Some networks do not block VPNs by address. They block them by shape. On those networks you can change servers all day and nothing improves, because what is being dropped is the look of your traffic rather than where it is going. This guide explains what that inspection actually examines, why a TLS-fronted VLESS stream is a harder thing to classify, how to load one into the usual client apps, and, at the end, the part most pages skip: what nobody can honestly promise.
If you have an order with us, the VLESS links are on your order page alongside the WireGuard and OpenVPN files, opened with your eight character magic code. Four of the servers we deliver are CDN-fronted for exactly this situation: Singapore, Tokyo, Los Angeles and Berlin. Everything else on the VPN page is delivered the same way, on the same order, with no account anywhere in the process.
What deep packet inspection is looking at
A filtering box sitting between you and the internet has a handful of cheap signals available, and it uses them in roughly this order.
- Destination. The IP address and, for TLS, the server name in the handshake. This is the cheapest check and the first one built.
- Port and transport. Whether it is TCP or UDP, and which port. Unusual UDP to a high port is a strong hint on a network where almost everything is TCP 443.
- The first bytes. Every protocol starts with something recognisable. WireGuard's first handshake message is a fixed length with a known type byte in front. OpenVPN has its own opcode header. These are trivial to match once someone writes the rule.
- Shape over time. Packet sizes, timing, how symmetric the traffic is, whether there is a heartbeat every few seconds. A tunnel that sends a small keepalive at a fixed interval forever looks like nothing a browser does.
- Active probing. The most sophisticated version: the filter connects to the server itself and sees how it answers. A server that responds to a random probe in a way no real web server would responds itself into a blocklist.
WireGuard is excellent at almost everything and bad at exactly this. It is UDP-only, its handshake is a fixed size, and it is designed for speed and simplicity rather than for hiding. That is not a flaw. It is a design decision, and it is why the answer to "WireGuard is blocked" is never "configure WireGuard differently".
Why VLESS is harder to classify
VLESS is a lightweight transport protocol with almost no identifying handshake of its own. On its own that would not save it. What matters is what it is usually wrapped in: a normal TLS session to a normal hostname on port 443, often with a content delivery network in front, so the address your device connects to is an address that serves ordinary websites for thousands of other people.
To a passive observer, that connection looks like the several hundred other TLS connections your device makes every day. There is no distinctive opcode to match, the port is the one port that can never be blocked wholesale, and the destination address is shared with unrelated traffic, so blocking the address has a cost.
| Protocol | Transport | What a filter sees | When to use it |
|---|---|---|---|
| WireGuard | UDP, custom port | Fixed-size handshake with a known signature, on UDP | First choice everywhere it is allowed. Fastest, best on mobile. |
| OpenVPN UDP | UDP | Recognisable opcode header on an unusual port | Rarely better than WireGuard. Try when a client only supports OpenVPN. |
| OpenVPN TCP 443 | TCP 443 | Ordinary-looking port, but a distinctive handshake underneath | Corporate and hotel networks that only allow TCP 80 and 443. |
| VLESS over TLS | TCP 443, often behind a CDN | A TLS session to a shared hostname, like any HTTPS site | Networks that inspect traffic rather than just filtering ports. |
The order to try things in
Work down this list rather than jumping to the last item. Each step is slower or more fragile than the one before it, so there is no prize for skipping ahead.
- WireGuard. Import it, try two or three different servers, and give each one a minute. If a handshake never lands on any of them, and the same tunnel works on mobile data or another Wi-Fi, this network is the problem. The WireGuard setup guide covers the other reasons a handshake can fail, and those are worth ruling out first.
- OpenVPN over TCP 443. The profile is on your order page. Many restrictive networks are only doing port filtering, and this clears them immediately. Expect it to be slower than WireGuard: TCP inside TCP handles packet loss badly.
- VLESS. If port 443 in TCP is allowed but your OpenVPN profile still dies, the network is looking deeper than ports, and a TLS-fronted stream is the next shape to try.
- Change the location, not just the protocol. If VLESS to one region fails, try another. Filtering is often route-specific rather than global.
Importing a vless:// link
A VLESS server is delivered as a single line of text beginning with vless://. It contains the address, the port, the identifier and the transport settings all at once, which is why every client can import it from the clipboard in one step. Treat that line like a password: it is the credential.
v2rayNG, Android
- Install v2rayNG from its official release page or F-Droid.
