Mobile + Network Infrastructure • Live on Google Play (v2.1.2+23)

HS VPN — Commercial Anti-DPI VPN with Native Kotlin & Swift Tunnels on 9 Global Nodes

A commercial VPN app with native tunnels and a resilient control plane built for difficult network conditions.

FlutterKotlinSwiftFastAPIWireGuard

Role: Solo mobile, native, and infrastructure engineer
Production status: Live on Google Play · v2.1.2+23
Core stack: Flutter · Kotlin · Swift · AmneziaWG · FastAPI · Firebase Remote Config · Caddy · 9 Linux nodes
Business outcome: Shipped a commercial censorship-resistant VPN backed by a self-hosted nine-country fleet, with encrypted tunnels designed to stay stable across strict DPI networks.

The real-world problem

What the system had to solve

Standard VPN protocols and off-the-shelf mobile plugins get detected and blocked by deep packet inspection firewalls across strict network environments in Egypt and the MENA region. Standard client libraries also freeze or crash when switching between cellular data and Wi-Fi networks.

What I built

Architecture shaped by the constraints

I engineered an anti-DPI VPN client using Flutter, building custom native tunnel implementations with Kotlin on Android and Swift (NEPacketTunnelProvider) on iOS. The backend features a Python FastAPI peer registrar, handshake-verified connection state monitoring, and a 3-tier Firebase Remote Config fallback pipeline that updates server routes without requiring app store updates.

Production proof

Delivered system

Live on Google Play (com.hsvpn.vpn, v2.1.2+23) with users connecting through 9 production Linux nodes in Germany, the US, Singapore, the UK, the Netherlands, Canada, India, Australia, and Japan.

System flow

Architecture at a glance

Flutter app

Shared product UI and connection controls.

Native tunnel

Kotlin VpnService on Android and Swift NEPacketTunnelProvider on iOS.

Control plane

FastAPI peer registrar, Firebase configuration, and nine Linux nodes.

Engineering decisions

Why the system works this way

Native obfuscated packet tunnels

Constraint: Plain WireGuard headers can be fingerprinted by DPI systems, while generic mobile plugins do not handle the required platform tunnel behavior.
What I engineered: Implemented AmneziaWG packet obfuscation in Kotlin WireGuardVpnService on Android and Swift NEPacketTunnelProvider with WireGuardKit on iOS.
Production outcome: Established stable encrypted tunnels across restrictive networks without protocol renegotiation drops.

Three-tier control-plane fallback

Constraint: Firebase endpoints or DNS can be blocked regionally, leaving a client without current routes or gateway configuration.
What I engineered: Built a fallback chain from live Firebase Remote Config to a validated last-known-good disk cache and then a bundled bootstrap catalog.
Production outcome: Kept gateway resolution available during control-plane outages so the client could still find a connection route.

Handshake-verified session state

Constraint: A local tunnel interface can initialize before a remote cryptographic handshake, which can make an unprotected session look connected.
What I engineered: Gated active-session state on a confirmed native handshake and added a FastAPI peer registrar behind Caddy on TCP 443.
Production outcome: The app reports protection only after the tunnel is verified, while the registrar assigns client addresses and manages peers.

Discuss a similar system