VPN protocol architecture analysis
Proton Protocols is not a new VPN protocol: what ProTUN changes
Proton Protocols sounds like a new tunnel competing with WireGuard or OpenVPN. It is not. Proton has replaced part of its client architecture with a shared Rust engine that implements WireGuard and can carry existing Proton connection modes, including Stealth.
A new protocol would change the rules spoken between the VPN client and server. Proton's August 12 release changes how its apps implement and manage those rules. It may still become a meaningful engineering upgrade, but the launch does not by itself prove faster speeds, stronger security, or post-quantum protection.
What Proton released
Proton published two launch articles and a public source repository. The technical article describes four names that are easy to collapse into one. They sit at different layers.
| Name | Technical role | Status | What it is not |
|---|---|---|---|
| Proton Protocols | The product name for the shared client architecture | Beta | A new wire protocol |
| ProTUN | Operating-system wrapper around the Rust core | Public source and tagged releases | The WireGuard implementation itself |
| libpvpnclient | Rust implementation of WireGuard | Used as a ProTUN dependency | A separate encryption protocol |
| LocalAgent | Certificate-authentication and control channel | Rewritten in Rust | The encrypted data tunnel |
| muon | Planned layer for reaching Proton's API under censorship | Phase two, described as coming soon | A current production tunnel feature |
Client architecture
Where ProTUN fits in a Proton VPN connection
The solid path is available in the beta architecture. The dashed muon path is planned work for reaching Proton's API before the VPN tunnel exists.
- App layer Proton VPN app Windows, Android, iOS, iPadOS, or Linux GUI
- OS adapter ProTUN Wraps the shared core for each operating system
- Tunnel core libpvpnclient Rust implementation of WireGuard
- Selected transport WireGuard or Stealth UDP, TCP, or the obfuscated Stealth path
LocalAgent
Handles Proton's certificate-based authentication and connection control alongside the tunnel core. Proton says this component was also rewritten in Rust.
muon
Intended to help apps reach Proton's API when DNS or server-name blocking prevents the first connection. It is separate from the current VPN tunnel path.
Why Proton is replacing wireguard-go
Proton's apps previously used the official Go implementation, wireguard-go. Proton says that code did not integrate cleanly with Kotlin on Android, Swift on Apple platforms, and the other native layers used by its apps. The result was more platform-specific glue, harder debugging, and slower feature work.
A shared core can reduce that duplication. One implementation can receive a fix once and expose it through thin operating-system adapters. It also gives engineers a common place to test edge cases and add transport behavior. Those are sensible architecture goals. They are not benchmark results.
Proton also says Rust should improve safety and performance. Rust can prevent several classes of memory errors when code stays within its safe subset, but language choice does not prove the absence of logic errors, unsafe blocks, dependency flaws, or protocol mistakes. A public assessment would provide stronger evidence than the implementation language alone.
What the public source establishes
The ProTUN repository is public under GPL-3.0. Its latest public release when checked was
v2.2.1, published August 7. The tagged library passes cargo check --lib after fetching dependencies from
crates.io and Proton's anonymously accessible Rust registry.
A buildable public tag gives reviewers something concrete to inspect. It still falls short
of a clean reproducible release. The tag has no Cargo.lock, so compatible
patch versions can change between builds. The release tags also sit outside the history of
the repository's default branch. Anyone reviewing a shipped version needs the tag instead
of relying on the latest master checkout.
The ProTUN manifest pulls pvpnclient from Proton's registry. That package source
is downloadable, but its package manifest does not declare license or repository metadata and
the downloaded package does not include a license file. This does not show that Proton lacks
rights to its own code. It does make reuse terms and provenance less clear for an outside reviewer
than the GPL-3.0 wrapper repository suggests at first glance.
No dedicated ProTUN audit has been published
Proton has a history of publishing app audits, and its apps remain open source. Those facts should not be stretched to cover a new 2026 WireGuard implementation. No public dedicated ProTUN or libpvpnclient report was located in Proton's security material, the repository, likely auditor indexes, or technical coverage checked on August 14.
