FCAE VPN

Break through censorship with automatic endpoint discovery, encrypted MASQUE / WireGuard tunneling, and local SOCKS5 & HTTP proxy. Built for heavily restricted networks.

v1.0.8.8 Windows · Linux · macOS · Android MIT License
⬇️ Download 📁 Source Code

🔧 How It Works

Connects to Cloudflare's WARP network — the infrastructure behind 1.1.1.1

1

Account Provisioning

Creates WARP device identity & obtains dedicated IPv4/IPv6 + WireGuard keypairs

2

Endpoint Scanning

Probes Cloudflare edge IPs across multiple ports to find reachable gateways

3

Tunnel Establishment

Encrypted MASQUE, WireGuard, or WARP-in-WARP tunnels to the best edge

4

Local Proxy

SOCKS5 (:1819) & HTTP (:1820) proxies for all your apps

🏗️ Architecture

FCAE VPN Architecture 
  YOUR APPLICATION
       |  SOCKS5 :1819 / HTTP :1820
       v
  ┌────────────────────────────────────┐
  │        FCAE VPN CLIENT            │
  │  · Netstack (TCP/IP)              │
  │  · Scanner (endpoint discovery)   │
  │  · Obfuscation (aether-noize)     │
  │  · Health Monitor (auto-reconnect)│
  └────────────┬───────────────────────┘
               │
               v
  ┌────────────────────────────────────┐
  │       ENCRYPTED TUNNEL            │
  │  · MASQUE HTTP/3 (QUIC)           │
  │  · MASQUE HTTP/2 (TLS)            │
  │  · WireGuard (UDP)                │
  │  · WARP-in-WARP (nested WG)       │
  └────────────┬───────────────────────┘
               │
               v
  ┌────────────────────────────────────┐
  │    CLOUDFLARE WARP EDGE           │
  │    (162.159.192.x auto-discovery)  │
  └────────────┬───────────────────────┘
               │
               v
         PUBLIC INTERNET

📊 Protocol Comparison

ProtocolTransportDPI ResistanceSpeedUse Case
MASQUE (HTTP/3)QUIC over UDPBestFastDefault, most resistant
MASQUE (HTTP/2)TLS over TCPBestFastFallback when QUIC blocked
WireGuardUDPModerateFastestWhen UDP is allowed
WARP-in-WARPNested UDPHighModerateExtra obfuscation layer

✨ Features

🔍Automatic endpoint discovery with end-to-end data-plane validation
🔐MASQUE (HTTP/3 QUIC / HTTP/2), WireGuard, and WARP-in-WARP support
🎭Traffic obfuscation with configurable profiles (aether-noize)
🔄Automatic reconnection with quick-reconnect on failure
🔌Local SOCKS5 and HTTP proxies for any application
🖥️Native GUI on all platforms (ImGui + DX11 / OpenGL / Material UI)

💻 Supported Platforms

🪟
Windows
DirectX 11 + ImGui
🐧
Linux
GLFW + OpenGL + ImGui
🍎
macOS
GLFW + OpenGL + ImGui
📱
Android
Kotlin Material UI

🔨 Building from Source

Requirements

Rust engine

cargo build --manifest-path core/Cargo.toml -p aether-ffi --release

Native GUI

cmake -B build -DAETHER_TARGET=LINUX_X64
cmake --build build --config Release

Targets: LINUX_X64, WIN_X64, MACOS_ARM64, MACOS_X64, ANDROID_ARM64.

🤝 Want to Contribute?

Open Source & Open to Contributions!

FCAE VPN is MIT licensed and welcomes pull requests, bug reports, and feature ideas. Join us in building a better censorship circumvention tool.

⭐ Star & Fork on GitHub

👥 Contributors

People who built FCAE VPN

Plangto@Plangto348 commits Bat-Script@Bat-Script1 commit

🙏 Credits

Standing on the shoulders of open-source giants

Aether

by CluvexStudio

The core censorship circumvention engine. Provides MASQUE, WireGuard, and WARP-in-WARP protocols.

Dear ImGui

by ocornut

Immediate-mode GUI library used for all native desktop rendering.

Quiche

by Cloudflare

Cloudflare HTTP/3 and QUIC implementation. Used as the QUIC transport backend.

Wintun

by WireGuard

A TUN driver for Windows. High-performance Layer 3 network interface for tunneling.

tun2socks

by xjasonlyu

Go library that transparently routes TUN device traffic through SOCKS5 proxy. Powers TUN mode.

FCAE VPN

by Plangto (FCFlenkchy)

The FCAE VPN client itself — bringing all components together.