05 May 2026
Free Ha Tunnel Plus Config Files for All 16 Countries
Ha tunnel plus connects over SSH using a custom payload and SNI to bypass your network without consuming airtime. Download ready-to-import .hat config files for your country and carrier from this page.
What Ha Tunnel Plus Actually Does
Ha tunnel plus is an SSH tunnelling client for Android. It wraps your internet traffic inside an SSH session pointed at a zero-rated access point on your network, which lets your data pass through without being counted against your airtime balance.
What separates it from basic SSH tools is the custom payload and SNI (Server Name Indication) system built into every .hat config file. These two settings are how the SSH handshake gets past your carrier's traffic inspection without being blocked or charged.
Unlike HTTP Custom, which depends on an HTTP proxy port, ha tunnel plus works at the transport layer. That means it keeps running on lines where the carrier has actively patched the HTTP proxy. The trade-off is speed: ha tunnel plus typically delivers 2 to 8 Mbps, which is steady and reliable but slower than HTTP Custom on a fresh config.
Config files for ha tunnel plus use the .hat format. Each .hat file carries everything the app needs to connect: the SSH server address, port, username and password, the payload string, and the SNI host. You import the file and connect. There is nothing to type manually.
Standard Ha Tunnel Plus Config
The primary import format. Contains a complete SSH session profile including server credentials, payload, and SNI settings. Import it using the folder icon inside the app.
Manual SSH Entry
Some older configs are shared as plain text SSH credentials rather than packaged .hat files. Ha tunnel plus accepts both, but .hat import is faster and less error-prone since all settings are pre-filled.
Current App Version
Always use the latest build. Older versions of ha tunnel plus have import bugs that reject valid .hat files from newer config generators. Get the current APK from the download link above.
What Is Inside a .hat Config File
A .hat file is a structured configuration package. Understanding what each field does helps you diagnose problems when a config stops working and gives you a head start on building your own when no shared config exists for your network.
[server] host = www.smartcall.co.za the SSH server your traffic is routed through port = 80 target port (80, 443, 22 or carrier-specific) username = vpn4pros SSH account username (shared or personal) password = vpn4pros SSH account password [network] sni = zero.mtn.co.za zero-rated host your carrier allows through for free payload = GET / HTTP/1.1[crlf]Host: [host_port][crlf][crlf] the HTTP upgrade request that tricks the carrier's proxy into opening the tunnel [ssh] method = direct direct = straight SSH; proxy = SSH via HTTP tunnel keepalive = 30 seconds between keepalive packets to prevent timeout compression = true compress traffic before tunnelling for faster throughput [proxy] type = socks5 local SOCKS5 proxy the app creates on your device local_port = 1080 port your apps route through on-device
SNI Field
The SNI value must match a hostname your carrier has whitelisted for zero-rated access. If it changes, the tunnel will connect but your carrier will charge for data.
Payload Field
This is the HTTP CONNECT or GET request sent during the tunnel handshake. The [host_port] placeholder is replaced automatically by the app using the SNI value and port.
Port Selection
Port 80 works on most carrier proxies. Port 443 works where 80 is blocked. Port 22 is raw SSH and usually fails on carrier networks. Some configs use non-standard ports like 8080 or 8443.
Server Lifespan
SSH servers in shared configs are recycled regularly. When the server is decommissioned, every .hat file pointing at it stops working regardless of the payload or SNI settings.
How the SSH Tunnel Gets Through Your Network
Ha tunnel plus uses three layers to connect. Each layer solves a different part of the problem of getting traffic through a carrier that is actively trying to identify and charge for VPN connections.
SSH Tunnelling
All your traffic is wrapped inside an SSH session. From the carrier's perspective, the connection looks like a legitimate encrypted session rather than a VPN tunnel. This is the core layer that makes ha tunnel plus harder to block than HTTP-based VPNs.
Core LayerSNI Spoofing
The SNI field in the TLS handshake is set to a hostname your carrier has whitelisted for zero-rated access, such as a social media or health site. The carrier's proxy reads the SNI, sees an approved domain, and allows the connection through without billing. The actual destination is inside the encrypted SSH tunnel.
Billing BypassCustom Payload
Before the SSH session opens, the app sends a crafted HTTP request to the carrier's proxy. This request mimics a legitimate browser connection to the zero-rated host. The proxy is satisfied, upgrades the connection, and the SSH tunnel opens inside it. The payload is the reason ha tunnel plus works on networks where a raw SSH connection would be immediately rejected.
