Maggakos VPN

Features

Two ways to tunnel.
One set of protections.

Not a browser extension. Maggakos creates a real virtual network adapter and routes every app on your system.

🛡️

System-wide tunnel

All apps — browsers, games, terminals — route through the tunnel via a real TUN adapter. Works with HTTP, HTTPS, SOCKS4 and SOCKS5 proxies, authenticated or not.

⛓️

Tor-style 3-hop chains

You → Entry → Middle → Exit. Nobody in the chain sees the full path. Auto-picks the best chain for you.

⚡

Elite proxy checker

Up to 2000 parallel threads. Latency, anonymity level (Elite / Anonymous / Transparent), country flags, UDP support, a real page-load test and download speed — and it verifies username/password proxies instead of skipping them. Flaky proxies that drop the first connection are retried automatically.

🔑

Authenticated proxies

HTTP Basic, SOCKS5 user/pass and SOCKS4 user id work end to end. Paste credentials with the proxy, or right-click any row → Edit credentials… to add or fix them and re-test on the spot — no need to remove and re-add the proxy.

🧲

Proxy parser & filters

Paste any text, import files/folders, or pull from 11 open-source public lists — downloaded in parallel, so one dead list can't stall the run. Understands ip:port:user:pass, socks5://user:pass@host:port, comments and space-separated credentials. Filter by type, anonymity, auth or tag; click any column header to sort. The preview has its own right-click menu — add selected to the pool, use in VPN, copy, pin or drop rows.

🛡️

WireGuard — a real encrypted VPN

Import a standard .conf from any WireGuard provider or your own server and connect — from a file, or by pasting the text straight out of a provider's web page, so a private key never has to be saved to disk first. Unlike proxy mode this is a true tunnel: no one relay sees your traffic, the key never leaves your machine unencrypted (it is sealed with Windows DPAPI the moment it is imported), and because WireGuard carries UDP, gaming, VoIP and HTTP/3 work instead of being forced back to TCP. It runs on the same core and adapter as proxy mode, so the kill switch, split tunnelling, IPv6 guard and DNS controls all apply unchanged.

🔀

Switch transports in one click

Already connected through a proxy and want the real thing? Connecting a WireGuard tunnel replaces it — deliberately, not by accident. The reverse works too, and a connect you started can be cancelled at any point: the core is stopped on the way out, so cancelling never leaves traffic routing in the background.

🔎

One-button privacy audit

Instead of running four tests and working out what they mean, one button answers "is anything getting out around the tunnel?" — DNS (proved by which resolver answered), IPv6 (against an IPv6-only echo: an IPv4-only tunnel that sees an IPv6 answer is traffic going around it), UDP/WebRTC (a STUN request, whose mapped address is the one a remote peer would be handed), and whether your encrypted resolver really resolves. Only a positive answer that could not have come from anywhere else is called a leak — a probe that did not answer is reported as untested, not as a finding.

🎯

Split tunnelling — and your LAN stays yours

Send particular destinations, or particular apps picked from what is running right now, straight out while everything else is tunnelled — useful for a latency-sensitive game or a work app that must not look like it moved. Private addresses, loopback and link-local ranges never enter the tunnel, so network printers, casting and NAS drives keep working while you are connected. An IP entry that is not a valid range is ignored and shown to you, instead of being handed to the core and breaking every connect.

🧹

Wipe that actually wipes

Panic wipe destroys the pool, saved profiles, history, traffic totals, imported tunnels, logs and clipboard — and overwrites the files before deleting them, because a deletion leaves the bytes behind for any undelete tool. The Windows DNS and ARP caches go with them: the two places the machine remembers where you went.

🔒

Kill switch that really blocks

Strict routing while the tunnel is up, plus a real Windows Firewall block rule on your physical adapter — IPv4 and IPv6 — so nothing escapes if it drops. Local network and DNS stay reachable, and the rule removes itself on disconnect and never outlives a reboot.

🕵️

Private by construction

No account, no telemetry, no analytics — the app only talks to the proxy you chose, plus the IP/geo lookups it needs to verify the tunnel. Passwords are sealed with Windows DPAPI at rest, so the stored pool carries no cleartext. The checker marks WebRTC/DNS leaks and the 3-hop chain hides your IP from the exit.