The precise conclusion is "no public dedicated audit located," not "never audited." Proton may have performed internal testing or commissioned work that has not been published. Until a report identifies ProTUN, libpvpnclient, the reviewed tag or commit, and its exclusions, older app reports are only background evidence.
What users can test now
Proton lists the beta architecture on Windows, Android, iOS and iPadOS, and its Linux GUI app. macOS is absent from the current beta list. On iOS and iPadOS the early-access build uses the architecture automatically. The Windows, Android, and Linux apps expose a Proton Protocols toggle.
Linux gets the clearest immediate feature change: Stealth and Smart Protocol require Proton Protocols there. Stealth remains a WireGuard-over-obfuscated-TLS mode for restricted networks. ProTUN is the client architecture now capable of delivering it on Linux. The two names are related, but they are not interchangeable.
Beta users should expect defects. Proton's Android release notes already describe ProTUN updates intended to improve stability and ask testers for feedback. Early rollout work commonly looks like this, and it is also why broad claims about reliability or battery life should wait for measurements across devices and networks.
muon and post-quantum claims are future work
A VPN cannot protect a connection that never starts. DNS blocking, server-name inspection, or blocked API endpoints can stop an app before the system tunnel exists. Proton says muon will create a safer path to its API during that first phase and may eventually replace its alternative-routing system.
That could be valuable in censored networks, but Proton presents muon as phase two and says it will roll out soon. It should not be described as a current ProTUN capability or evidence that the beta already defeats a wider range of blocking.
The same boundary applies to post-quantum cryptography. Proton says the architecture lays groundwork for future support. It does not identify an algorithm, hybrid key-exchange design, protected connection phase, or app rollout. The current registry therefore records no documented post-quantum mechanism for ProTUN.
Should you enable Proton Protocols?
Enable it if you are comfortable testing beta networking code, need Stealth on Linux, or want to provide useful compatibility feedback. Keep the standard app path if your VPN is business-critical and the current connection is stable. A shared core can be a better long-term design without being the safest choice for every device during beta.
Do not switch because you expect a guaranteed speed boost or quantum-resistant tunnel. Proton has not published the comparative data or mechanism needed to support those conclusions. If you test it, keep the server, protocol, and network conditions fixed, then compare connection time, throughput, battery use, handover behavior, and leaks.
Our VPN protocol comparison now records ProTUN separately from Stealth so the implementation does not inflate the count of distinct protocols. For the broader concepts, see how VPN protocols and implementations fit together.
Primary sources
- Proton's ProTUN technical explanation for the roles of libpvpnclient, ProTUN, LocalAgent, and muon.
- Proton Protocols launch announcement for the beta platform list and stated design goals.
- Current Proton protocol support matrix for app availability and Linux requirements.
- ProTUN source repository and the v2.2.1 release for source, dependency, license, and release evidence.
- VPN Protocol Registry v0.2.0 for the normalized ProTUN and updated Stealth records.
Proton Protocols and ProTUN: FAQ
No. Proton describes it as a client-side VPN architecture based on WireGuard. The selectable tunnel and transport can still be WireGuard UDP, WireGuard TCP or Stealth. The new work changes the shared client engine that implements and manages those connections.
ProTUN is Proton's operating-system wrapper around libpvpnclient. It adapts the shared Rust core to Windows, Android, iOS and iPadOS, and Linux rather than defining a new wire format between the client and VPN server.
libpvpnclient is Proton's Rust implementation of WireGuard. Proton says it forked cryptographic code from Cloudflare BoringTun, then built a different client architecture around it.
No public dedicated ProTUN or libpvpnclient assessment was located in our search completed on August 14, 2026. Proton has published audits of its apps, but the older reports do not establish an independent review of this 2026 implementation.
Not in the material Proton published at launch. Proton says the architecture lays groundwork for future post-quantum cryptography, but it does not document an implemented algorithm, key exchange or rollout for ProTUN.
Proton lists Windows, Android, iOS and iPadOS, and the Linux GUI app. macOS is not included in the current beta list. Linux users must enable Proton Protocols to use Stealth and Smart Protocol.
