FCAE VPN

Break through censorship with automatic endpoint discovery, encrypted MASQUE / WireGuard tunneling, and local SOCKS5 & HTTP proxy. Built for heavily restricted networks.

Windows Linux macOS Android MIT License

⬇️ Download 📁 Source Code

🔧 How It Works

Connects to Cloudflare's WARP network — the infrastructure behind 1.1.1.1

Account Provisioning

Creates WARP device identity & obtains dedicated IPv4/IPv6 + WireGuard keypairs.

Endpoint Scanning

Probes Cloudflare edge IPs across multiple ports to find reachable gateways.

Tunnel Establishment

Encrypted MASQUE, WireGuard, or WARP-in-WARP tunnels to the best edge.

Local Proxy

SOCKS5 (:1819) & HTTP (:1820) proxies for all your apps.

🏗️ Architecture

From your app to the public internet

Your Device

Any Application

Browser, CLI, or system-wide TUN

↓

Local Proxies

SOCKS5 :1819 · HTTP :1820

Apps connect through FCAE VPN locally

↓

FCAE VPN Client

Core Engine

Netstack

TCP/IP Stack

Scanner

Endpoint Discovery

Obfuscation

aether-noize

Health

Auto-Reconnect

↓

Encrypted Tunnels

Best Available Transport

MASQUE HTTP/3

QUIC

MASQUE HTTP/2

TLS

WireGuard

UDP

WARP-in-WARP

Double WG

↓

Cloudflare WARP Edge

162.159.192.x

Automatic endpoint discovery

↓

Freedom

🌐 Public Internet

📊 Protocol Comparison

Choose the right tunnel depending on network restrictions

Protocol	Transport	DPI Resistance	Speed	Use Case
MASQUE (HTTP/3)	QUIC over UDP	Best	Fast	Default, most resistant
MASQUE (HTTP/2)	TLS over TCP	Best	Fast	Fallback when QUIC blocked
WireGuard	UDP	Moderate	Fastest	When UDP is allowed
WARP-in-WARP	Nested UDP	High	Moderate	Extra obfuscation layer

⬇️ Get FCAE VPN

Download releases or browse the source code

📦

Download

Get the latest builds for Windows, Linux, macOS & Android.

→

💻

Source Code

Browse the code, open issues, or fork on GitHub.

→

✨ Features

Built for restricted networks

🔍

Automatic endpoint discovery with end-to-end data-plane validation.

🔐

MASQUE (HTTP/3 QUIC / HTTP/2), WireGuard, and WARP-in-WARP support.

🎭

Traffic obfuscation with configurable profiles (aether-noize).

🔄

Automatic reconnection with quick-reconnect on failure.

🔌

Local SOCKS5 and HTTP proxies for any application.

🖥️

Native GUI on all platforms (ImGui + DX11 / OpenGL / Material UI).

💻 Supported Platforms

Native builds for major desktop and mobile systems

🪟

Windows

DirectX 11 + ImGui

🐧

Linux

GLFW + OpenGL + ImGui

🍎

macOS

GLFW + OpenGL + ImGui

📱

Android

Kotlin Material UI

🔨 Building from Source

For developers who want to compile FCAE VPN themselves

Requirements

Rust (latest stable)
C/C++ compiler (GCC/Clang/MSVC)
CMake 3.22+
Vulkan SDK or DirectX SDK (Windows)
For Android: NDK, Android SDK, Kotlin

Rust engine

cargo build --manifest-path core/Cargo.toml -p aether-ffi --release

Native GUI

cmake -B build -DAETHER_TARGET=LINUX_X64
cmake --build build --config Release

Targets: LINUX_X64, WIN_X64, MACOS_ARM64, MACOS_X64, ANDROID_ARM64.

🤝 Want to Contribute?

Open Source & Open to Contributions!

FCAE VPN is MIT licensed

FCAE VPN welcomes pull requests, bug reports, and feature ideas. Join us in building a better censorship circumvention tool.

⭐ Star & Fork on GitHub

👥 Contributors

People who built FCAE VPN

@Plangto 443 commits

@Bat-Script 1 commit

🙏 Credits

Standing on the shoulders of open-source giants

Aether

by CluvexStudio

The core censorship circumvention engine. Provides MASQUE, WireGuard, and WARP-in-WARP protocols.

Dear ImGui

by ocornut

Immediate-mode GUI library used for all native desktop rendering.

Quiche

by Cloudflare

Cloudflare HTTP/3 and QUIC implementation. Used as the QUIC transport backend.

Wintun

by WireGuard

A TUN driver for Windows. High-performance Layer 3 network interface for tunneling.

tun2socks

by xjasonlyu

Go library that transparently routes TUN device traffic through SOCKS5 proxy. Powers TUN mode.