🌐

DNS you control

Pick a built-in DoH provider — Cloudflare, Google, AdGuard, Quad9, or every Mullvad resolver (base, adblock, extended, family, all) — or your own URL, and choose whether DNS is resolved through the proxy so your ISP never sees the query. Mullvad's public DNS is retiring Nov 2, 2026; Quad9 is the drop-in replacement.

🛠️

Fast to fill your pool

Add one proxy by hand (host, port, and optional username/password), paste from the clipboard, drag files straight onto the window, or import a folder. Ping All refreshes latency in one click, and a Recent connections quick-pick jumps back to a proxy that worked.

🔄

Auto-rotate + traffic stats

Switch proxies automatically on a timer or when one dies. Auto-failover is on by default, and turning it (or auto-rotate) off is remembered across restarts — nothing reconnects on its own. Live up/down graph right on the dashboard.

📌

Pin & per-proxy actions

Star a proxy and the app prefers it everywhere — picker, auto-connect and failover. Every row has Use in VPN, Connect, Copy (with or without credentials), Test latency, Test UDP, Edit credentials, Pin and Remove. Double-click a row to select it as the exit without connecting, and add notes or tags to keep a big pool readable.

🩺

Built-in diagnostics

One click runs a full self-check: VPN core, Wintun driver, storage, internet, DNS, checker endpoints, whether your saved credentials can be decrypted, your whole proxy pool — and which resolver actually answered, a DNS leak test that fails on real evidence rather than on a lookup it doesn't recognise. Copy or save the report.

🗂️

Profiles & encrypted backups

Save separate pools (gaming, streaming, work) and switch instantly. Proxy passwords are sealed with Windows DPAPI at rest, and you can back everything up to a password-protected AES-256 file.

🕶️

Paranoid mode

One switch for maximum privacy: a 3-hop chain, DNS through the proxy, the kill switch, auto-rotation and IPv6 protection — with QUIC and plaintext HTTP rejected inside the tunnel and DNS resolved over an encrypted provider.

🚫

IPv6 leak protection

Native IPv6 is switched off on your physical adapter while the tunnel is up, so an IPv6-only path can't bypass an IPv4/TCP tunnel — and the tunnel itself is IPv4-only by default: it advertises no IPv6 address and refuses AAAA, so a browser never opens an IPv6 connection an exit can't carry. It stands down when a hop needs IPv6, is restored on disconnect, and is restored again after a crash.

🧹

No-logs mode & panic wipe

Turn off the VPN and crash logs entirely, and destroy the pool, connection history, traffic totals, logs and clipboard in one click.

FAQ

Good to know

Is this a real VPN, or just proxies?

Both — and they are clearly separated. WireGuard mode is a real VPN: an encrypted tunnel to a server you chose, carrying UDP as well as TCP. Proxy mode is not a VPN and does not pretend to be: it relays your system through a SOCKS5/HTTP proxy, and SOCKS5 carries no encryption at all, so the hop to that proxy is not private (HTTPS still protects page content end to end). Proxy mode is there because it needs no account and costs nothing. If you want what the word "VPN" actually means, import a WireGuard config.

Do I need a WireGuard provider?

No — you can import a config from any WireGuard provider, or run the server yourself (a free-tier cloud VM and wg genkey is enough). The app never asks for an account, and it works with proxy mode alone if you prefer. Paste the config text or point it at the file — either way it is checked properly, and a bad one is refused with the reason (a key that is not 32 bytes, an endpoint with no port) instead of becoming a handshake that never completes. A config using AmneziaWG's obfuscation keys is flagged too, since sing-box does not implement them.

Is it really free?

Yes. The app is free; it works with public free proxies or your own. No accounts, no tracking, no limits.

Can I pin or remove proxies?

Yes. Star (★) a proxy to make the app prefer it for the picker, auto-connect and failover, or remove one straight from the Checker's action bar, its right-click menu, or the Dashboard row. Pinning is kept across restarts. Right-click a row for the full set of actions, or double-click to select it as the tunnel exit.

What does turning off Auto-Failover do?

