Originally published on proxymint .

A MASQUE proxy tunnels UDP and IP traffic over HTTP/3 with CONNECT-UDP and CONNECT-IP. How it works, who runs it today, and what it means for proxy users.

TL;DR

A MASQUE proxy tunnels UDP and IP over HTTP. It uses Extended CONNECT, usually over HTTP/3 on QUIC, so the site sees the proxy's IP and the network sees HTTPS on port 443.

Three RFCs define it. RFC 9297 adds HTTP Datagrams and capsules, RFC 9298 defines CONNECT-UDP, and RFC 9484 defines CONNECT-IP for full IP tunnels.

It already runs at scale. iCloud Private Relay and the Cloudflare WARP and 1.1.1.1 apps run on MASQUE, and Apple publishes the Private Relay egress ranges.

HTTP and SOCKS5 proxy users stay on TCP. Chrome uses SOCKS5 only for TCP requests and tunnels HTTP proxies through CONNECT, so a proxied browser speaks HTTP/2, not HTTP/3.

Key takeaways

Pick the method by what must cross the tunnel.…