rVPN Introduces Rust-Based Stealth VPN Protocol Using Pooled Multiplexing

rVPN is a new open-source protocol that aims to provide 'stealth' connectivity by ensuring that VPN traffic is indistinguishable from ordinary HTTPS web traffic on port 443. Developed by PDG Global Limited, the protocol is designed to function in environments where traditional VPN protocols are actively blocked or throttled by network censors.

This image illustrates the client-side application for the rVPN protocol on mobile devices.

Stealth via HTTPS Mimicry

The primary mechanism for rVPN's stealth is its transport layer, which uses WebSocket over TLS. To a censor watching the wire, the traffic appears as standard application-layer data on port 443. Unlike many VPNs that have unique handshakes, rVPN is designed to lack a blockable fingerprint.

To further evade detection, rVPN nodes are configured to be active-probe resistant. If a censor probes the server's endpoint, the node responds like an ordinary website with a 200 OK status and a realistic decoy login page, rather than revealing its identity as a VPN gateway.

“rVPN is an open-source protocol that carries your traffic safely across the internet, indistinguishable from ordinary HTTPS, so it works even where VPNs are blocked.”

— rVPN · Encrypted stealth VPN over WebSocket/TLS

Pooled Multiplexing Architecture

A common way to identify VPN usage is by observing the 'shape' of the traffic. Standard connections often establish a new TCP and TLS handshake for every individual flow, creating a signature of hundreds of parallel sessions under heavy load. rVPN addresses this through pooled multiplexing.

In this architecture, many flows share a small pool of long-lived connections. This keeps the wire signature small and ordinary regardless of how busy the client is. The system uses credit-based flow control to ensure that bulk data transfers do not starve interactive sessions, and it supports TLS 1.3 ticket resumption for fast reconnects.

Security and Implementation

The rVPN core is written in Rust to leverage its memory-safety guarantees, which the developers claim helps eliminate entire classes of common vulnerabilities. The protocol incorporates the Double Ratchet algorithm—originally used in the Signal protocol—to rekey every message, ensuring that a stolen key cannot unlock past or future communications.

For initial handshakes, rVPN uses X3DH (Extended Triple Diffie-Hellman) to establish secure keys without requiring passwords or accounts. The project is released under the AGPLv3 license, and the developers provide reproducible builds to allow users to verify that the shipped binaries match the open-source code.

This visual confirms the licensing model mentioned in the security and implementation section.