MASQUE proxy: how HTTP/3 tunnels UDP and IP traffic

A MASQUE proxy is an HTTP proxy that carries UDP datagrams and raw IP packets as well as TCP streams. The client opens a tunnel with an Extended CONNECT request, usually over HTTP/3 on QUIC. The destination sees the proxy’s IP address, and the network in between sees what looks like ordinary HTTPS on port 443.

Classic HTTP CONNECT has tunnelled TCP for decades. Then QUIC moved a large share of web traffic onto UDP, and a TCP-only proxy could no longer carry it without wrapping UDP inside TCP, the same stacked-retransmission problem that makes TCP-over-TCP VPNs slow. MASQUE is the IETF’s answer, and iCloud Private Relay and Cloudflare WARP already run on it.

Two kinds of reader search for it. One is building or operating a relay, a VPN-style tunnel or a QUIC client. The other runs HTTP or SOCKS5 proxies for scraping, testing or automation and wants to know whether MASQUE changes that setup.

What a MASQUE proxy is

MASQUE stands for Multiplexed Application Substrate over QUIC Encryption. The IETF architecture draft, The MASQUE Architecture (draft 09, August 2026), defines a MASQUE proxy as an ordinary HTTP proxy that also implements the MASQUE methods. It runs on top of HTTP on purpose, so existing servers, load balancers, denial-of-service protection and HTTP authentication all carry over.

The family is three published RFCs and a few drafts:

An Ethernet variant and a templated version of plain TCP proxying, covered below, are still drafts; both were with the IESG for approval when checked in October 2026. Taken together, the MASQUE protocol family lets one HTTP connection carry TCP, UDP and IP flows side by side.

How the MASQUE protocol works

HTTP Datagrams. RFC 9297 (August 2022) adds datagrams to HTTP. Over HTTP/3 they ride in QUIC DATAGRAM frames, which are encrypted but not retransmitted, so a lost UDP packet stays lost, as UDP expects.

Capsule Protocol. The same RFC defines capsules: type-length-value records sent on the request stream. They carry control messages, and they also carry datagrams when the connection is HTTP/2 or HTTP/1.1 and has no DATAGRAM frames.

Extended CONNECT. The client sends a CONNECT request with a :protocol pseudo-header that names the tunnel type. HTTP/1.1 clients use an Upgrade header instead.

URI template. The target goes into the path, not the authority. RFC 9298 (August 2022) shows the request a client sends over HTTP/3 to open a UDP tunnel to 192.0.2.6 port 443:

HEADERS
:method = CONNECT
:protocol = connect-udp
:scheme = https
:path = /.well-known/masque/udp/192.0.2.6/443/
:authority = example.org
capsule-protocol = ?1

A 2xx response with capsule-protocol: ?1 opens the tunnel. Clients that only let the user enter a host and a port can fall back to a default template, https://$PROXY_HOST:$PROXY_PORT/.well-known/masque/udp/{target_host}/{target_port}/, and the RFC asks proxies to serve that path for compatibility.

When the target is a hostname, the proxy must resolve it before it answers. A failed lookup comes back as a rejection with a Proxy-Status header (RFC 9209, June 2022) such as dns_error. So DNS happens at the proxy, which matters if you care where name lookups leak.

CONNECT, CONNECT-UDP and CONNECT-IP

Classic CONNECT (TCP)

The method every HTTP proxy speaks. The client names a host and port, the proxy opens a TCP connection, and bytes flow both ways. HTTPS to the target runs inside it, so the proxy never sees the page.

CONNECT example.com:443 HTTP/1.1
Host: example.com:443
Proxy-Authorization: Basic BASE64_USERNAME_PASSWORD

CONNECT-UDP (one UDP flow)

CONNECT-UDP gives the client one UDP flow to one target. The proxy opens a socket, converts datagrams to UDP packets and back, and keeps the socket open as long as the request stream lives. The RFC says a proxy that closes idle sockets should wait at least two minutes. Its main job is carrying QUIC, so a browser can speak HTTP/3 to a site through the proxy and keep end-to-end encryption.

CONNECT-IP (whole IP packets)

RFC 9484 (October 2023) goes one layer down. The client asks for :protocol = connect-ip with a path such as /.well-known/masque/ip/*/*/ for full-tunnel forwarding, and the proxy can assign addresses and advertise routes through ADDRESS_ASSIGN and ROUTE_ADVERTISEMENT capsules. The RFC names remote-access VPN and site-to-site VPN as use cases. CONNECT-IP is the piece that makes MASQUE a VPN protocol rather than only a proxy method.

