How it works
The story of how your traffic gets through
Some networks put a checkpoint on the road to the internet. It opens every parcel, reads the labels, and quietly drops anything that looks like a VPN. Engineers call it deep packet inspection — DPI.
ForestVPN answers with an adaptive ladder of counter-moves — and always uses the lightest one that works. This page tells the whole story: simply enough for a five-year-old, precisely enough for an engineer.
The disguise game
Your traffic has to walk past a checkpoint. ForestVPN gives it better and better disguises — but only as many as the checkpoint demands.
Your message sets out. On easy networks, it just walks through.
Region tiers decide the starting rung: free / monitored / censored.
First trick: the walker wears no name tag. Nothing about it says what it is.
T0 — keyed discovery + obfuscated headers: no cleartext fingerprint. Always on, on every plan.
The guard starts measuring everyone. So the walker changes size — and uses a different door each time.
T1 — padding + multi-port: telltale sizes and the single well-known port go away.
Now the guard listens for a certain accent. The walker answers in a completely different language.
T2 — Shadowsocks-2022 encapsulation.
Best disguise yet: look exactly like everybody else.
T3 — QUIC mimicry: shaped like the busiest traffic on the internet.
Send three walkers down three roads at once. Whoever gets through first wins.
T4 — race all transports: first road through carries the session.
For the very strictest checkpoints, the walker even changes how it walks.
T5 — maybenot/DAITA traffic shaping. Opt-in — you switch it on.
ForestVPN climbs only as high as your network demands — and steps back down when it can.
Tiers are retuned per region, server-side — no app update needed.
The packet that vanished
Watch one marked parcel become impossible to pick out of the crowd.
Every message is a little parcel. An inspector can read the labels.
Classic VPN protocols announce themselves in cleartext.
First, we take the label off.
Keyed discovery + obfuscated headers — nothing left to read.
Then we make the parcel the same size as everyone else’s.
Padding evens out the telltale lengths.
New wrapping paper — the same kind everyone uses.
Re-encapsulation (Shadowsocks-2022) or QUIC mimicry: the wrapping itself is ordinary.
Now even a careful inspector sees five ordinary parcels. Only you know which is yours.
That’s the whole trick: not stealth theater — nothing to match.
That’s what “nothing to find” means.
How ForestVPN handles censored networks
The road and the relay
When the straight road closes, another one lights up.
Usually your traffic takes the straight road.
Direct connections use UDP with NAT hole-punching.
Sometimes the road is closed.
Some networks block UDP entirely.
So ForestVPN sends it up and over — through a relay.
The DERP relay network, operated by ForestVPN.
The relay talks the same way normal websites do — so the road stays open.
When UDP is blocked, relays fall back to TLS; QUIC-DERP keeps it fast where QUIC is allowed.
You can tell it which roads you prefer.
Routing Mode: Automatic / Direct-preferred / Relay-only.
The moment the straight road opens again, ForestVPN takes it — that’s the fast lane.
Relays stay standing by; direct comes back the instant it works.
Devices that find each other by name
MagicDNS gives every device on your private mesh a real name — like nas.mesh.fvpn.net — so your devices reach each other by name, from any network.
Automatic names
Every device gets a name under *.mesh.fvpn.net the moment it joins — nothing to configure, no IP addresses to remember.
Split-DNS
Only your mesh names resolve through the mesh; every other lookup goes exactly where it normally would.
Rename on the fly
Rename a device and the new name follows instantly — the tunnel never restarts.
No DNS leaks
When you route through an exit node, DNS queries stay inside the tunnel instead of leaking to the local network.
Post-Quantum Cipher Suite
On Premium and Enterprise plans, ForestVPN's key exchange runs in hybrid mode: the classical handshake and Kyber — a post-quantum algorithm — agree on the keys together.
Why it matters: encrypted traffic can be recorded today and decrypted years from now, once quantum computers catch up — unless the keys were agreed in a way designed to withstand them. In the hybrid exchange an attacker has to break both halves, the classical exchange and Kyber; if one ever falls, the other still holds.
Included with Premium and Enterprise plans.
Ready for a VPN that adapts?
One app. The right disguise, only when it's needed.