Docs Config MASQUE

MASQUE

A proxy protocol based on the QUIC MASQUE standard, commonly used together with the usque tool to access certain carrier networks. Supports three network modes: quic, h2, and h3-l4proxy.

Example Config

config.yaml YAML

proxies:
  - name: "masque"
    type: masque
    server: server.com
    port: 443
    private-key: BASE64_ENCODED_PRIVATE_KEY
    public-key: BASE64_ENCODED_PUBLIC_KEY
    ip: 172.16.0.2/32
    ipv6: fd00::2/128
    mtu: 1280
    udp: true
    # congestion-controller: bbr

The key pair needed for the config file — can be generated with the community tool usque.

Field Reference

private-key / public-keyRequired

The base64-encoded ECDSA private/public key (the public key belongs to the server side). Remember to strip the PEM header/footer markers (like -----BEGIN PUBLIC KEY-----) and any line breaks within it.

ip / ipv6Optional

The local virtual network interface's IPv4/IPv6 address, in CIDR format.

mtuDefault: 1280

The MTU size for the TUN device.

networkDefault: quic

Three modes: defaults to native quic; set to h2 for masque-h2; set to h3-l4proxy for h3-l4proxy mode (this mode doesn't support UDP yet).

remote-dns-resolve / dnsOptional

When enabled, forces remote DNS resolution through the MASQUE tunnel; the dns field specifies the list of resolver servers to use.

congestion-controller / handshake-timeoutOptional

congestion-controller is off by default; can be set to bbr. handshake-timeout is the handshake timeout in seconds, defaulting to 0, meaning it relies solely on the outer connection's timeout.