MASQUE
ActiveMASQUE (Multiplexed Application Substrate over QUIC Encryption) is an IETF protocol for proxying arbitrary traffic over HTTP/3 and QUIC. It enables UDP proxying (RFC 9298), IP proxying (RFC 9484), and TCP proxying via HTTP CONNECT. MASQUE is used in iCloud Private Relay and Cloudflare WARP to proxy traffic through HTTP/3 proxies while appearing as normal HTTPS traffic – enabling VPN-like functionality through firewalls that only allow HTTPS.
In one line
MASQUE (RFC 9298/9484, 2022–2023) proxies UDP, TCP, and IP packets over HTTP/3 and QUIC. It extends HTTP CONNECT to carry arbitrary protocols via Extended CONNECT (RFC 9220) and HTTP Datagrams (RFC 9297). The CONNECT-UDP method proxies UDP flows; CONNECT-IP proxies full IP packets. Apple iCloud Private Relay uses MASQUE for its second-hop proxy. Cloudflare WARP and many VPN providers use MASQUE to traverse firewalls that block non-HTTPS traffic.
Quick Reference
| Field | Size | Description |
|---|---|---|
| CONNECT-UDP | RFC 9298 | Proxies a UDP flow over HTTP/3. Client sends CONNECT request with :method=CONNECT, :protocol=connect-udp, :path=/.well-known/masque/udp/host/port/. UDP datagrams carried as HTTP Datagrams (capsules). |
| CONNECT-IP | RFC 9484 | Proxies IP packets (full IP-layer tunneling). Enables routing arbitrary IP traffic through an HTTP/3 proxy. More powerful than CONNECT-UDP. |
| HTTP Datagrams | RFC 9297 | Foundation for MASQUE. Adds unreliable datagram delivery to HTTP/3 via the DATAGRAM frame. Used to carry UDP packets and IP packets in MASQUE tunnels. |
| Extended CONNECT | RFC 9220 | Extends HTTP CONNECT to support protocols other than TCP tunneling. MASQUE uses Extended CONNECT to establish UDP and IP proxy tunnels. |
| Capsule Protocol | RFC 9297 §3 | A framing protocol carried in HTTP/3 stream data (not datagrams) for control messages in MASQUE tunnels. Allows reliable message exchange alongside the unreliable datagrams. |
| iCloud Private Relay | Deployment | Apple's iCloud Private Relay uses two hops: hop 1 (Apple operated) uses OHTTP/TLS, hop 2 (partner CDN – Cloudflare, Fastly) uses MASQUE CONNECT-UDP to proxy the actual QUIC/HTTP/3 traffic to destinations. |
| Firewall bypass | Port 443 | MASQUE proxies arbitrary traffic over HTTPS port 443. Firewalls that only allow HTTPS/TLS cannot distinguish MASQUE tunnels from normal HTTPS. Enables VPN functionality in restrictive networks. |
Key Characteristics
VPN over HTTPS
MASQUE tunnels TCP, UDP, and IP traffic over HTTP/3. To a firewall, it looks like normal HTTPS. No special VPN ports (1194, 1701, etc.) needed.
QUIC performance
UDP proxying over QUIC avoids the TCP head-of-line blocking of traditional VPNs. QUIC's congestion control and packet pacing improve throughput for multiplexed tunnels.
Proxying, not anonymizing
MASQUE is a proxy protocol, not an anonymizing protocol. The proxy operator can see client IP and destination. Combine with OHTTP for privacy (iCloud Private Relay pattern).
WebRTC TURN successor
MASQUE CONNECT-UDP can replace TURN for WebRTC relay. Instead of a TURN server, clients use MASQUE CONNECT-UDP through an HTTP/3 proxy to relay media. More firewall-friendly than TURN.
Message Format
// MASQUE CONNECT-UDP request (RFC 9298)
// Establishes UDP tunnel to 192.0.2.1:1234
CONNECT /.well-known/masque/udp/192.0.2.1/1234/ HTTP/3
:method = CONNECT
:protocol = connect-udp
:scheme = https
:authority = masque-proxy.example.com
:path = /.well-known/masque/udp/192.0.2.1/1234/
capsule-protocol = ?1
# Server responds 200 to accept tunnel
HTTP/3 200
# Client then sends UDP packets as HTTP Datagrams
# QUIC DATAGRAM frame:
# [Quarter Stream ID][UDP payload bytes...]// MASQUE CONNECT-IP (RFC 9484)
// Establishes IP-level tunnel
CONNECT /.well-known/masque/ip/*/* HTTP/3
:method = CONNECT
:protocol = connect-ip
:path = /.well-known/masque/ip/*/*
# Control capsules (Capsule Protocol, RFC 9297 §3)
# ADDRESS_ASSIGN capsule: proxy assigns IP address to client
# ROUTE_ADVERTISEMENT: proxy advertises routes
# IP packets carried as datagrams after setup
# iCloud Private Relay simplified flow:
# Client → Relay1 (Apple): OHTTP-encrypted request
# Relay1 → Relay2 (partner CDN): MASQUE CONNECT-UDP tunnel
# Relay2 → Target: normal QUIC/HTTPS