A quieter way through.¶

Understand the tunnel you run. prrr carries encrypted IP traffic over HTTPS-based HARP or QUIC-based MASQUE, with a hybrid handshake and explicit routing and recovery policies.

Make your first connection Watch the mechanics

Follow one packet¶

Your application's IP packet reaches the TUN interface.
prrr encrypts it with a directional session key and authenticates its counter.
HARP or MASQUE carries the ciphertext to the server.
The server verifies and decrypts it, then passes the packet to its configured network path.
The reply travels back through the encrypted channel. A duplicate counter is rejected.

These are illustrative sample packets, not your traffic. Playback starts paused; choose Play or a chapter. The explanation remains readable without JavaScript.

Choose your path¶

Get connected¶

Install, provision one client, then follow your first tunnel.

Understand what happens¶

Explore the handshake, encrypted packet path, and recovery, then read the security boundaries.

Keep the route working¶

Diagnose the data plane with recovery checks; use configuration to choose full or resource routing.

Look up the details¶

Find the CLI, wire formats, admin API, and glossary.

What this protects—and what stays visible¶

The tunnel encrypts traffic between its client and server. A network observer can still see the endpoint, connection timing, and traffic volume; the server remains a trust boundary. Browser-like TLS settings do not establish indistinguishability from a browser, and reconnecting is not a kill switch. See security boundaries before deployment.

These pages describe the source at revision 191ebaf. That revision removed built-in Whisper messaging. Earlier flat guides remain in the repository as historical material; this site's navigation uses the new source-checked guides.

Source · Report a problem · Contribute to the docs