Self-host Qeli
v0.8.2Self-hosted VPN with anti-DPI and post-quantum crypto
- Stars
- 262
- Ports
- 443 (VPN TCP listener (default)), 8080 (Web admin panel (default, loopback only))
ghcr.io/litvinovtd/qeli
What is Qeli?
Qeli is a self-hosted VPN designed for censorship-resistant connectivity in environments with active deep packet inspection (Iran, China, Russia). It implements its own Layer 4 protocol with six wire modes including REALITY TLS 1.3 with genuine HTTP/2 carrier, fake-TLS mimicry, and QUIC-shaped UDP. The handshake uses hybrid post-quantum cryptography (X25519 + ML-KEM-768) with ChaCha20-Poly1305 for data encryption. A built-in web admin panel provides user management, profile configuration, and qeli:// link/QR code issuance with Argon2id authentication. The server runs on Linux (TUN/TAP) with clients for desktop, mobile, and router platforms; iOS client is feature-complete but untested. Installation options include a one-command installer script, .deb packages, Docker multi-arch images, and binary downloads. The project is pre-1.0 beta with per-directory licensing: AGPL-3.0-only for the core/server and MPL-2.0 for clients.
Should you self-host Qeli?
Qeli scores 46/100 on selfhost.directory (how scoring works) and ranks #42 of 56 in VPN. It has 262 GitHub stars.
It shipped 10 stable releases in the past year. The latest, v0.8.3, came out on 26 October 2026. New versions land roughly every 6 days.
Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in Rust.
Its closest alternative on selfhost.directory is Tailscale (84/100, 38 203 stars). It scores higher overall, so compare the two before you pick. See Qeli vs Tailscale side by side.
Features
- IPv4/IPv6 dual-stack
- Multiple wire modes
- Multi-Profile Support
- Post-quantum handshake
- Router support (Keenetic, OpenWrt)
- Session roaming
- Site-to-site networking
- TUN VPN (full-tunnel and split-tunnel)
- Web Admin Panel
Qeli README
More in VPN
Self-Hosted GatewayOpen-source alternative to Cloudflare Tunnels using WireGuard, NGINX, and Caddy to expose local Docker containers without port forwarding.
setup-ipsec-vpnSelf-hosted VPN server built by one bash installer on Ubuntu, Debian, RHEL-family or Alpine Linux, offering L2TP/IPsec, Cisco IPsec and IKEv2 plus user helper scripts.
ShadowsocksOpen-source, self-hosted Shadowsocks proxy in pure C (the renamed shadowsocks-libev) with AEAD and SIP003 obfuscation, static builds and Docker images.
SoftEtherVPNOpen-source self-hosted VPN server supporting SSL-VPN, WireGuard, OpenVPN, IPsec, L2TP, SSTP and EtherIP in one program, running on Windows, Linux, FreeBSD and Solaris.
sshuttleOpen-source, self-hosted VPN alternative that tunnels TCP (and DNS, plus UDP with TPROXY) over plain SSH, with no admin access needed on the remote end.
strongswanSelf-hosted open-source IPsec VPN: an IKEv2/IKEv1 daemon for site-to-site and road-warrior tunnels with X.509 or EAP auth on Linux, FreeBSD, macOS and Windows.
subspaceSelf-hosted, open-source web GUI for running a WireGuard VPN server: per-device configs with QR codes, SAML SSO with G Suite or Okta, and Let's Encrypt TLS.
SwizGuardSelf-hosted stealth VPN wrapping WireGuard in VLESS+REALITY+Vision to appear as HTTPS traffic to Microsoft.com, deployable on a VPS with one command.
TailGuardSelf-hosted Docker container that bridges WireGuard-only devices into a Tailscale network, advertising WG subnets to the tailnet with an optional monitoring web UI.
TailscaleTailscale is an open-source WireGuard mesh VPN client creating secure peer-to-peer networks across devices using a hosted coordination service.
Tailscale DERP DockerA Docker-based self-hosted Tailscale DERP server that relays encrypted traffic between tailnet devices when direct connections fail.
towoneltowonel is an open-source, self-hosted tunnel exposing HTTP(S), TCP, and UDP services behind NAT or CGNAT without inbound ports, using a persistent QUIC tunnel.
0 comments