6 min read
Of the whole list of circumvention protocols, three remain workable in heavily filtered networks as of 2026: VLESS with Reality masking, AmneziaWG, and Hysteria2 with obfuscation. Classic OpenVPN, plain WireGuard, Trojan and Shadowsocks in their base configurations are cut off by filtering equipment — each has a recognisable pattern in its first packets. Here is how the survivors differ and what to pick for which job.
It is not about the strength of the encryption — all of the above are fine there. It is about how the connection looks from the outside.
Filtering equipment does not decrypt traffic. It looks at signals: the size and order of the first packets, the handshake fields, the rhythm of the exchange. In classic VPN protocols these signals are constant and well documented — a connection is identified by them within the first milliseconds, before a single byte of useful data has moved.
The protocols that survive are the ones that hide that signature. There are three ways to do it, and they are fundamentally different.
| Protocol | What it mimics | Transport | Strength | Weak point |
|---|---|---|---|---|
| VLESS + Reality | ordinary HTTPS to a real site | TCP | maximum inconspicuousness: the handshake runs against a real third-party site | harder to configure, sensitive to the choice of cover site |
| Hysteria2 | HTTP/3 (QUIC) | UDP | speed and low latency, handles packet loss well | QUIC is itself noticeable, obfuscation required |
| AmneziaWG | nothing specific; it alters WireGuard's packet structure | UDP | simple setup, WireGuard speed | weaker masking than Reality |
VLESS + Reality is not merely encryption but a substitution of the interlocutor during connection setup. The client performs a TLS handshake with a real third-party site, and only after that does traffic go to your server. To an observer this looks like an ordinary visit to an ordinary site: real certificate, real domain.
Hysteria2 runs over QUIC and pretends to be HTTP/3 traffic — the same protocol that carries a significant share of today's web. The bet is that HTTP/3 is too widespread to be cut wholesale. The problem is that filtering equipment has learned to isolate QUIC patterns, so in heavily filtered networks Hysteria2 is deployed with obfuscation: it breaks recognition at the level of the connection's first packets.
AmneziaWG is WireGuard with an altered packet structure: junk is added, sizes and headers are changed so the connection no longer matches the reference signature. It does not pretend to be anything specific — it simply stops looking like WireGuard.
TUIC is another protocol over QUIC, ideologically close to Hysteria: same transport, same bet on speed and resilience to loss. Its practical niche is narrower than the three main ones: fewer clients, fewer guides, and it is vulnerable to QUIC filtering exactly as Hysteria is without obfuscation.
A sensible attitude to it: if you are already building infrastructure on QUIC and know what you are doing, TUIC is a workable option. As a main protocol for someone who just needs sites to open, it loses on the number of ready-made solutions.
A comparison of the base protocols against each other is covered separately: VLESS, OpenVPN or WireGuard.
On paper UDP protocols beat TCP-based ones, and Hysteria2 genuinely wins on unstable channels. But the speed you actually see is determined not by the protocol but by three other things: the distance to the server, the load on that particular node, and whether your operator is throttling that traffic.
A protocol cut off at the first packet has a speed of zero regardless of its specifications. So in filtered networks the order of priorities is the reverse of the usual: first "does it get through at all", then "how fast". The causes of speed loss: why a VPN slows you down.
If you are running your own server — yes, it is your decision, and whether the tunnel still works a month from now depends on it. Tools for your own server are covered in Amnezia, Outline or a ready-made service.
If you use a ready-made service — no. The whole job of the service is that you do not have to think about which protocol gets through today: masking is updated on the infrastructure side, and you press a button.
VLESS with Reality masking — the option that, of the three workable ones, gives the strongest inconspicuousness. To the operator's equipment the connection looks like an ordinary HTTPS visit to an ordinary site: the handshake is performed with a real resource, and the traffic has no signature of its own. One app covers iPhone, iPad, Mac, Apple TV and Apple Watch, a separate build handles Android TV, with clients for Windows and macOS. There are over a hundred servers; if one location is restricted you switch to another.
Which protocol works best in heavily filtered networks in 2026? Three are workable: VLESS + Reality, AmneziaWG and Hysteria2 with obfuscation. Classic OpenVPN, plain WireGuard, Trojan and Shadowsocks in base configurations are cut off.
Is Hysteria2 faster than VLESS? On an unstable channel usually yes, thanks to UDP transport and better handling of packet loss. On a stable channel the difference is small and distance to the server decides.
How does AmneziaWG differ from WireGuard? In packet structure: junk is added and headers are changed so the connection does not match the reference WireGuard signature that filtering recognises.
What is obfuscation and why does Hysteria2 need it? An additional layer that changes how the first packets of a connection look. Without it QUIC traffic is recognised by its characteristic features; with it, recognition breaks before it can fire.
Should I switch between protocols manually? On a ready-made service, no — that is the provider's job. On your own server it makes sense to keep a fallback protocol in case the main one stops getting through.
Which VPN to choose in 2026: 6 honest criteria — protocol, servers, logs, devices, traffic and sign-in. How to pick the best VPN and why BessyConnect fits. More
What you really pay for a free VPN and what a paid VPN gives you: encryption, servers, logs, speed. An honest comparison and where BessyConnect fits in. More
Reality vs Shadowsocks vs Trojan in 2026: which protocol beats blocks and DPI. An honest comparison of resilience, speed and setup — and where BessyConnect fits. More