Templated CONNECT-TCP

An HTTP working-group draft, Template-Driven HTTP CONNECT Proxying for TCP (draft 14, September 2026), brings plain TCP into the same model: a URI template with target_host and target_port, the upgrade token connect-tcp, and data carried in capsules. One proxy URL can then describe TCP, UDP and IP service the same way.

MASQUE vs SOCKS5 and VPNs

SOCKS5 has carried UDP since RFC 1928 (March 1996) through UDP ASSOCIATE, but the UDP goes to a separate relay port in the clear, and client support is thin. Chrome, for one, uses SOCKS5 only for TCP requests. The SOCKS5 vs HTTP proxy guide compares the two classic methods in detail.

With CONNECT-IP, MASQUE also competes with VPN protocols, and WireGuard is the usual comparison. WireGuard runs its own handshake on its own UDP port. Cloudflare’s March 6, 2024 post on tunnelling WARP with MASQUE gives two reasons for the move, traffic that looks like HTTPS on port 443 and FIPS-compliant encryption that some customers require, and Cloudflare describes port 443 as less exposed to blocking than WireGuard. Neither side has a universal speed win; both carry UDP, and real throughput depends on the client, the network and the server.

Where MASQUE runs today

Service	Hops	What it uses	Status
iCloud Private Relay	Two: Apple ingress, third-party egress	QUIC on 443, MASQUE proxying	Introduced in 2021 for iCloud+ subscribers
Cloudflare 1.1.1.1 and WARP	One	MASQUE over HTTP/3	Default protocol in new app installs since December 2024
Chrome IP Protection	Two: Google proxy, then an external CDN	CONNECT and CONNECT-UDP	Retired: Google announced its retirement on October 17, 2025, after Incognito-only testing
Firefox built-in VPN	One, run by Fastly	HTTP CONNECT over HTTP/2 first, MASQUE over HTTP/3 planned	Shipped in Firefox 149, March 24, 2026

iCloud Private Relay. Apple runs the first relay; Akamai, Cloudflare and Fastly run the second, according to an APNIC and TU Munich study published January 25, 2023 that describes the connections as MASQUE over QUIC. Apple’s guide for networks and web servers (checked October 1, 2026) publishes the egress ranges at mask-api.icloud.com/egress-ip-ranges.csv and says the egress IP keeps a coarse, city-level location.

Cloudflare WARP. Cloudflare made MASQUE the default for the 1.1.1.1 and WARP apps on iOS, Android, macOS, Windows and Linux in a post dated December 27, 2024, with WireGuard kept as a manual option.

Chrome IP Protection. Google’s IP Protection explainer (archived by Google on November 3, 2025) described two proxies: Google’s would see the user’s IP but not the destination, the CDN’s the destination but not the user. Traffic was to use CONNECT and CONNECT-UDP, with DNS resolved at the second proxy, and the protection covered only Incognito requests to domains on a published list when they loaded as third parties. Google announced its retirement on October 17, 2025, citing low adoption, so it stands as a two-hop design reference, not a running deployment.

Firefox. Fastly’s write-up of the proxy behind Firefox’s VPN (June 15, 2026) says the first rollout uses HTTP CONNECT over HTTP/2, with MASQUE over HTTP/3 planned later in 2026.

Two hops and partitioning

One MASQUE proxy moves trust from the network provider to the proxy operator. The architecture draft points out that for most users this alone is no real gain. Nested tunnels fix that. The client runs CONNECT-UDP inside CONNECT-UDP, so the first proxy knows who but not where, and the second knows where but not who. With non-colluding operators, no single party holds both, an approach the IETF calls partitioning (RFC 9614, July 2024).

What networks and websites see

The network. The architecture draft says the unencrypted bits of a MASQUE QUIC connection look the same as those of normal browsing. Paired with a probe-resistant authentication scheme (RFC 9729, Concealed HTTP Authentication, February 2025), a MASQUE proxy can look like any web server to someone scanning it. The draft also names the limit. Products that classify traffic by packet timing and size still work on encrypted flows, so MASQUE raises the cost of that analysis without preventing it.

The website. It sees the egress IP, nothing else from the tunnel. For the big relays those addresses are public and labelled. Apple publishes its list, and IP-intelligence databases tag the ranges with fields such as relay or privacy proxy, according to Apple’s guide. Many users share one egress address, the same pattern as CGNAT on mobile carriers, so a per-IP rate limit hits every visitor behind that address. The wider set of signals sites read from an address is covered in how websites detect proxies.

