Skip to content
SkiMasque
Sign InGet Started

Real MASQUE underneath.

SkiMasque is built around the IETF MASQUE architecture rather than presenting a proprietary tunnel abstraction as the product.

Protocol stack

  1. Application
  2. MASQUECONNECT-UDP
  3. HTTP/3
  4. QUIC
  5. UDP/IP
Traffic rides MASQUE over HTTP/3, which runs on QUIC over UDP/IP.

HTTP/3 + QUIC

The transport layer provides the foundation for modern multiplexed network sessions. Only HTTP/3 is supported today.

Extended CONNECT

SkiMasque uses the HTTP/3 extended CONNECT mechanisms associated with MASQUE.

UDP

UDP semantics can be preserved end-to-end where supported.

Client
Gateway
CONNECT-UDP requestClient to Gateway
tunnel establishedGateway to Client
UDP datagramsClient to Gateway
UDP datagramsGateway to Client
The client asks the gateway for a CONNECT-UDP tunnel, the gateway confirms it, and datagrams flow both ways.

IP support

IP proxying (RFC 9484) is partly implemented. The wire formats are complete; forwarding IP packets through a TUN device is not wired yet.

PLANNED CONNECT-IP forwarding through a TUN device

Today SkiMasque carries TCP/UDP tunnels with HTTP and SOCKS frontends. Native Linux TUN forwarding translates configured TCP/UDP flows into those tunnels. General IP forwarding with RFC 9484 CONNECT-IP, ICMP and arbitrary IP protocols remains unavailable.

Standards status

The transport implements the MASQUE specifications listed below in Rust, on quinn and h3.

SpecificationStatusDetail
RFC 9297 — HTTP Datagrams and the Capsule ProtocolCompletein both encodings
RFC 9298 — Proxying UDP in HTTPCompleteover HTTP/3 extended CONNECT
draft-ietf-httpbis-connect-tcp — Proxying TCP in HTTPOn by defaultclassic CONNECT host:port
RFC 9484 — Proxying IP in HTTPPartialwire formats complete; TUN forwarding not yet wired
RFC 1928 — SOCKS5CompleteCONNECT and UDP ASSOCIATE

Where MASQUE fits

SkiMasque provides identity-aware network access.
MASQUE is the network transport underneath it.