New Update AdguardVPN Protocol goes Open-source(TrustTunnel)

spaceoctopus

Level 16
Thread author
Verified
Top Poster
Content Creator
Well-known
Forum Veteran
Jul 13, 2014
769
5,304
1,478
Distant galaxy
Today is a big day for us, and for everyone who cares about transparency, privacy, and having full control over their own traffic. We’re finally open-sourcing the protocol that powers AdGuard VPN. And it now has a name: TrustTunnel.

For a long time, we’ve wanted to make the protocol public. Many of you asked for it, and we always said: yes, we will, it’s only a matter of time. Well, the time has come.

 
Last edited by a moderator:
The site you linked, TrustTunnel - Modern Open-Source VPN Protocol, presents itself as the official project page for “TrustTunnel”, described as an open-source VPN protocol originally developed by AdGuard VPN, with links out to AdGuard’s own blog and to GitHub for server/client setup. ([trusttunnel.org](https://trusttunnel.org/))

That said, I can’t certify any site as “safe” just from a link. If you’re trying to decide whether to trust it, these are the lowest-risk checks and best practices.

What it appears to be
  • A protocol/project site (not a consumer “VPN service” signup page): it emphasizes self-hosting a server and using clients to connect to “your own TrustTunnel servers.” ([trusttunnel.org](https://trusttunnel.org/))
  • It’s associated with AdGuard Software Limited per the site footer and AdGuard’s announcement about open-sourcing the protocol. ([trusttunnel.org](https://trusttunnel.org/))

Safer way to proceed
  • Do not download APKs from random mirrors. If you want the mobile client, prefer the official iOS App Store / Google Play links provided by the project (or the official developer pages). ([trusttunnel.org](https://trusttunnel.org/))
  • If you plan to use the GitHub code, only follow the GitHub links directly from the official site or AdGuard announcement, and verify you’re on the correct GitHub org/repo before running scripts or binaries. ([trusttunnel.org](https://trusttunnel.org/))
  • Before entering any credentials or downloading anything, submit the URL and any downloaded files to VirusTotal and also run a URL scan (urlscan.io) to see redirects, contacted domains, and other indicators.
  • If you self-host a VPN endpoint, treat it like any internet-facing service: patch the OS, lock down firewall rules, disable password SSH logins (keys only), and monitor logs. A “safe protocol” doesn’t compensate for an insecure server.

Key takeaway
It looks like a legitimate AdGuard-associated open-source VPN protocol project page, but you should still verify using reputation/scanning tools and only install clients from official sources. ([trusttunnel.org](https://trusttunnel.org/))

Sources
 
  • Like
Reactions: spaceoctopus
Does the app allow me to run a VPN server on device and allow me to connect to it from another device? Because... this is what I need.
Something like this?
 

ohhhh T R U S T Tunnel and NOT Thrust Tunnel ...got it.... sorry I was thinking of a different open source app
 
Jokes aside, Adguard is just too good. I use it daily for android. I highly recommend getting AdGuardVPN, if only to use it on mobile devices. I know android only have one VPN slot, and Adguard takes it. That meand that you cannot use AdGuard for Android and any other VPN. But if you get AdGuard for Android you can combine the two and still only use the one slot. If you get it from stacksocial you can get AdguardVPN for 60 months for $43 tax included (use code DOA20)! Not a bad deal at all.

I'm going to stop saying Adguard now.
 
How is AG VPN when it comes to privacy/anonymity?

Unclear. It's based in Cyprus, which is a very good for privacy. They do not have data retention laws. I believe IVPN is from Cyprus as well. AdguardVPN also claims a no-logging policy. But they've not been audited yet. However, Adguard is a very reputable company so I'm inclined to give them the benefit of the doubt until given a reason not too.
 
  • Like
Reactions: stonjean633
Unclear. It's based in Cyprus, which is a very good for privacy. They do not have data retention laws. I believe IVPN is from Cyprus as well. AdguardVPN also claims a no-logging policy. But they've not been audited yet. However, Adguard is a very reputable company so I'm inclined to give them the benefit of the doubt until given a reason not too.
Cyprus is a tax evasion/money launderers paradise. A lot of criminals set up shop there because they think it's safe.

There is no point anyway, most of the developers are based in Moscow, it doesn't matter if the company is registered in Cyprus when they can turn the screws back home.

It just depends on what threat model you accept and what privacy or security issues you care most about?
 
Cyprus is a tax evasion/money launderers paradise. A lot of criminals set up shop there because they think it's safe.

There is no point anyway, most of the developers are based in Moscow, it doesn't matter if the company is registered in Cyprus when they can turn the screws back home.

It just depends on what threat model you accept and what privacy or security issues you care most about?
Read this thread:

Andrey Meshkov (CTO and co-founder) answered all the questions regarding their services/apps and theories about connection with Russia. I strongly recommend everyone having any doubts about AdGuard to read them.
 
Yeah bullshit, he can say what he wants that he can't be pressured, extorted, arrested or coerced because the company is registered in Cypruss = LOL.

But the fact is if he is a Russian citizen then it's open season and anything can happen.
If you really believe in something, no amount of evidence will change your opinion. That's a fact.

I trust them. AdGuard is one of the most transparent companies out there, it's the second most popular ad blocking software and if it was doing something shady, it would be all over the media.
 
But the fact remains, if there are no logs to be turned over it would be impossible for anyone to turn over logs. Cyprus allows for such a policy. If you're saying that they are lying, keeping logs despite what their policies state because they can be pressured into it by Russian authorities, that's another argument. I don't buy that either. Then you fall down the slippery slope and believe that every VON logs despite policy, which we know by third party audits and server seizures to be false.