Stealth VPN Mode for Windows and macOS
Stealth is a connection mode available only in the Windows and macOS VPNclient apps. It runs an OpenVPN connection locally and pushes it through stunnel, which can help on some networks where many ports are blocked.
- Available on
- Windows and macOS only
- Built on
- OpenVPN + stunnel
- Not on
- iOS, Android, Linux, TV
What Is Stealth?
Stealth is not a separate encryption standard. When a customer selects Stealth in the Windows or macOS app, the app runs an OpenVPN connection locally and pushes it through stunnel, an open source tool that wraps traffic in a TLS connection.
Wrapping the OpenVPN connection this way can help it get through on some networks that block many ports or common VPN traffic. Network restrictions vary and change over time, so Stealth is a useful extra option, not a guaranteed way through every firewall.
OpenVPN inside
The VPN tunnel itself is still an OpenVPN connection.
Pushed through stunnel
stunnel wraps the connection in TLS before it leaves the device.
Desktop only
Available in the Windows and macOS VPNclient apps.
When Stealth Can Help
- Windows or macOS users on networks where many ports are blocked.
- Desktop customers whose WireGuard or regular OpenVPN connection will not connect on a particular network.
- Giving support teams one more option to try before escalating.
Practical Limitations
- Available only in the Windows and macOS apps. Not available on iOS, Android, Linux, Android TV / Fire TV or routers.
- Can work on some restrictive networks, but does not bypass every firewall or censorship system and is not undetectable.
- Extra wrapping adds overhead compared with a direct connection.
Stealth Availability
Stealth is available only in the Windows and macOS VPNclient apps. It is not available on iOS, Android, Linux, Android TV / Fire TV or routers.
| Platform | Stealth |
|---|---|
| Windows app | Available |
| macOS app | Available |
| iOS app | Not in app |
| Android app | Not in app |
| Linux app | Not in app |
| Android TV / Fire TV app | Not in app |
Download links for every platform are on the white label apps page. Setup help is in the Help Center.
Stealth in a White Label VPN Offering
Stealth gives your desktop customers an extra option in the included Windows and macOS apps, with nothing additional to build or host. When you describe it to customers, say clearly that it is a desktop feature and that it can help on some restricted networks.
For mobile apps or your own application, consider VLESS through the VPNresellers API as an option for restrictive networks.
Stealth FAQ
Which devices support Stealth?
Stealth is available only in the Windows and macOS VPNclient apps. It is not available on iOS, Android, Linux, Android TV / Fire TV or routers.
Is Stealth a separate encryption protocol?
No. Stealth runs an OpenVPN connection locally and pushes it through stunnel. It is a way of carrying an OpenVPN connection, not a separate encryption standard.
Does Stealth work on every restricted network?
No. Stealth can work on some networks where many ports are blocked, but network restrictions vary and change, so it cannot be guaranteed to work everywhere or to be undetectable.
What can mobile customers use instead of Stealth?
Mobile VPNclient apps offer WireGuard and OpenVPN UDP/TCP. Partners building their own app can also integrate VLESS through the VPNresellers API for restrictive networks.
Background reading: stunnel.org
Give Desktop Customers One More Way to Connect
Stealth is included in the Windows and macOS VPNclient apps, alongside WireGuard and OpenVPN.
Read the VPNresellers API documentation →