Relay traffic therefore arrives from shared, published, relay-labelled addresses, and IP-intelligence data files them as a class of their own, apart from single home connections and hosting ranges.

Performance and limits

Nested congestion control. Proxying QUIC through a QUIC tunnel stacks two congestion controllers. RFC 9298 forbids the outer connection from switching its own off unless it knows for certain that the inner traffic is congestion-controlled.

Nested retransmission. Run CONNECT-UDP over HTTP/2 and a lost packet can be resent twice, once by TCP underneath and once by QUIC inside. That is why the RFC says UDP proxying should run over HTTP/3.

Packet size. QUIC DATAGRAM frames cannot be fragmented. When a UDP payload from the target does not fit, the proxy should drop it and send an ICMP Packet Too Big message rather than squeeze it into a capsule. Tunnels carrying full-size packets need path MTU discovery working on both legs.

Blocked UDP. Some corporate and public networks block UDP 443 outright. The standards keep HTTP/2 and HTTP/1.1 variants so a client can still connect over TCP, at the cost of the double-retransmission problem above.

Operator rules for a MASQUE proxy

RFC 9298’s security section sets these rules for anyone running a gateway:

• Require authentication. An open UDP proxy lets anyone send traffic that is attributed to the proxy.
• Refuse targets that are the proxy’s own addresses, localhost, link-local, multicast or broadcast, and answer with the destination_ip_prohibited Proxy-Status error. Otherwise a client can reach admin interfaces that trust 127.0.0.1.
• On a non-connected socket, check that each reply comes from the requested target’s address and port, and discard anything else.
• Plan for floods. A TCP CONNECT proxy stops sending once the target stops answering; a UDP proxy has no handshake to tell it the path is saturated.

What does MASQUE change for proxy users?

For people who route web requests through HTTP or SOCKS5 proxies, MASQUE changes little on the request path and something on the reputation side.

Browsers stay on TCP behind a configured proxy. Chromium’s proxy documentation (checked October 1, 2026) says HTTP proxies tunnel through CONNECT, and that Chrome uses SOCKS5 only for TCP-based requests and cannot relay UDP through it. A Chrome profile behind an HTTP or SOCKS5 proxy talks HTTP/2 or HTTP/1.1 to the site, not HTTP/3. Playwright and Python requests take their proxy as an http:// or socks5:// URL and have no connect-udp option, so the same holds for most automation. curl is the exception to watch: version 8.21.0 (June 24, 2026) added experimental CONNECT-UDP proxying in builds compiled with HTTP/3 proxy support, per the curl changelog.

HTTP/2 through a proxy is a common pattern. Every browser on a network that blocks UDP 443 also arrives over HTTP/2. Mismatches stand out more: a TLS or HTTP/2 fingerprint that does not fit the claimed browser, or an IP type that does not fit the claimed user.

Check what your requests actually negotiate. Cloudflare’s trace endpoint reports the IP it saw, the HTTP version, the country and whether the request came through WARP:

curl -s -x http://USERNAME:PASSWORD@HOST:PORT https://www.cloudflare.com/cdn-cgi/trace | grep -E '^(ip|http|loc|warp)='

Run it with and without the proxy, and from the browser profile you automate, and compare the http= line. Expect http/2 through an HTTP CONNECT or SOCKS5 proxy.

Relay IPs form their own class. A MASQUE relay presents a shared egress that the operator publishes. A residential or mobile proxy presents one consumer connection; a datacenter proxy presents a hosting range. Each fits a different job. proxymint’s tiers all speak HTTP and SOCKS5, the two schemes these tools expect: rotating residential proxies for consumer-origin coverage across cities, and datacenter proxies for volume against lenient targets. The types of proxies guide maps the rest, and best proxies for web scraping matches them to targets.

Which tunnel fits which job

• You are building a privacy relay, a VPN-style tunnel or anything that must carry QUIC, DNS or WebRTC through a proxy: run a MASQUE proxy. CONNECT-UDP for single flows, CONNECT-IP for a full tunnel, two non-colluding hops if the operator must not see both ends. Start from masque-go or quiche rather than writing capsule parsing yourself.
• You run a gateway that will accept CONNECT-UDP: authenticate every request, block local and link-local targets, keep congestion control on, and test MTU on both legs before launch.
• You scrape, test or automate websites: HTTP CONNECT and SOCKS5 remain the methods your tools speak, and the choice that matters is the IP type behind them. Check the negotiated protocol once with the trace command and keep the browser fingerprint consistent with it.
• You run a website and see relay traffic: treat Private Relay and WARP egress as shared addresses, use the published lists, and prefer tokens over per-IP limits.