Infrastructure and reliability

#Connection profiles

The apps receive the server list and connection profiles from Colitu over an encrypted channel. Profiles are short-lived and renew automatically; if the internet drops briefly, the last valid profile keeps working for a while. You never enter any settings by hand.

#Protocols and ports

Colitu uses 4 protocol families and 5 connection modes: Hysteria2, VLESS Reality, VLESS XHTTP, Trojan and Shadowsocks 2022. The app decides automatically which one to use: How Colitu Adaptive Connect works

We don't publish which ports VLESS, Hysteria2 and the other protocols use. Ports and the other connection details reach the app encrypted; you never have to enter anything by hand.

#Corporate and restricted networks

Colitu works on most restricted networks automatically. If you can't connect on a company network, talk to your network administrator or write to live support and we'll find a solution together.

#Service tests

Every server regularly and automatically checks whether popular services open from its location:

• AI services (e.g. ChatGPT, Gemini, Claude)
• Streaming platforms (e.g. Netflix, YouTube Premium)

The results flow into the location list and categories in the app automatically.

#Server health

Servers are monitored continuously. A server with problems is taken out of rotation for new connections automatically and the apps are sent to a healthy one.

#Server categories

Labels in the location list:

• Streaming

  streaming platforms tested

• Gaming

  low latency and balanced load

• Privacy

  privacy-focused locations

• Speed

  high bandwidth

• Torrent

  servers where P2P is allowed (see Torrent and P2P; no server carries this tag right now)

• AI

  AI services open

#DNS, IPv6 and WebRTC

• Android and iOS: DNS queries go through the tunnel.
• Windows and Linux in TUN mode: DNS queries go through the tunnel to Cloudflare DNS-over-HTTPS.
• Windows and Linux in system proxy mode (the default): only lookups for traffic that reaches the proxy are protected. Apps that ignore the system proxy, the system DNS resolver, browser UDP traffic (QUIC, WebRTC) and IPv6 are not covered, so your internet provider can see those lookups and connections. Turn on TUN mode to cover them.
• The public resolvers the apps use by default (Cloudflare, Google) receive queries from the VPN server's IP address, not yours.
• IPv6: blocked on Android; on Windows and Linux blocked only in TUN mode with the kill switch on; on iOS it no longer leaks.
• Regional sites that the apps send outside the VPN are reached over your normal connection; see Split tunneling.