Know the state
of your tunnel.
Not a guess at it.
Most VPN apps show a green dot and hope. ForestVPN's core tells you which of eight states your connection is actually in — working, degraded, blocked at handshake, blocked after it — and why, every few seconds, on every platform you run.
A proven handshake. Not reinvented.
The tunnel core keeps its handshake unmodified — Noise_IKpsk2, proven, interoperable with the fleet we run. What we changed sits around it: room in the handshake's own key slot for material we haven't shipped yet, traffic shaping, handshake and keepalive sizes that vary on every connection, and a diagnostic layer that reads the datapath's own counters instead of asking it how it feels.
On your device
forestvpn-quantum · forestvpn-netdiag
Handshake, encryption, and the counters that produce a verdict — all local. Nothing about how you use the tunnel leaves the device to be diagnosed.
On the exit
infra/ · NixOS fleet
Your traffic terminates on hardware we run, not a control-plane Worker. The Worker in front issues signed server lists and entitlements — it never carries a packet.
"Connected" is not a state we produce — it hides too much. Every verdict below comes straight from verdict.rs, and the app shows you the one that's true right now.
| State | What it means |
|---|---|
| Working | Data is flowing both ways. |
| Idle | Tunnel is up, nothing is sending. The state most often misreported as a fault. |
| Degraded | Carrying traffic, measurably worse than it should. |
| BlockedAtHandshake | Initiations are going out; the far end isn't answering. |
| BlockedAfterHandshake | The session established, then carried nothing. |
| MtuBlackhole | Large packets drop, small ones pass. A different location won't fix it. |
| ExitUnreachable | The path to the exit works; the exit can't reach the internet. |
| UnderlayDown | The local network is down. Nothing further out can be concluded. |
One core. Six clients.
- iPhone & iPad
- NetworkExtension, on-device. Under 50 MB RSS — no crash-reporter SDK is linked into the tunnel process.
- Mac
- Same core, same NetworkExtension model, menu bar first.
- Apple TV
- Ten-foot navigation, D-pad and Siri Remote, no keyboard needed to sign in.
- Android
- Phone, tablet, and Android TV, one VpnService implementation.
- Windows & Linux
- A privileged daemon plus a Tauri UI — the daemon runs headless on a machine with no screen.
- Router
- Runs as a RouterOS container on MikroTik hardware. Set its exit location from the web console — the one thing a screenless box can't do for itself.
No email. No password. A number.
Your account is a 32-character number. Nothing else identifies you. It can't be recovered if lost, and we designed every screen around telling you that clearly, once, at the moment it matters — not as a warning shouted at the door.
- 01
Buy
The App Store. Your account and number exist before a card is charged.
- 02
Save the number
Copy it, download it as a file, or print it. There is no email tied to it to send it back to you.
- 03
Paste it anywhere
iPhone, Mac, Apple TV, Android, a router with no screen — the same number signs in everywhere.