Architecture Overview

The Wihaister Tunnel

Wihaister uses QUIC as its transport protocol, providing a secure, multiplexed connection between two endpoints. A single encrypted tunnel carries every part of your session.

Your device                              Workstation
    │                                         │
    │   QUIC connection (TLS 1.3)             │
    │◄───────────────────────────────────────►│
    │   Remote desktop  ────────────────────► │
    │   Terminal        ◄───────────────────► │
    │   File browser    ◄───────────────────► │
    │   Camera          ◄───────────────────► │
    │   HID input       ────────────────────► │

Connection Flow

1. Handshake: The client initiates a QUIC connection to the server.
2. NAT Traversal: Wihaister attempts direct peer-to-peer connection using hole-punching techniques.
3. Relay Fallback: If direct connection fails, traffic routes through an encrypted relay. The relay forwards encrypted bytes without decryption capability.
4. Session Establishment: Once connected, the tunnel multiplexes remote desktop, terminal, file, camera, and HID streams.

Security Model

• All traffic is end-to-end encrypted using TLS 1.3 over QUIC.
• Encryption keys are generated per session and never shared with relay infrastructure.
• No plaintext traffic is ever transmitted.
• Relay servers only see encrypted bytes — not even we can read your traffic.

Protocol Components

The tunnel carries multiple multiplexed streams:

Stream Type	Purpose
Remote Desktop	Screen capture and streaming
Terminal	PTY sessions
File Transfer	Remote file browsing, previews, and downloads
Camera	Forwarding of workstation cameras
HID Forwarding	Keyboard, mouse, and touch input

Resilience

Wihaister watches the health of your connection during a session:

• Reconnection: if the tunnel drops, the client reconnects automatically.
• Adaptive quality: stream quality adjusts to available bandwidth, so a busy network slows the picture rather than breaking it.
• Relay fallback: sessions that cannot establish a direct path stay connected through the encrypted relay for as long as needed.