# AetherST Tunnel: a multi-protocol Android client for MASQUE, WireGuard and Gool > AetherST Tunnel wraps the Aether Core and the HEV SOCKS5 engine in a Compose Multiplatform UI, adding optional Psiphon and Tor second layers. The README is detailed on protocol modes and silent on build instructions, so adoption depends on trusting the release binaries. **immaghzbad/AetherST** — Advanced Multi-Protocol VPN Client for Android (MASQUE, WireGuard, Gool, Zero Trust) powered by Aether Core and HEV SOCKS5 engine. High performance, DPI circumvention, and modern UI. - Repository: https://github.com/immaghzbad/AetherST - Stars: 470 · Forks: 72 - Language: Kotlin - License: NOASSERTION - Published: 2026-09-17 · Updated: 2026-09-17 · Language: en - Canonical page: https://hysenlabs.com/projects/immaghzbad-aetherst ## What AetherST Tunnel is for, and who it is not for AetherST Tunnel is a VPN and proxy client for Android and Windows whose stated purpose is connectivity in restricted networks. The README frames it as a client rather than a service: it does not run its own exit infrastructure, it orchestrates tunnels through protocols and third-party networks. The target reader is someone whose ISP or national firewall blocks protocol fingerprints, not someone who simply wants an encrypted link to a home router. The protocol list explains the intended use. MASQUE carries traffic over QUIC or TLS so it resembles ordinary web browsing. Gool nests one WireGuard tunnel inside another for obfuscation. Cloudflare Zero Trust routes through Cloudflare's network with Gateway filtering and Service Tokens. These are choices made by people who expect active blocking, and each one adds configuration surface that a plain WireGuard client does not have. The README lists two clients with different maturity: Android at v1.7.1 and Windows at v1.1.1, described as the first public release. That gap matters. Feature descriptions in the README, including the Tor chain, are labelled Android and tied to Aether Core v2.0.0, so a Windows user should not assume parity. ## How the Aether Core, HEV SOCKS5 and Psiphon layers fit together The architecture section names three components with distinct jobs. Aether Core v2.0.0 is the orchestration layer: tunnel management, gateway health checks, multi-protocol handling for MASQUE, WireGuard, Gool and MASQUE-in-MASQUE, and the built-in Tor implementation (arti) with automatic BridgeDB bridges. HEV SOCKS5 Tunnel v2.17.1 is described as the native bridge between the system and Aether on Android, providing a user-space TCP/IP stack, zero-copy packet processing and UDP over SOCKS5 translation. Psiphon Tunnel Core v2.0.41 is the optional second-layer engine. The data flow implied by the README is: the Android system hands packets to the HEV SOCKS5 tunnel, which translates them to SOCKS5 and passes them to Aether Core, which dials the selected transport. If a second layer is enabled, that transport is chained. The Psiphon chain exposes local endpoints on 127.0.0.1:3080 for SOCKS and 127.0.0.1:1820 for HTTP. The Tor chain exposes its exit on 127.0.0.1:3081 by default. The chain modes are directional and the README is explicit about one consequence. Tor inside tunnel (TOR) is documented as you to WARP to Tor to internet, and works with MASQUE, WireGuard, Gool and MASQUE-in-MASQUE. Tunnel through Tor (TOR_REVERSE) is documented as you to Tor to WARP to internet, and the README states it is MASQUE over HTTP/2 only because WireGuard and Gool endpoints are UDP-only and are refused in that mode. Tor only (TOR_ONLY) drops the Aether tunnel and runs the main proxy as plain Tor. A chain provider selector under Settings, Connection switches between Psiphon (the default) and Tor, and the Dashboard shows only the selected provider's settings card. ## Installing AetherST Tunnel and making a first connection The README does not document an install procedure. There is no build command, no Gradle invocation, no APK path, and no Windows installer step. What it does provide is a releases link, and the repository's release list carries Android tags such as v1.7.1-android. The honest summary is that the project expects you to take a release artifact, not to compile it. The repository does contain a Gradle wrapper and a settings.gradle.kts, so a build is presumably possible, but no documented task exists to follow, and the README names no module or task. The modules visible at the top level are app and composeApp, and the only script defined in package.json is the default test stub, which exits with an error. Nothing in the repository files shows how the Android client is assembled. Once installed, the README's configuration story runs through Settings. The chain provider selector lives at Settings, Connection. Choosing Psiphon keeps the default behaviour and the Dashboard swaps in the Psiphon card; choosing Tor swaps in the Tor card with its modes. The Tor modes are TOR, TOR_REVERSE and TOR_ONLY, and the README notes that bridges are fetched automatically from BridgeDB for the country you appear to be in, with a manual override available through --tor-pt-dir pointing at a folder of transport binaries. Pluggable transports listed are obfs4, snowflake, webtunnel and meek. A first real use is therefore: install the release, open Settings, Connection, pick a chain provider, pick a mode, and connect; the README's claim is that gateway discovery validates the data plane before the connection is presented as up. ## Where AetherST Tunnel breaks down The clearest limitation is documented by the project itself: TOR_REVERSE refuses WireGuard and Gool because those endpoints are UDP-only. If your preferred transport is WireGuard for battery and speed, tunnel-through-Tor is not available to you, and you are pushed either to MASQUE over HTTP/2 or to a different mode with different exposure. The second limitation is the missing build documentation. For a client that handles all of a device's traffic, the absence of a documented, reproducible build path is a real cost. You cannot easily audit what you are