Aether v2.0.0 turns Cloudflare WARP into a local proxy
Aether v2.0.0 runs the tunnel, a user-space TCP/IP stack, and a proxy inside one process. It scans Cloudflare edge addresses, rejects candidates that cannot carry data, and exposes the working route on 127.0.0.1:1819. Your browser or terminal must use SOCKS5 or the optional HTTP CONNECT listener. Aether installs no network driver and needs no root for ordinary desktop use.
Four tunnel modes cover different interference: MASQUE over HTTP/3 or HTTP/2, WireGuard, nested WireGuard, and nested MASQUE. The 163,558-line codebase can move MASQUE onto TCP when a network blocks UDP 443. Its scanner ranges from a quick first match to an ironclad mode that makes a real HTTP request before accepting an endpoint. The useful idea is simple: test the route a person can use rather than trust a successful handshake.
All 604 tests passed, but they cannot reproduce your censor
All 604 Cargo tests passed in our sandbox, and the repository contains about 163,558 lines of source. That is a lot of machinery for a client whose visible output is one local proxy. The documentation explains transports, scan modes, identities, routing rules, firewall marks, upstream proxies, and the cases where a setting changes privacy or reachability.
A 604-test suite cannot tell you which packets an ISP will drop tomorrow. Filtering varies by country, carrier, port, and protocol, so the README recommends MASQUE first, then offers HTTP/2, endpoint scans, ClientHello fragmentation, and heavier obfuscation profiles. Test those choices on the affected connection. We did not measure bypass success or tunnel speed and make no claim about either.
What happened when we ran it
Our sandbox installed 264 packages in 94 seconds at commit 0e6f6a5. The release build succeeded in 117 seconds, and cargo test completed in another 27 seconds with 604 passed and 0 failed. The fresh Debian container had 3 CPUs, 12 GB of RAM, no secrets, and no elevated privileges.
The checkout measured 10.5 MB across 2,190 files and about 163,558 source lines. Our scan recorded 1 CI workflow, no Dockerfile in the measured project path, and no top-level tests directory there. The Cargo command is the result that establishes the 604 successful cases.
Aether v2.0.0 has an unauthenticated local proxy
Aether v2.0.0 binds SOCKS5 to loopback, and every Docker example publishes port 1819 only on 127.0.0.1. Neither the SOCKS5 listener nor the optional HTTP listener authenticates callers. Binding either one to every interface can create an open relay. The OpenWrt guide suggests a LAN address for sharing, but you still need a firewall or an authenticated front end between the proxy and untrusted machines.
Persistent identity is another requirement. Aether registers a WARP device and stores its identity in a file. Losing that file after a restart causes another registration, and the README warns that Cloudflare can rate-limit repeated attempts. Keep the config on a durable volume. Zero Trust use adds an email code, service token, or access token, plus an optional Gateway path that can record browsing.
The 22-item issue and PR queue includes router and Tor bugs
GitHub listed 22 open issues and pull requests, with issue activity on September 14, 2026. Issue 117 reports that Aether's Tor SOCKS listener accepts TCP CONNECT but rejects UDP ASSOCIATE, while common TUN front ends send DNS through that command. The reported result is a tunnel that appears connected while names fail to resolve. Tor plus tun2socks needs its own test before you depend on it.
Issue 114 says --mark reaches raw tunnel sockets but not the HTTP client used for device registration. On the reported Linux policy-routing setup, registration can loop into a TUN interface and wait for a 20-second timeout. Issue 113 says the advertised gfw and firewall obfuscation names fall back to the balanced profile. These are open reports rather than findings from our sandbox, but each concerns the restricted-network cases Aether is meant to handle.
Rust 1.98 makes source builds more demanding than binaries
Building v2.0.0 requires Rust 1.98 or newer, CMake, and a C or C++ compiler. The Cargo project lives under aether/, so a build command from the outer directory fails. Prebuilt archives avoid that toolchain on Windows x86_64, Intel and Apple Silicon Macs, several Linux targets, Android Termux, and selected OpenWrt ARM or x86 hardware. Every v2.0.0 archive has a matching SHA-256 file.
MIPS and MIPSel OpenWrt devices are excluded. macOS binaries are not notarized, so the README tells users to clear the quarantine attribute after extraction. Tor needs a build with its extra feature and ships pluggable transports beside the binary. The instructions cover each case, though this remains a command-line network tool rather than an install-and-forget consumer VPN.
Aether reached v2.0.0 within two months
Aether was created on July 14, 2026, reached v2.0.0 on September 12, and was pushed the same day. GitHub showed 1,904 stars and 22 combined issues and pull requests on September 15. Issue updates two days after the push show that users are testing the new Tor and router paths. Two months of history cannot establish how the client handles long-running changes in Cloudflare or national filtering systems.
The AGPL-3.0 license deserves a deliberate check before modifying Aether for a product. For an individual who needs a WARP route through a difficult network, download a checksum-matched binary, keep the identity file, and leave the listener on loopback. A full-device VPN with authenticated sharing still needs another layer.