WebTunnel Bridge VPS

WebTunnel runs an HTTPS server (real domain, valid Let's Encrypt cert) that serves an ordinary-looking website to standard browsers, but accepts WebSocket-upgrade requests at a secret path that bridges Tor traffic. The bridge is indistinguishable from any generic HTTPS website until the censor knows the exact secret path.

This is the strongest pluggable transport against DPI-based blocking in 2026 because it does not require a fronting CDN, does not have the throughput penalty of meek, and is harder to detect than obfs4 in environments that block all unknown encrypted protocols.

WebTunnel requires a real domain pointing at the VPS (we register or you bring), a real-looking cover website (we provide templates), valid TLS certificate via Let's Encrypt, and the webtunnel transport binary plus torrc configuration.

BridgeRelay 1
ORPort auto
ExtORPort auto
ServerTransportPlugin webtunnel exec /usr/bin/webtunnel
ServerTransportListenAddr webtunnel 127.0.0.1:15000
ServerTransportOptions webtunnel url=https://your-site.example/secret-path-here
Nickname AnubizWebTunnelBridge01

WebTunnel security depends on the cover website looking real. We provide cover-website templates: a static photography portfolio, a basic-resume site, a small-business landing page. None of these are blacklisted as bridge fronts. Operators can bring their own existing domain if it has plausible non-circumvention content.

WebTunnel VPS provision in 30 to 60 minutes including domain wiring and cover-site deployment. BTC and XMR.

Related: obfs4 Romania, meek, snowflake, obfs4 RU, Tor hosting parent.