Moonlight
beyond walls.

Lunaire — multiprotocol VPN with Hysteria 2 and VLESS Reality

Lunaire is a VPN service that runs four modern protocols simultaneously: Hysteria 2 on QUIC/UDP, VLESS over Reality transport, xHTTP over HTTP/2, and classic VLESS + WebSocket. All four protocols run in parallel and the client app automatically fails over to a backup channel in under a second if the active protocol loses speed or stability. We deliberately don't build around a single protocol — different networks, ISPs, and regions behave differently, and the only reliable way to give users stable connectivity is to offer several independent paths at once.

The project launched in 2025 to solve a simple problem: most existing VPN services are built on WireGuard or OpenVPN, and when those protocols degrade on a specific network, users have no alternative but to wait or switch providers. Lunaire uses sing-box as its core on servers and on the Android client, which lets us quickly add new protocols and transports as they emerge. As of April 2026 we run seven servers across five regions — Amsterdam, Frankfurt, Helsinki, Ashburn, Tokyo — with a single multiprotocol subscription that works in any compatible client.

Protocols and why they matter

Hysteria 2 is a modern protocol built on QUIC over UDP, released in 2023. Its key feature is a custom congestion control algorithm called Brutal that maintains high throughput at 10-15% packet loss, where WireGuard and OpenVPN lose up to 70% of bandwidth under the same conditions. That makes Hysteria 2 the ideal choice for mobile internet (LTE, 5G), public Wi-Fi networks, and long international routes with high latency. Traffic is visually indistinguishable from regular HTTP/3 (QUIC) requests — e.g., requests to Google or YouTube. In Lunaire, Hysteria 2 is the primary protocol on all paid plans.

VLESS Reality is a transport protocol from the Xray family where the TLS handshake is disguised as a connection to a real website. On connect, the Lunaire server returns a genuine TLS certificate of a known domain (e.g., Microsoft or Apple), and from passive observation the client looks like a regular user of that site. This gives maximum connection camouflage: even advanced TLS-fingerprint analysis can't distinguish Reality traffic from regular HTTPS. Reality runs on TCP/443 and is particularly effective where Hysteria 2 doesn't pass due to UDP restrictions.

xHTTP is a relatively new transport that appeared in Xray and sing-box in 2024-2025. It's an HTTP/2 tunnel with multiplexed requests that delivers speed between Reality and WebSocket. It looks like an ordinary HTTP/2 connection and doesn't require specific TLS setup. Useful on networks where the Reality handshake itself gets filtered or where UDP is unstable.

VLESS + WebSocket is the most compatible transport. A WebSocket over TLS that looks like normal WebSocket traffic (Zoom, WhatsApp Web, any real-time site). Slower than Hysteria 2 and Reality due to additional wrapper layers, but passes almost everywhere, including corporate networks with aggressive filtering. Bonus — VLESS + WebSocket can be routed through a CDN (Cloudflare), which makes it resistant to IP blocks. In Lunaire it's the fallback protocol used when the other three channels can't connect.

Where Lunaire works better than typical VPNs

Classic VPN services (Nord, Express, Proton, Surfshark) are built on WireGuard or OpenVPN — reliable protocols, but rigid. They were designed for the stable networks of the 2010s and don't handle modern challenges well: active DPI on mobile carriers, UDP throttling by ISPs, packet loss on wireless networks. Lunaire solves three problem categories well.

Unstable networks. On trains, planes, cruise ships, and subways — where 4G hops between towers and packet loss can hit 10-20%. Hysteria 2 delivers 2-3× the speed of WireGuard in those conditions thanks to adaptive congestion control.

Mobile internet. Some mobile carriers aggressively throttle UDP traffic during peak hours (18:00-23:00 local time). WireGuard, which runs only over UDP, drops to 1-2 Mbps during those hours regardless of your plan. Lunaire switches to TCP protocols (VLESS Reality or WebSocket) and keeps the rated speed.

Public Wi-Fi. Hotspots in cafes, airports, hotels — often with captive portals, heavy filtering, and unstable latency. The multiprotocol approach increases the chance that at least one channel passes through a given hotspot.

Who Lunaire is for

The service targets users who value connection stability andprivacy, not geographic IP swapping for streaming. Typical scenarios: developers and IT pros who need stable access to GitHub/GitLab/ AWS/GCP from regions with ISP filtering; journalists and researchers who rely on identity protection; travelers and digital nomads moving between countries and networks; small business owners working with international corporate services (Slack, Zoom, Google Workspace). Lunaire also fits regular users who want baseline privacy on public Wi-Fi and protection from ISP-level DNS snooping.

Supported devices and clients

Lunaire has a native Android app (7.0+) using sing-box 1.13.8 as the core. The app is free, installed from Google Play or via APK from the site, supports all four protocols, auto-switch, kill switch (via Android's native Always-on VPN), and auto-connect on boot. For Android TV — the same APK, remote-friendly UI.

For iOS, Windows, macOS, Linux, and routers, we recommend third-party clients with our subscription. Best cross-platform choice —Hiddify: one client with identical UX across platforms, auto subscription update, support for all our protocols. Alternatives:NekoBox / NekoRay (Android, Windows — sing-box based, for power users), V2RayNG (Android — lightweight, classic),sing-box CLI (all platforms — for servers and routers),Streisand (iOS — Hiddify alternative). For routers — OpenWrt, Asuswrt-Merlin, Keenetic with Entware, guides at /docs. Native Lunaire clients for iOS, Windows, and macOS are in active development, ETA Q2 2026.

Privacy and no-logs

We operate under a strict no-logs policy. We don't record your originating IP, destination IPs, DNS queries, connection timestamps, or session contents. The infrastructure is designed to make logging technically impossible: iptables rules on nodes have no `-j LOG`, sing-box runs with `log.disabled: true`, servers don't have disk space to retain traffic. The only data we keep is minimum billing info (subscription ID, expiry, aggregate traffic for the period). The service operates from a jurisdiction outside of 5/9/14 Eyes intelligence sharing agreements and doesn't respond to user-data requests without a court order in the jurisdiction of registration.

About the free plan

The Dusk plan is free forever. You get 1 GB of traffic per day at full speed with no throttling, access to all four protocols, and one closest relay zone. The limit resets every 24 hours at 00:00 UTC. To connect — use the Telegram bot @lunairevpn_bot: no registration, just hit Start and get a subscription link for any compatible client. No payment data requested. The free plan isn't a limited trial — it's a standalone product for light daily use: 1 GB is enough for messengers, email, and web browsing throughout the day. For video streaming, large downloads, or cloud work — Twilight and above.