Proxy HandshakeLocal SOCKS5 Proxy
Once connected, ha tunnel plus creates a SOCKS5 proxy on your device at port 1080. All apps on your phone can route through this proxy. The SSH tunnel carries the traffic to the remote server, which forwards it to the open internet. Your real IP is replaced by the SSH server's IP for everything that exits the tunnel.
Device RoutingDownload Ha Tunnel Plus Configs for Your Country
Each country page has .hat config files sorted by carrier. Pick your country, find your network, download the file, and import it directly into ha tunnel plus.
How to Import and Connect a Ha Tunnel Plus Config
The import process takes under two minutes. Follow these steps exactly and the config will load on the first try.
Download and install Ha Tunnel Plus
Get the latest APK from app.vpn4pros.com/apps/ha-tunnel-plus/. Install it on your Android device and grant all permissions on first launch. Do not install from unofficial sources — some repackaged versions have import issues or strip out the payload editor.
Find your country and download the right config
Use the country cards above to go to your country's config page. Select your carrier and download the .hat file. Check the date next to the file. Always grab the most recently verified one. If the download link shows a password, note it down before you import.
Import the .hat file into the app
Open ha tunnel plus. Tap the folder icon at the top of the screen, then select Import. Navigate to your Downloads folder and tap the .hat file. The config will load instantly with all fields pre-filled. You do not need to change anything.
If the app asks for a password during import, enter the one shown next to the download link on this website.
Connect and verify the tunnel is working
Tap the large Connect button. Ha tunnel plus will negotiate the SSH handshake using the payload and SNI from your config. A green status indicator confirms the tunnel is open. Open your browser and visit any site to confirm traffic is routing through.
If the connection fails on the first attempt, wait 10 seconds and try once more. SSH handshakes occasionally time out on congested networks on the first attempt.
Use the ping tool to pick the fastest config
If you have more than one .hat file saved, tap and hold any config in the list to access the ping tool. Ha tunnel plus will test latency to the SSH server. Pick the config with the lowest ping. Below 150ms is solid. Above 300ms and speeds will feel sluggish.
What Kills a Config and How to Know Which Part Failed
A ha tunnel plus config stops working for one of four reasons. Knowing which one it is saves you from spending time fixing the wrong thing.
The Four Failure Types
- 🔴 SSH server is down. The most common cause. The server in the config has been decommissioned or is temporarily offline. The app will show a connection timeout at the SSH handshake stage. Fix: download a fresh config from this website.
- 🟠 SNI host was patched. The carrier removed the hostname from their zero-rated whitelist. The tunnel connects but your data gets charged as normal. Fix: find a config with an updated SNI value for your carrier.
- 🟡 Payload format changed. The carrier updated their proxy to reject the HTTP request pattern used in the payload. The app will fail at the proxy handshake stage before the SSH session opens. Fix: download a config that uses a payload format tested after the carrier's update.
- 🔵 Port is blocked. The carrier started blocking the port used in the config. Common with port 80 and port 22 on carriers that have tightened their inspection rules. Fix: try a config that uses port 443, or 8080, or a non-standard port your carrier has not blocked.
How to Diagnose the Failure
- 🔍 Timeout at startup. The app hangs for 10 to 30 seconds then drops. This is almost always a dead SSH server. Download a fresh config before trying anything else.
- 🔍 Connected but no internet. The tunnel is open but no pages load. This points to an SNI issue. Your carrier is routing the SSH connection through but it is not reaching the internet because the zero-rated host is no longer valid.
- 🔍 Data balance drops after connecting. The config is working but it is not hitting a zero-rated path anymore. The SNI has been patched and your carrier is billing for the traffic. Disconnect immediately and get a new config.
- 🔍 Fails immediately with an error code. A refused connection at startup usually means the port is blocked at the carrier level. Try a config on a different port.
Step-by-Step Fixes for the Most Common Problems
Work through these before submitting a config request. Most problems are resolved at step one or two.
