DPI bypass (Beta)
Qmesh has two Beta bypass modes for different tasks Results depend on your network
| Mode | Purpose | Platforms |
|---|---|---|
| Discord / YouTube | Local access to these services without a remote VPN server | Windows and Android |
| DPI bypass for VPN | Use zapret2 on the outer connection to your VPN server | Windows only |
The modes cannot run together Neither guarantees undetectable traffic or hides the VPN server IP
Find local bypass
On a desktop, Discord / YouTube is in the left sidebar On Android and in a compact window, use the play icon marked Beta at the top right Long-press it to see its name
The button opens setup until bypass has been enabled successfully for the first time Afterwards, it enables or stops bypass directly using the saved strategy Active mode is highlighted Bypass does not start automatically when Qmesh launches
Open Settings - DPI bypass to change the strategy. The initial setup page shows this location in an information card. Stop bypass before choosing another strategy.
| Windows strategy | How it works |
|---|---|
| Split the request | Sends the beginning of the TLS connection in parts in their normal order |
| Reverse order | Sends parts in reverse order if normal splitting does not help |
| Fake beginning | Sends a fake TLS packet before the split request |
| Android strategy | How it works |
|---|---|
| Balanced | Small TLS fragments and short pauses, recommended first choice |
| Small fragments | Smaller fragments and longer pauses, connections may take longer |
| Large fragments | Larger fragments with short pauses, an alternative for different network filters |
Android strategies adjust TLS fragment sizes and timing, rather than using the same packet algorithms as Windows.
Local DPI bypass
No remote VPN server or subscription is required. Bypass does not change your IP country or protect all traffic with a remote VPN tunnel. Results depend on your network; stop it and try another strategy if needed.
Windows: run Qmesh as administrator, select a strategy and enable bypass. Qmesh runs zapret2 with WinDivert independently of the VPN. If a VPN is connected, reconnect it to apply direct routes for these services. Reconnect again after stopping bypass to remove those routes. Standalone bypass will not start while Kill Switch is enabled. The bypass process closes with Qmesh; a running process does not prove service availability.
Android: Qmesh uses TLS fragmentation in its Xray core, without root or a second VPN app. Starting bypass creates and connects the Discord · YouTube (local) profile, replacing the current VPN. Android still displays a VPN icon because a local TUN is used. Other traffic goes directly. QUIC is blocked only for the service domains so clients can retry over fragmented TCP. Discord voice or IP-based blocks may still require a normal VPN.
To return to a normal VPN, stop bypass, select your subscription server and connect.
DPI bypass for the VPN connection - Windows
This Beta option is off by default and saved per server Administrator privileges are required even in proxy mode because zapret2 uses WinDivert
- Stop standalone Discord · YouTube bypass
- Select your VPN server on the home screen
- Open Settings - DPI bypass for VPN
- Enable Use for this server and start with Split the request
- Run Qmesh as administrator and reconnect
Supports one VLESS, VMess or Trojan server with TLS/REALITY over TCP, including raw transport Proxy chains, multiple proxy outbounds, WebSocket, gRPC, XHTTP, plain TCP and UDP are not supported yet Disable the option for these profiles to connect normally
zapret2 targets the outer VPN server IP and TCP port This option adds no direct website routes Existing explicit direct routes remain in effect Capture is scoped to the endpoint rather than a process ID, so other TLS connections to the same IP/port can also be affected
Hostnames are resolved using system DNS before connection and pinned to one public IP for the session The original TLS/SNI name is retained Kill Switch may block system DNS - use a numeric server address with the correct TLS/REALITY name if needed
zapret starts before the VPN cores and stops on disconnect, cancellation or application exit A zapret crash stops the VPN without silently retrying without bypass Kill Switch remains enabled with no additional direct permissions Strategy compatibility with WFP/WinDivert and the network requires testing on the device
Try another strategy and reconnect if needed This does not hide the server IP, overcome an IP block or guarantee undetectable traffic A running process does not prove successful bypass
Troubleshooting
- Administrator privileges required - use the restart button on the bypass screen and confirm the Windows prompt
- Unsupported profile - disable the per-server option and connect normally The transport configuration matters, not just the VLESS protocol name
- IP resolution failed - check DNS With Kill Switch, use a numeric server address and the correct TLS/SNI name supplied by the provider
- Standalone bypass blocked by Kill Switch - expected, since it needs direct traffic Use a normal VPN or the supported VPN DPI mode if blocking must remain enabled
- Process running but service unavailable - stop bypass and try another strategy The Android local mode does not change your IP country and Discord voice may require a normal VPN
When contacting support, include the platform, mode and strategy from Diagnostics Never publish subscription tokens, passwords or the full configuration