How It Works
[Android Device]
│
│ WireGuard UDP
▼
[SNI Tunnel Client] ← Wraps UDP in TLS/ssl + injects fake SNI
│
│ Looks like: HTTPS → microsoft.com ✓
▼
[ISP Firewall] ← Passes through — sees only valid HTTPS
│
▼
[VPS Server] ← Decrypts TLS, recovers WireGuard UDP
│
▼
[Cloudflare Warp] ← Receives native WireGuard traffic
│
▼
Internet
The core trick is SNI injection: the tunnel client inserts a trusted domain name (e.g. microsoft.com) into the TLS handshake. The ISP sees what appears to be a standard HTTPS connection and allows it through. The VPS server on the other end strips the TLS wrapper and forwards the real WireGuard packets to Cloudflare.
Features
- ssl tls sni injector
- warp
- cloudflare
- sni
- ssl
- tls
- vpn
- udp
- tcp
- injector
- WireGuard
- CloudFront

