Hello Proton VPN Support Team,

I am a Proton VPN user on Android and I have been using the WireGuard configuration profiles exported from the Proton VPN dashboard with a third-party client (RethinkDNS), which provides per-app firewall and DNS filtering and profiles (e.g. with NextDNS) features alongside VPN functionality.

I have identified a specific issue with mobile network connectivity:

• When I establish a WireGuard tunnel over Wi-Fi and then switch to a 5G mobile network, the existing session continues without interruption.
• However, if I attempt to initiate a new WireGuard connection directly over 5G, the handshake fails entirely.

This behavior strongly suggests that my mobile carrier performs Deep Packet Inspection (DPI) and blocks the initial WireGuard handshake packets — which have a well-known, identifiable signature — on 5G networks, while already-established UDP flows are allowed to pass.

The Proton VPN application itself solves this via its Stealth (WireGuard over TCP) mode, which obfuscates traffic and bypasses DPI effectively. However, this feature is not available through the standard WireGuard configuration profiles exported from the dashboard, as it relies on a proprietary obfuscation layer that cannot be expressed in the standard WireGuard config format.

My request:
Would it be possible to provide an officially supported method for enabling Stealth/TCP mode in third-party WireGuard-compatible clients? This could be achieved through, for example:
- A documented SOCKS5 or HTTP proxy endpoint on the Proton infrastructure that wraps WireGuard in TCP, usable alongside standard WireGuard profiles;
- Or an open-source implementation of the Stealth obfuscation layer that third-party apps could integrate.

This would greatly benefit users who rely on third-party clients for functionality not available in the official Proton VPN app, while still needing to bypass carrier-level DPI on mobile networks.

Thank you for your time and consideration.

Best regards