You tap “Connect”, a second or two passes — and the screen says “Protected”. More happens in those seconds than meets the eye: the app knows three different ways to reach the server and picks, on the fly, the one that is alive on your particular network. Here is how that ladder works — with no extra buttons on your side.
Why one path isn't enough
Between your phone and the server lies a carrier's network, and conditions there differ every time: on one network everything glides through, on another encrypted traffic hits interference, on a third certain kinds of packets simply vanish. And today's picture says nothing about tomorrow — the same SIM behaves differently across town. A service with one fixed route goes silent in that situation, leaving you to guess what broke. So Mayak keeps three routes and walks through them itself.
Rung 1: direct
The shortest path: your device talks straight to the server of the country you picked. It runs AmneziaWG 3.1 — the same fast, battle-tested WireGuard inside, but with the outward pattern of the connection altered, so it doesn't stand out from ordinary traffic and suffers less from carriers' traffic-management systems. On most networks the story ends right here: it's the fastest option, and the app always tries it first.
There is a subtlety here that you can see on screen. If your carrier gave the phone a newer-style address (IPv6), the app first tries to reach the server over it, and only then over the familiar one. The reason is simple: with some carriers the older address path is squeezed for connections like ours, while the newer one is not. When the new address works, connecting takes about a second. When there is none, or it doesn't get through, you'll see the line “Trying the usual path…” — that is not an error but a second attempt at the same first rung, to the very same server. The ladder does not step down at that point.
Rung 2: through a nearby entry point
When the direct path doesn't answer, distance — in the network sense — is often the culprit: traffic can't reach the faraway server, yet reaches a point in your own country just fine. That's what the second rung is for: the app connects to a nearby entry point, which relays the traffic onward to the very same server in the very same country.
One detail matters here: the encryption is end-to-end. The relay cannot read your traffic — it only passes along sealed packets that no one but the destination server can open. And the screen is honest about the route: a “Via Russia” label appears next to the status.
Rung 3: the backup channel
Some networks kill both of those paths. Then the last rung kicks in: the tunnel's traffic is wrapped inside an ordinary secure web connection — the same kind your browser uses to open any site. A connection like that works practically anywhere sites open at all.
The backup is noticeably slower than the direct path, and we don't hide it: the screen shows a “Backup” label. Its job isn't speed records — it's keeping you connected where everything else has gone quiet: messages get through, mail syncs, maps load. And if your network is like this all the time, Settings has an “Always use the backup channel” switch, so the app stops spending time probing the first two rungs.
How the app knows a path is alive
The most interesting part isn't the paths themselves but how the working one gets chosen. A “connected” icon guarantees nothing: an encrypted channel can establish while its packets quietly go missing. So Mayak verifies not the fact of a connection but the actual way out: it sends a request through the tunnel and waits for an answer from the outside world. Answer received — the path works end to end, phone to open internet. No answer within a few seconds — the path is declared dead, and the app steps down to the next rung. That's why you see steps changing on the screen instead of an endless “Connecting…”: the ladder keeps descending until it finds footing.
The same check keeps running after you're connected. If traffic dies on a live tunnel, the app notices and says so plainly: “There is a connection, but no traffic — reconnect”. Why that happens is a separate article.
Small things that save seconds
- Everything is prepared in advance. While you're choosing a country, the app is already fetching the connection settings — so the tap itself lands fast.
- Connecting without our site. The last working configuration is stored on the device, encrypted: even if our issuing server is temporarily unreachable, you can still connect.
- A network change is no reason to fall over. Wi-Fi hands over to mobile data, an elevator, the subway — the tunnel re-establishes itself without another round trip for settings.
- An honest route label. “Direct”, “Via Russia” or “Backup” — you can always see which path you're on, because that's what your speed depends on.
For you, all this machinery folds into a single button: tap it, and the app finds a living path on its own. The ladder is its job, not yours.