- Copy the
vless://line from your order page. - Open v2rayNG, tap the plus in the top right, choose Import config from clipboard. The server appears in the list.
- Tap it to select it, then tap the round button at the bottom right to connect. The V icon in the status bar turns on.
- Use the speed test in the menu to check the server answers before you assume the tunnel is broken.
Hiddify, Android, iOS, Windows, macOS and Linux
- Install Hiddify for your platform.
- Press New profile, then Add from clipboard, with the
vless://line copied. - Pick the server in the list and press the big connect button.
- Hiddify keeps several profiles side by side, which makes it the easiest client for holding all four locations and switching between them.
Shadowrocket or Streisand, iOS
- Both are iOS clients that accept a
vless://link. Shadowrocket is paid; Streisand is free. Either is fine. - Copy the link, open the app, and it usually offers to add the server from the clipboard on launch. If not, use the plus button and paste.
- Set the routing mode to global or proxy for everything, unless you specifically want split routing.
- Connect, and approve the VPN configuration prompt from iOS the first time.
On desktop, Hiddify is the simplest cross-platform option. Advanced users running sing-box or Xray directly can paste the same link into their own configuration generator, but there is no advantage to doing so unless you already work that way.
Practical notes that save an evening
- Check the device clock. TLS is sensitive to a badly wrong clock, exactly like WireGuard. Set date and time to automatic before blaming anything else.
- Do not run two tunnels at once. A VLESS client and a WireGuard tunnel both want to be the system VPN. Turn one fully off before starting the other.
- Test on mobile data first. If the link works on mobile data and fails on a specific Wi-Fi, you have confirmed the network is filtering rather than the server being down.
- Expect it to be slower. An extra TLS layer and a CDN hop cost latency. That is the price of looking ordinary, and on a network that drops everything else it is a price worth paying.
- Turn the VPN off to install an eSIM. The profile download has to reach the operator directly. This applies to every protocol, and it catches people who bought a bundle and set up the VPN first.
The honest limits
This is the part that matters most, and it is the part a page selling you something usually leaves out.
No provider can promise that any protocol works on a censored network. Filtering changes, sometimes weekly, sometimes for a few days around an event, sometimes only on one carrier while another is untouched. Anyone who guarantees a specific country is either not paying attention or is telling you what you want to hear. We say what VLESS is built to do, which is to look like ordinary traffic and be the first thing to try, and we do not attach a promise or a refund claim to that.
A VPN moves trust, it does not remove it. Your ISP stops seeing where your traffic goes and starts seeing that you have an encrypted connection to one address. The network at the other end sees the traffic instead. Our network keeps no logs, source IP addresses and connection timestamps are never stored, and the servers run from RAM so a reboot wipes the machine, but that is a description of a design, not a promise about what any observer anywhere can work out. Nothing here makes anyone anonymous or untraceable, and a page that tells you otherwise is selling a feeling.
If your safety depends on this, do not rely on it alone. Use Tor, and on a network that blocks Tor directly, use Tor with bridges. Tor is designed against a much stronger adversary than a commercial VPN is, and the two are not substitutes for each other. Running Tor Browser over a VPN connection is a reasonable combination when the local network blocks Tor outright; the VPN handles reachability, Tor handles the threat model.
Your account and endpoint behaviour still matter. A tunnel changes the network path. It does not change that you signed into an account, that a browser fingerprint follows you, or that an app on your phone is reporting a location. Those are separate problems with separate answers.
What to do next
If you already have an order, open your order page with your magic code, import one VLESS link from each of the four locations rather than just the nearest one, and keep the WireGuard tunnels too. The whole point of holding several is that when one shape of traffic stops working you switch instead of investigating.
If you are still reading rather than buying, the VPN page lists what is delivered and the plan lengths from 7 to 365 days, and it is the same one account across every server we list. If your problem is a network at work or in a hotel rather than a censored country, start with the OpenVPN TCP profile and the WireGuard guide before any of this. And if you would rather understand what a crypto payment reveals before you make one, that has its own guide: paying with Monero, USDT or Bitcoin.
