Konduit exists because WireGuard-style UDP tunnels fall over on restrictive networks — so a large part of building it has been running it against genuinely adversarial conditions and measuring what breaks. That process is what we internally call battle-testing: connect, throw real traffic at the tunnel, measure throughput and stability, and treat every result — good or bad — as data worth recording.
The diagnostic that didn’t fit the theory
One of the standard diagnostics during battle-testing is a control test: tunnel the exact same traffic through a plain SSH connection instead of Konduit’s own transport, and compare. It’s meant to answer one question — is the network itself the bottleneck, or is it something in Konduit’s code?
On one restrictive test network, the SSH-tunneled control run came back with upload throughput roughly 5x higher than Konduit’s own transport was getting under identical conditions. That’s a useful diagnostic result on its own — it told us the ceiling we were hitting was in our own code, not the network — but it also pointed at something bigger: plain SSH port-forwarding was surviving conditions that were actively hostile to purpose-built VPN protocols.
From a test log entry to a product
That’s a pattern worth productizing, not just noting in a test log. SSH is already deployed everywhere, already trusted by anyone who runs a server, and — as the diagnostic showed — resilient in exactly the conditions where dedicated VPN transports struggle. The gap wasn’t the transport; it was that nobody had wrapped “SSH tunnel” into something a non-technical user could just turn on.
That gap became Koridor: a full-device VPN client built around a single idea — you already have a server you trust, so just tunnel through it. No Koridor-operated backend, no account signup, no third party sitting in the middle. Point it at any SSH server with port forwarding enabled, set up a connection profile, toggle on, done.
It’s also a deliberately different animal from Konduit on the server side. Konduit is a real VPN in the classic sense: the server terminates a tunnel interface and needs to be configured to route and forward that traffic — IP forwarding, NAT rules, the works. Koridor asks for none of that. It rides ordinary SSH port-forwarding, one TCP flow at a time, so a stock sshd with AllowTcpForwarding yes — which most servers already have — is the whole server-side setup. Konduit is the fully-engineered VPN; Koridor is the one that gets out of your way.
Konduit stays exactly what it was designed to be — a purpose-built, TCP-native VPN with server-enforced routing policy — and remains the fallback transport if SSH itself is ever the thing getting blocked. Two products, two transports, same underlying engineering discipline: measure first, build what the data actually points to.
Both are live now — see the products page for details, or read about their Google Play launch.