ProofKit nodes come in two kinds. An origin is an exit: it decrypts your traffic and sends it to the internet. An edge is an entry: it forwards connections to an origin without decrypting them. A direct route uses an origin alone; a 2-hop route puts an edge in front of it.
How a 2-hop connection flows
[Your device]
│ Reality, Hysteria2 or XHTTP
▼
[Entry node]
sees: your IP, cover site
│ WireGuard (or GRE+IPsec)
▼
[Exit node]
sees: your destinations
│ TCP via WARP, if on
▼
[The site you visit]What each node sees
- The entry runs an nginx stream proxy. It reads the cover site name from your connection to pick the exit, and passes the encrypted bytes on. It sees your IP address, not your destinations.
- The exit decrypts the traffic and connects to the sites you visit. It sees those destinations, but the connection reaches it from the entry, not from your address.
- This division protects you from one party seeing both ends only when the entry and the exit are run by different operators. The marketplace does not show who runs a node.
Why an entry node helps with blocking
Some networks block or throttle connections to addresses abroad while leaving domestic ones alone. An entry node inside such a network stays reachable, and the tunnel from it to the exit is traffic between two servers rather than from your device.
Transports
Reality, Hysteria2 and XHTTP can all go through an entry: Hysteria2 over a UDP relay and XHTTP over a TCP relay on the entry node, where the link has them. olcRTC does not use the entry; it always reaches the exit through the video service.
Cost
A 2-hop route costs the entry's price plus the exit's price, plus the 20% network fee. A direct route costs the exit's price plus the fee.