One tap, four paths: how Mayak connects

You tap “Connect”, a second or two passes — and the screen says “Protected”. More happens in those seconds than meets the eye: the app knows several different ways to reach the server and picks, on the fly, the one that is alive on your particular network. Here is how that ladder works — with no extra buttons on your side.

Why one path isn't enough

Between your phone and the server lies a carrier's network, and conditions there differ every time: on one network everything glides through, on another encrypted traffic hits interference, on a third certain kinds of packets simply vanish. And today's picture says nothing about tomorrow — the same SIM behaves differently across town. A service with one fixed route goes silent in that situation, leaving you to guess what broke. So Mayak keeps several routes and walks through them itself.

Rung 1: direct

The shortest path: your device talks straight to the server of the country you picked. It runs AmneziaWG 3.1 — the same fast, battle-tested WireGuard inside, but with the outward pattern of the connection altered, so it doesn't stand out from ordinary traffic and suffers less from carriers' traffic-management systems. On most networks the story ends right here: it's the fastest option, and the app always tries it first.

There is a subtlety here that you can see on screen. If your carrier gave the phone a newer-style address (IPv6), the app first tries to reach the server over it, and only then over the familiar one. The reason is simple: with some carriers the older address path is squeezed for connections like ours, while the newer one is not. When the new address works, connecting takes about a second. When there is none, or it doesn't get through, you'll see the line “Trying the usual path…” — that is not an error but a second attempt at the same first rung, to the very same server. The ladder does not step down at that point.

Rung 2: X-ray

If the direct path doesn't answer, the app tries a second protocol — X-ray. From the outside such a connection looks like an ordinary visit to a website; inside, it carries the same tunnel to the very same server of the chosen country, with no intermediate entry point. The screen then shows an “X-ray” label next to the status. Not every country has X-ray yet: where it doesn't, the app moves straight on to the next rung.

If you don't need this path — or, the other way round, need only this one — Settings has “AmneziaWG” and “X-ray” switches in the “Network” section. Either one can be turned off, but not both at once.

Rung 3: through a nearby entry point

When the direct path doesn't answer, distance — in the network sense — is often the culprit: traffic can't reach the faraway server, yet reaches a point in your own country just fine. That's what this rung is for: the app connects to a nearby entry point, which relays the traffic onward to the very same server in the very same country.

One detail matters here: the encryption is end-to-end. The relay cannot read your traffic — it only passes along sealed packets that no one but the destination server can open. And the screen is honest about the route: a “Via Russia” label appears next to the status.

Rung 4: the backup channel

Some networks kill all the paths above. Then the last rung kicks in: the tunnel's traffic is wrapped inside an ordinary secure web connection — the same kind your browser uses to open any site. A connection like that works practically anywhere sites open at all.

The backup is noticeably slower than the direct path, and we don't hide it: the screen shows a “Backup” label. Its job isn't speed records — it's keeping you connected where everything else has gone quiet: messages get through, mail syncs, maps load. And if your network is like this all the time, there is nothing to set up: the app moves to the backup channel on its own when it is needed.

How the app knows a path is alive

The most interesting part isn't the paths themselves but how the working one gets chosen. A “connected” icon guarantees nothing: an encrypted channel can establish while its packets quietly go missing. So Mayak verifies not the fact of a connection but the actual way out: it sends a request through the tunnel and waits for an answer from the outside world. Answer received — the path works end to end, phone to open internet. No answer within a few seconds — the path is declared dead, and the app steps down to the next rung. That's why you see steps changing on the screen instead of an endless “Connecting…”: the ladder keeps descending until it finds footing.

The same check keeps running after you're connected. If traffic dies on a live tunnel, the app notices and says so plainly: “There is a connection, but no traffic — reconnect”. Why that happens is a separate article.

Small things that save seconds

• Everything is prepared in advance. While you're choosing a country, the app is already fetching the connection settings — so the tap itself lands fast.
• Connecting without our site. The last working configuration is stored on the device, encrypted: even if our issuing server is temporarily unreachable, you can still connect.
• A network change is no reason to fall over. Wi-Fi hands over to mobile data, an elevator, the subway — the tunnel re-establishes itself without another round trip for settings.
• An honest route label. “Direct”, “X-ray”, “Via Russia” or “Backup” — you can always see which path you're on, because that's what your speed depends on.