VLESS, REALITY, Hysteria2, TUIC, WireGuard: a guide to modern protocols
In 2026, the VPN protocol landscape in Russia looks simple: classic OpenVPN, L2TP/IPsec, and plain WireGuard are widely detected by TSPU (ТСПУ) equipment and regularly stop working. The protocols that hold up are the ones that can disguise themselves as ordinary HTTPS: VLESS with REALITY, Hysteria2, TUIC, and obfuscated WireGuard forks such as AmneziaWG.
This page is an overview guide to working protocols: what each one was built for, where it is strong and weak, how it behaves under DPI, and which transports it uses (TCP/UDP/QUIC). If you are choosing what to run your VPN on, or just want to understand why one client works for you and another does not, start here.
We do not name specific “always working” services: TSPU rules are updated, and today’s “100% working VPN” may be in the filter tomorrow. It is better to understand the protocol itself; then it is easy to switch tools without wasting time on promotional reviews.
Short answer
- Modern “resilient” protocols are VLESS-REALITY, Hysteria2, TUIC, and AmneziaWG.
- Basic WireGuard, OpenVPN UDP, and L2TP/IPsec are classically detected by their handshake signature.
- REALITY is not a separate protocol, but a masking layer on top of VLESS that imitates another site’s TLS.
- Hysteria2 and TUIC run over QUIC/UDP and are optimized for packet loss.
- Shadowsocks-2022 remains a working lightweight proxy protocol, but without TLS masking.
- Choosing the protocol is now more important than choosing the service: the right protocol lasts longer.
What has happened to protocols over the last couple of years
Before the mass rollout of TSPU, almost any VPN was enough: the operator looked at the IP and port, and as long as your server was not visible on a blacklist, everything worked. Deep packet inspection changed the rules. Now equipment at the operator’s edge can inspect the contents of the first packet (the handshake) and decide: this is a browser, this is a game, this is a VPN.
This creates two large families of modern protocols. The first are those that pretend to be ordinary HTTPS: VLESS-REALITY, Trojan, and Shadowsocks with a TLS plugin. The second are those that moved to QUIC (UDP on port 443) and use it as the carrier: Hysteria2 and TUIC.
VLESS
A lightweight transport from the Xray team: it does not encrypt anything on its own and is designed to be wrapped in TLS from the outside. By itself, it is thin and fast. It became popular specifically as a “base” on top of which XTLS or REALITY is placed. Core documentation is on the XTLS project website.
REALITY
Not a separate protocol, but a masking layer for VLESS. The idea is simple: during the handshake, the server actually connects to another popular site (for example, a major cloud host), takes its real TLS certificate, and presents it to the client. From the outside, DPI sees a “connection to microsoft.com,” and it is hard to distinguish it from real traffic. The specification and code are in the REALITY repository.
Hysteria2
A proxy protocol over QUIC. Its main feature is its own congestion control (Brutal), which extracts speed in networks with high packet loss. It is disguised as HTTPS/3 (QUIC on 443). It is useful where an ordinary UDP tunnel breaks every minute.
TUIC
Also based on QUIC, but with an emphasis on low latency and IPv4/IPv6 multipath handling. It is used less often than Hysteria2, but is convenient for interactive scenarios: games, voice, and ssh.
WireGuard and its forks
WireGuard itself is the fastest and simplest modern VPN protocol. But its fixed-length handshake with a characteristic header is trivial to detect. That is why in Russia it is not “bare” WG that survives, but forks with obfuscation: AmneziaWG adds random junk bytes to the handshake to break the signature.
The classics: OpenVPN, L2TP/IPsec
Both protocols were designed before the DPI era and cannot hide themselves. OpenVPN in UDP mode is recognized by the structure of the first packet; in TCP-TLS mode, by characteristic ClientHello extensions. L2TP/IPsec uses a typical set of ports, UDP 500/4500, which operators often block entirely.
Protocol comparison: transport, masking, DPI resistance
| Protocol | Transport | Masking | DPI resistance |
|---|---|---|---|
| VLESS + REALITY | TCP/443 + another site’s TLS | Full — looks like HTTPS to a legitimate domain | High |
| VLESS + XTLS-Vision | TCP/443 + TLS | Moderate — characteristic ClientHello patterns are fixed regularly | Medium–high |
| Hysteria2 | QUIC/UDP 443 | As HTTPS/3 | High |
| TUIC | QUIC/UDP 443 | As HTTPS/3 | High |
| AmneziaWG | UDP, any port | Noise in the handshake on top of WG | Medium |
| Shadowsocks-2022 | TCP/UDP, any port | None; clean stream with AEAD | Medium |
| WireGuard (basic) | UDP, any port | None | Low |
| OpenVPN UDP/TCP | UDP 1194 / TCP 443 | None (or external plugins) | Low |
| L2TP/IPsec | UDP 500/4500 + ESP | None | Very low |
How to check right now
The easiest way to understand which protocol is currently available on your operator is empirical: run the same type of checks from different probes and compare. Freedom Checker does exactly this: it tracks the availability of popular protocols by operator and region, without advertising specific VPNs.
If your current client is using basic WireGuard or OpenVPN, it is the first candidate for replacement. First try VLESS-REALITY or Hysteria2 through clients based on the sing-box core or Hiddify.
Outage or blocking?
An outage looks like unpredictable dropouts for some users across different operators: the server went down, the provider has an incident, or a specific service is overloaded. After an hour or two, it comes back by itself.
Protocol blocking is different: the symptoms are stable and clearly tied to the protocol. Basic WireGuard fails to connect at scale on one operator, while the same server works over VLESS-REALITY. That is already a signature on TSPU. You should change the protocol, not the service.
What to pay attention to
- Do not tie yourself to one protocol: TSPU rules change, so keep a backup of 2 different ones.
- UDP protocols (WG, Hysteria2, TUIC) require the operator to pass UDP to the required port.
- A REALITY server cannot be deployed “just anywhere” — it needs an external domain whose TLS it mimics.
- Use OpenVPN and L2TP today only if there are no other options.
- Speed depends not only on the protocol, but also on the quality of the VPS link and the ping to the server.
- “One universal client” for all protocols: Hiddify, Streisand, NekoBox, v2rayNG.
- Real DPI resistance is always determined by exactly how the server is configured, not only by the protocol name.
Conclusion
The era of “one VPN for every use case” ended with the arrival of mass DPI. Modern circumvention is built on protocols that either mimic HTTPS (VLESS-REALITY), run on QUIC (Hysteria2, TUIC), or at least add noise to their handshake (AmneziaWG).
If something does not work, do not rush to blame the service: more often, the protocol itself is to blame. Understanding the differences between them saves a lot of diagnostic time.