⏱ Config times out on connect
- Download the newest .hat file for your carrier from this website
- Delete the old config from ha tunnel plus before importing the new one
- Use the ping tool to confirm the server responds before connecting
- If still timing out, try a different port variant of the same config
- Submit a config request if no working file exists for your network
🌐 Tunnel connects but internet does not work
- Check that your device's mobile data is switched on (not Wi-Fi only)
- Confirm you are on the carrier the config is built for
- Open ha tunnel plus settings and verify the local proxy is set to SOCKS5 on port 1080
- Try a different .hat file with an updated SNI value for your carrier
- Restart ha tunnel plus completely and reconnect
🐌 Connected but speeds are very slow
- Open the config list and use the ping tool on all saved configs
- Switch to the config with the lowest latency reading
- Enable compression in the config settings if it is off
- Check your signal strength. SSH tunnels degrade sharply below 2 bars
- Try HTTP Custom as an alternative if speed is the priority on your line
📥 .hat file fails to import
- Confirm you have ha tunnel plus version 1.6.2 or later installed
- Re-download the .hat file. A partial download will fail to import
- Check whether the file requires a password and enter it at the import prompt
- Clear the ha tunnel plus app cache in your device settings and retry
- Try importing the file from a file manager app rather than the browser
💸 Data balance drops while connected
- Disconnect immediately to stop the data loss
- The SNI in your config no longer hits a zero-rated path on your carrier
- Download a config that was verified within the last 24 hours
- Before reconnecting, open the config details and check the SNI value matches a known zero-rated hostname for your carrier
- If the problem persists across multiple fresh configs, your carrier may have closed the loophole. Submit a request for a rebuilt config
🔒 Ha Tunnel Plus is blocked by my carrier
- Try a config that uses port 443 instead of port 80 or 22
- Look for configs labelled with alternative payload formats for your carrier
- Try HTTP Custom as a fallback. It uses a different method that some carriers do not block at the same time as SSH
- On heavily restricted networks like UAE or Iran, look for configs with obfuscated payloads
- Submit a request noting your carrier and country and I will build a config designed for restricted lines
Ha Tunnel Plus vs Other VPN Apps
Ha tunnel plus is the right choice in specific situations. Here is how it compares to the other apps available on this website so you can pick the best one for your line.
| App | Method | File Type | Speed | Durability | Best For |
|---|---|---|---|---|---|
| Ha Tunnel Plus | SSH + SNI + Payload | .hat | 2–8 Mbps | High | Lines where HTTP Custom gets patched frequently |
| HTTP Custom | HTTP Proxy / SNI | .hc | 5–30 Mbps | Medium | Fast connections where proxies are not frequently patched |
| HTTP Injector | HTTP Injection / SSH | .ehi | 3–12 Mbps | Medium | Multi-network setups with SSH and SSL options in one file |
| TLS Tunnel | TLS Encryption | Config | 2–10 Mbps | High | Networks that block SSH but allow TLS on port 443 |
| Dark Tunnel | SSH | Config | 1–4 Mbps | Medium | Econet Zimbabwe and MTN where SSH still works cleanly |
| OpenVPN | OpenVPN Protocol | .ovpn | 5–20 Mbps | High | Stable paid or sponsored data connections, not free browsing |
Speed figures are real-world estimates from community tests. Your actual speed depends on your network, signal strength, and the SSH server your config points to.
Getting the Best Results from Ha Tunnel Plus
These tips go beyond the basics. If the app is connecting but something feels off, one of these will usually fix it.
Save multiple configs for your carrier
Keep at least three .hat files saved for your network at all times. SSH servers go offline without warning, and having a backup means you can switch in seconds rather than downloading a new file from scratch while you have no data.
Enable compression for faster speeds
Ha tunnel plus supports SSH compression. On text-heavy browsing and social media, compression can increase effective throughput by 30 to 50 percent. Look for the compression toggle inside the config settings after import and switch it on if it is off.
Use port 443 on restricted networks
If your carrier blocks port 80 connections or you are in a country with strict internet filtering, prioritise configs that use port 443. Port 443 is the HTTPS port and carriers almost never block it entirely because doing so would break legitimate banking and shopping sites.
If port 443 is also blocked, look for configs using non-standard ports in the 8000 to 9000 range.
Keep the app updated
Ha tunnel plus v1.6.2 introduced improvements to the payload parser and the import system. Older builds reject some .hat files that the current version handles correctly. If a config fails to import or connect and you are confident the file is valid, update the app first before assuming the config is broken.
Disable battery optimisation for ha tunnel plus
Android's battery optimisation kills background apps, which drops the SSH tunnel without warning. Go to your device settings, find Battery, then App Optimisation, and set ha tunnel plus to unrestricted. This prevents the tunnel from being dropped mid-session.
Use the ping tool before committing to a config
Do not connect blind. Use the built-in ping tool on every saved config after downloading a fresh batch. A config that pings at 80ms will give you a noticeably better experience than one at 350ms even if both are technically working. The ping result reflects both the server's location and how congested the SSH path is right now.
Not Seeing Your Country or Carrier?
I add new configs as they are tested and verified for each network. If your country or carrier is not listed yet, or if the existing config for your line is patched, submit a request and I will build one. Most requests are fulfilled within 48 hours. The community also contributes configs regularly, so your request may be filled faster than you expect.
Request a Config →
If your config is working or you have spotted something worth updating on this page, let me know what you think in the comments section below. I read every one and use the feedback to keep the config files and guides current.