With it off, a dead exit disconnects instead of jumping to another proxy — and the choice sticks, so the app won't reconnect on its own after a restart. Auto-Failover is on by default; Auto-Rotate is opt-in.

Why do some sites show captchas?

Free proxy IPs are often flagged by Cloudflare/Google. Rotate to a different proxy — SOCKS5 residential ones pass best.

Why is my proxy slower than expected?

The app is only as fast as the proxy you pick. Sort by "Fastest first", enable Auto-Rotate, and prefer low-latency SOCKS5.

What about privacy?

DNS never leaves the tunnel, HTTPS stays encrypted end-to-end, and the 3-hop chain hides your IP from the exit. Passwords for private proxies are encrypted on disk with Windows DPAPI, so they are not readable in the app's data files. The proxy operators are third parties — see the app's Quick Guide for the full picture.

Do private (username/password) proxies work?

Yes. Paste them as ip:port:user:pass or socks5://user:pass@ip:port. The checker verifies the credentials and reports "authentication failed" if they are wrong, and the tunnel uses them automatically. If a proxy shows ✗ required, right-click it → Edit credentials…, type the username and password, and it is re-tested immediately.

Do HTTP proxies work for browsing?

Yes — browsing is TCP, so HTTP/HTTPS proxies work fine. They cannot carry UDP (games, VoIP), and the app blocks HTTP/3 (QUIC) for any exit whose UDP support has not been verified, so browsers instantly fall back to TCP instead of hanging. A SOCKS5 exit that passes the UDP test keeps HTTP/3. Use SOCKS5 when you need UDP.

What exactly does the kill switch block?

While connected, a Windows Firewall block rule is scoped to your physical adapter and blocks everything except your proxy hops, your DNS resolvers and your local network — over IPv4 and IPv6. So traffic that falls back to that adapter when the tunnel dies is dropped instead of leaking, while the tunnel itself keeps working. The rule lives in the session-only store, never survives a reboot, and Settings → Clear firewall rules removes it instantly.

Is my DNS actually going through the tunnel?

Settings → Run Diagnostics answers it with evidence instead of assuming. The DNS leak test reads the resolver's identity back out of authoritative "whoami" records at two independent operators and corroborates it with an EDNS lookup, then reports exactly which resolver answered — by operator name, or by geolocation when it is one the built-in table doesn't know. It fails on real evidence of a leak (the answer came from one of your own DNS servers, a local address, or a different operator than the one you configured) and not merely because a resolver isn't recognised, so the warning stays worth believing. What it proves is the resolver's operator, not the transport used to reach it — plain UDP to Google and DoH to Google look identical from the answer alone.

Do you keep any logs?

Not if you don't want to. Turn on No-logs mode and the VPN/core log and the crash log are never written — and the logs that already exist are deleted. Your public and exit IPs are never written to disk, and the runtime config that names your proxy is removed on every disconnect.

What is Paranoid mode?

A single switch that enforces the strongest posture: 3-hop chain, DNS through the proxy, kill switch, auto-rotation and IPv6 protection, with QUIC and plaintext HTTP blocked inside the tunnel. It's slower on purpose — turn it off and your individual switches stay where you left them.

What does the panic wipe do?

One click destroys the proxy pool, connection history, traffic totals, the VPN and crash logs, and your clipboard. It also restores IPv6, so a wipe never leaves your networking altered.

A page half-loads with ERR_CONNECTION_RESET

Your exit is resetting IPv6 connections it can't carry. The tunnel is IPv4-only by default — no IPv6 address, AAAA refused, IPv4 preferred — which is exactly what prevents it; leave Route IPv6 through the tunnel off unless your proxy genuinely carries IPv6. If it still happens, the exit is hitting its own concurrent-connection limit, and a different proxy is the fix.

Why does it need administrator rights?

The tunnel creates a virtual network adapter (Wintun) and the kill switch edits Windows Firewall — both need elevation. The app and the installer each declare that requirement in their own manifest, so Windows raises the prompt before either one starts. If it ever comes up without admin rights, the app re-launches itself elevated; declining the prompt exits instead of running half-configured.

Two ways to tunnel.One set of protections.