Skip to content

MASQUE IP & Ethernet Proxying over HTTP — draft-ietf-masque-connect-ip, draft-ietf-masque-connect-ethernet#

IETF 122 (Bangkok) digest Program Adjacent pick Bangkok · 15–21 March 2025

Slides Session recording Materials

  • Tier: Adjacent
  • Why: This is "VPN-as-an-HTTP-extension" maturing past UDP proxying into full IP and now Layer 2 tunneling — relevant if you're evaluating HTTP-native alternatives to classic VPN protocols for client access or overlay transport.
  • What: connect-ip proxies arbitrary IP packets over HTTP, letting a client build an IP tunnel through an HTTP server acting as proxy. connect-ethernet does the same one layer down, tunneling Ethernet frames through an HTTP server attached to a physical or virtual Ethernet segment. (from abstract only)
  • How: Both build on the same HTTP Datagram/Capsule Protocol machinery MASQUE established for UDP proxying, generalized to carry raw IP or L2 frames instead.
  • Where applicable: General; useful anywhere an HTTP load balancer is the only permitted ingress and you still need L3/L2 tunnel semantics behind it.