudflare edge IPs across multiple ports to find a reachable gateway. Each candidate is validated with a real handshake (and optionally a full HTTP request in ironclad mode) to confirm the route actually passes traffic.
3. Tunnel establishment — Once a working edge is found, an encrypted tunnel is opened:
   • MASQUE — Traffic is encapsulated inside HTTP/3 (QUIC) or HTTP/2 (TLS) sessions using the CONNECT-IP method, making it look like normal HTTPS traffic to DPI systems.
   • WireGuard — A standard WireGuard UDP tunnel is established directly to the edge node.
   • WARP-in-WARP (gool) — Two nested WireGuard tunnels for an additional encryption layer.
   • WARP-in-MASQUE — A WireGuard tunnel carried inside a MASQUE (HTTP/3 or HTTP/2) session, so the outer traffic still looks like HTTPS.
4. Local proxy — The tunnel exposes a local SOCKS5 proxy (port 1819) and HTTP proxy (port 1820). Applications configured to use these proxies route their traffic through the encrypted tunnel to the internet via Cloudflare's network.

All traffic between the client and Cloudflare is encrypted. From Cloudflare onward, traffic exits to the public internet normally.

┌─────────────────────────────────────────────────────────────────────┐
│                        Your Application                             │
│              (browser, app, or system traffic via TUN)              │
└──────────────────────────────┬──────────────────────────────────────┘
                               │ SOCKS5 :1819 / HTTP :1820
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                       FCAE VPN Client                               │
│  ┌────────────┐  ┌────────────┐  ┌────────────┐  ┌──────────────┐   │
│  │  Netstack  │  │  Scanner   │  │  Obfuscat. │  │  Health Mon. │   │
│  │ (TCP/IP)   │  │ (endpoint  │  │  (aether-  │  │  (reconnect  │   │
│  │            │  │  discovery)│  │   noize)   │  │   on fail)   │   │
│  └──────┬─────┘  └────────────┘  └────────────┘  └──────────────┘   │
│         │                                                           │
│         ▼                                                           │
│  ┌──────────────────────────────────────────────────────────────┐   │
│  │                    Encrypted Tunnel                          │   │
│  │   ┌───────────┐   ┌──────────────┐   ┌──────────────────┐    │   │
│  │   │  MASQUE   │   │  WireGuard   │   │  WARP-in-WARP    │    │   │
│  │   │ HTTP/3/2  │   │   (UDP)      │   │  (WG inside WG)  │    │   │
│  │   └─────┬─────┘   └──────┬───────┘   └────────┬─────────┘    │   │
│  └─────────┼────────────────┼────────────────────┼──────────────┘   │
└────────────┼────────────────┼────────────────────┼──────────────────┘
             │                │                    │
             ▼                ▼                    ▼
┌─────────────────────────────────────────────────────────────────────┐
│                   Cloudflare WARP Edge                              │
│          (162.159.192.x — automatic discovery)                      │
└──────────────────────────────┬──────────────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                       Public Internet                               │
└─────────────────────────────────────────────────────────────────────┘

• Automatic endpoint discovery with end-to-end data-plane validation
• MASQUE (HTTP/3 QUIC / HTTP/2), WireGuard, WARP-in-WARP (gool) and WARP-in-MASQUE support
• Traffic obfuscation with configurable profiles
• Automatic reconnection with quick-reconnect
• Local SOCKS5 and HTTP proxies
• Native GUI on all platforms (ImGui + DirectX11 / OpenGL on desktop, Kotlin Material UI on Android)

You can define custom routing rules directly in the UI (Routes tab) without needing an external file. Rules use a simple format:

[direct]ip:190.9.2.4,192.33.45.6:400,example.com
[block]gazo.com,10.0.0.0/8,keyword:ads

Format:

• [direct] — traffic matching these rules bypasses the VPN (direct connection)
• [block] — traffic matching these rules is blocked entirely
• Entries are comma or newline separated
• Unprefixed entries default to [direct]

Supported rule types:

On Desktop: Open the Routes tab and paste rules into the "Inline Routing Rules" text box.

On Android: Scroll to "Inline routing rules" and enter your rules. Tap CONNECT to apply.

Rules set via inline input take priority and are merged with any rules file specified in the "Routing Rules File" field.

• Rust (latest stable)
• C/C++ compiler (GCC/Clang/MSVC)
• CMake >= 3.22
• Vulkan SDK or DirectX SDK (Windows)
• For Android: NDK, Android SDK, Kotlin

cargo build --manifest-path core/Cargo.toml -p aether-ffi --release

cmake -B build -DAETHER_TARGET=LINUX_X64
cmake --build build --config Release

Targets: LINUX_X64, WIN_X64, MACOS_ARM64, MACOS_X64, ANDROID_ARM64.

Open android/ in Android Studio and build. The Gradle config invokes CMake with ANDROID_ARM64 automatically.

• Aether — The core censorship circumvention engine by CluvexStudio. Provides MASQUE, WireGuard, WARP-in-WARP and WARP-in-MASQUE protocols.
• Dear ImGui — Immediate-mode GUI library Used for all native desktop rendering.
• hev-socks5-tunnel — C SOCKS5 tunnel engine, runs in-process.
• Psiphon — Psiphon tunnel core library.
• Quiche — Cloudflare's HTTP/3 and QUIC implementation. Used as the QUIC transport backend for MASQUE protocol support.
• Wintun — A TUN driver for Windows by WireGuard. Provides a high-performance network interface at Layer 3 for tunneling traffic.
• tun2socks — A Go library that transparently routes TUN device traffic through a SOCKS5 proxy. Powers the system-wide VPN TUN mode across all supported platforms (Linux, Windows, macOS, and Android).
• zeptun — A Zig TUN engine, statically linked and running in-process. Provides an alternative to tun2socks on Linux, macOS, and Android.

Join the official Telegram channel for release announcements, connectivity notices, and configuration tips — plus answers from the maintainers and other users:

• Release announcements — new versions, changelogs, and platform-specific notes.
• Connectivity notices — early warnings when endpoints are blocked or a route needs updating.
• Support and tips — setup help, troubleshooting, and answers from the community.

Bug reports and feature requests belong in GitHub Issues so they stay tracked and searchable — the channel is for everything else.

If you'd like to support the developer, you can send GRAM (The Open Network) to:

UQAz9mcfJ5qlba97SPbrCw-Yt8OhhT58yG9PzARyu1Muz0jV

Use The Open Network only. Donations are optional.

Interested in sponsoring FCAE? Read the Sponsor Policy for eligibility, content requirements, privacy rules, and contact information.

Contributions are welcome! Whether it's bug reports, feature requests, documentation improvements, or code contributions — feel free to open an issue or pull request.

For questions and general discussion, see the Community section.

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

Released under the LICENSE

The names FCAE and FCAE VPN are trademarks of this project. See TRADEMARK.