WireGuard is excellent — until your ISP throttles or blocks UDP. Konduit is designed for TCP from the ground up: fully userspace, no root, no kernel modules. It gets out of your way.
Tunneling UDP into TCP creates head-of-line blocking — the failure mode that makes "TCP mode" miserable on every other VPN. Konduit has no UDP to wrap, so it simply doesn't have that problem.
Nothing is being tunneled through a second transport. One reliable stream, behaving the way TCP is meant to.
Corporate firewalls, hotel Wi-Fi, mobile carriers — environments that throttle or drop UDP leave Konduit untouched.
The clean mental model you expect from a modern VPN, without the UDP dependency or OpenVPN's configuration sprawl.
Every layer was chosen for the same goal: a VPN that behaves on hostile networks without asking for privileges it doesn't need.
Designed for TCP, not retrofitted. No UDP at any layer of the stack — by design, not by fallback.
Administrators enforce routing policy server-side. Clients receive routes — they cannot bypass them.
No kernel modules, no root. The TUN
device runs entirely in userspace on every platform.
Update server configuration without dropping a single connection. Policy changes apply live.
Scan once, connect instantly. Device onboarding without copying keys by hand.
X25519 key exchange and a ChaCha20-Poly1305 data channel. Standard, audited primitives — no homegrown crypto.
Reach your server through your own SOCKS5 proxy, or expose a local SOCKS5 listener after connecting — bring your own tunneling tool if you need one.
The entire engine is written in Rust. Whole classes of memory-safety vulnerabilities are gone by construction.
One Rust engine, bridged to a Flutter UI. Linux ships today; macOS, Android and iOS share the same core.
| Layer | Technology |
|---|---|
| UI | Flutter / Dart |
| Core engine | Rust (Tokio async) |
| FFI bridge | flutter_rust_bridge |
| Cryptography | ring / rustls |
| TUN device | tun crate (userspace) |
Keys never touch disk in plaintext. Private keys live in the OS secure enclave on every platform — iOS Keychain, macOS Keychain, Android Keystore.
Konduit is a VPN for reaching your own resources — it doesn't try to disguise its traffic or fight active censorship. If you need to get through a hostile network, chain konduit with a tool built for that (SSH SOCKS, Xray, sing-box) over standard SOCKS5, in either direction.
use_proxy)Reach your konduit server through a
SOCKS5 proxy you already trust, instead
of dialing it directly.
listen_socks)Once connected, expose a local SOCKS5
proxy so other apps can route through
the tunnel too.
Grab konduit-cli from the
Releases page — a single static binary.
One chmod and you're ready. No
installer, no daemon to register.
Point it at your server with a peer ID and pre-shared key. Routes arrive from the server.
The client library is published for transparency and security review. The server and management UI stay closed.
The konduit-platform crate is published here for transparency and security audit. It contains the cryptographic primitives, connection statistics, and platform networking layer (TUN device, DNS, routes) — everything an auditor needs to verify what runs on your machine.
The VPN server, GUI client app, and management UI are proprietary. Source review under NDA is available for enterprise partners.
Available now for Linux, Windows, and Android. macOS and iOS are coming soon.
Beta · Linux & Windows binaries on the Releases page · Android on Google Play