running, and you cannot patch a dependency yourself without reverse-engineering the Gradle setup. The release page is the only supported distribution channel the README points at. The third is platform asymmetry. Windows is at v1.1.1 and described as the first public release, while the Tor chain and the Aether Core v2.0.0 features are labelled Android. A Windows user reading the feature list at the top of the README may reasonably expect Tor chaining and find that the documentation scopes it to Android. Finally, the dependency chain is long. Aether Core, HEV SOCKS5 Tunnel and Psiphon Tunnel Core are three separate upstream projects pinned to specific versions in the README. When any of them moves, this client has to follow, and nothing in the repository layout suggests an automated way to know when that happens. ## AetherST Tunnel compared with a plain WireGuard client The obvious alternative for most readers is the official WireGuard client for Android, which does one thing: it reads a configuration file and brings up a tunnel. There is no gateway scanning, no protocol selector, no second layer, and no UI beyond a list of tunnels and a toggle. The difference in approach is where the complexity sits. WireGuard assumes the endpoint is reachable and stable. AetherST Tunnel assumes the opposite: the README describes real-time gateway discovery with data-plane validation before connection, which is a response to endpoints that are blocked or degraded. If your endpoint is not blocked, that scanning is overhead you are paying for nothing, and the extra layers (MASQUE, Gool, Psiphon, Tor) are configuration you will never touch. If your network does block WireGuard by fingerprint, the comparison flips. A plain WireGuard client has no fallback; AetherST Tunnel can move to MASQUE over QUIC or TLS, and can nest WireGuard inside WireGuard with Gool. The trade is that you are now depending on a client that ships as a binary release and whose build steps are undocumented, rather than on a client you can compile from a small, well-known codebase. Neither position is universally right; the deciding question is whether your network blocks the protocol you would otherwise use. ## Licence and upgrade cost The repository metadata reports the licence as NOASSERTION, which means GitHub could not classify the LICENSE file automatically. The README's own badge says Proprietary, and the badge links to that same LICENSE file. Separately, package.json declares "license": "ISC", which contradicts both. That file also carries a description field containing raw HTML copied from the README, and its test script is the default echo-and-exit stub, so it looks like scaffolding rather than a maintained manifest. Do not treat the ISC string as the project's licence. What this means practically: the source is visible on GitHub, but a proprietary badge is not the same as an open source licence. Redistribution, forking and bundling terms come from the LICENSE file, and you should read it before shipping the client inside anything. Nothing here is legal advice; the point is that three sources in the repository disagree and only one of them is the actual licence text. Upgrade cost is driven by the pinned dependencies. Aether Core v2.0.0, HEV SOCKS5 Tunnel v2.17.1 and Psiphon Tunnel Core v2.0.41 are all versioned in the README, and the Tor feature is tied to Aether Core v2.0.0 specifically. The release history shows three Android releases in September 2026, with v1.7.1-android on 2026-09-14, so the client is moving quickly. The last push to the repository was on 2026-09-14. Fast releases plus pinned upstreams means upgrades are frequent and each one can change tunnel behaviour. ## Conclusion AetherST Tunnel is aimed at users in heavily filtered networks who need MASQUE or nested WireGuard rather than a plain VPN profile, and who are willing to run prebuilt binaries. It is a poor fit for anyone who wants a reproducible build from source, because the README documents no build steps and the licence is marked Proprietary despite the NOASSERTION metadata. Before installing, check the LICENSE file for redistribution terms, confirm the release APK matches the v1.7.1-android tag, and test the Tor chain modes against your own network, since the README states that TOR_REVERSE refuses WireGuard and Gool endpoints. ## FAQ ### What does AetherST Tunnel do? It is a VPN and proxy client for Android and Windows that tunnels traffic through MASQUE, WireGuard, Gool or Cloudflare Zero Trust, with optional Psiphon or Tor second layers. The README describes it as built for restricted networks where DPI and protocol fingerprinting are present. ### How do I install AetherST Tunnel? The README does not document an install procedure. It links to the GitHub releases page, and the release list carries Android tags such as v1.7.1-android, so the intended path is a release artifact rather than a build from source. ### Which protocols does AetherST Tunnel support? MASQUE over HTTP/3 or HTTP/2, WireGuard, Gool (WireGuard nested in WireGuard), Cloudflare Zero Trust, and MASQUE-in-MASQUE via the --mim option. Psiphon and Tor are optional second layers that chain over the main transport. ### Why does AetherST Tunnel refuse WireGuard in tunnel-through-Tor mode? The README states that TOR_REVERSE is MASQUE over HTTP/2 only, because WireGuard and Gool endpoints are UDP-only and are refused in that mode. Tor inside tunnel (TOR) has no such restriction and works with all transports. ### What licence is AetherST Tunnel released under? The repository metadata reports NOASSERTION, the README badge says Proprietary, and package.json declares ISC. The README badge links to the LICENSE file, so that file is the one to read. ## Sources - [immaghzbad/AetherST on GitHub](https://github.com/immaghzbad/AetherST) - [Issues](https://github.com/immaghzbad/AetherST/issues) - [README](https://github.com/immaghzbad/AetherST/blob/main/README.md) - [Releases](https://github.com/immaghzbad/AetherST/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/immaghzbad-aetherst