What Is VPN Obfuscation?

VPN obfuscation is an advanced security feature that hides the fact that you are using a VPN to reroute your traffic. It can help to bypass firewalls, avoid blocks by governments or ISPs, and evade detection by deep packet inspection (DPI).

Internet restrictions are often implemented by governments during important political events, or to censor the internet of political, religious, or sexual content. Some schools and workplaces also implement firewalls to keep students safe or protect their networks from malicious attacks.

This guide is a summary of the most important features, benefits, and disadvantages of VPN obfuscation. It will help you decide when to use VPN obfuscation, how to enable it, and which obfuscated VPN to choose. We’ll also explain the different types of obfuscation and exactly how they work.

VPN obfuscation refers to a set of advanced features that disguise your VPN traffic as normal HTTPS, UDP, or TCP web traffic. This allows you to get past a VPN blocker and connect to a VPN, even in countries with highly restricted internet.

Obfuscation can require complicated configuration and resources, which means it’s only offered by some VPN services.

Importantly, not all obfuscation tools work in the same way. There are several different methods to bypass VPN blocks, some of which are more effective than others. The most common obfuscation techniques include Shadowsocks proxies, OpenVPN over TLS, SSTP, and OpenVPN Scramble.

When you connect to a normal VPN server, your ISP can’t see what you’re doing online because a secure and encrypted tunnel is created. However, it can see that you are using a VPN from the way your data looks. Your traffic might have recognizable encryption patterns, or it might be using well-known VPN service ports that give it away.

When you connect to a VPN using obfuscated servers or protocols, it will change the way your data packets look. As a result, your ISP won’t be able to detect you’re using a VPN and will let you pass a strict VPN block.

When obfuscation is implemented, the VPN signature and other signs of a VPN connection disappear. Deep packet inspection can no longer tell that you’re using a VPN and you have access to the unfiltered internet.

If you’re in an environment with strict online restrictions, such as the UAE or Turkey, this will let you access the internet and unblock restricted websites without your ISP or government being alerted to your web activity.

To show this, we used deep packet inspection software called WireShark to examine our VPN traffic with obfuscation enabled and disabled.

Here’s a screenshot of our VPN traffic without obfuscated servers, protocols, or proxies:

Here’s a screenshot of our VPN traffic after connecting to an obfuscated VPN server:

Without obfuscation, the packet inspection software was able to detect both WireGuard and OpenVPN protocols – exposing our connection to a VPN service. With obfsproxy obfuscation enabled, Wireshark was unable to pick up on the VPN protocol that was being used. Instead, it only detected a TCP connection.

What Are Obfuscated Servers?

Obfuscated servers are specialized servers that camouflage your VPN connection. They make it more difficult for your ISP or national government to detect your VPN connection.

Your ISP might use DPI to inspect the data packets on their network. If so, they would be able to see what you’re doing online, including whether you are torrenting or streaming.

Depending on the country you’re based in and the laws that apply, your ISP might be selling this data to third-party advertisers or reporting your activity to the authorities and other government agencies.

Are Obfuscated Servers Slower?

Obfuscated servers apply extra layers of encryption and code, which can slow down your internet connection.

In our obfuscation speed tests, we found that every VPN’s speed is affected differently by obfuscation technology.

In general, the VPNs that are best at bypassing firewalls (Astrill VPN, ExpressVPN, and Windscribe VPN) have fast to average speeds – even with obfuscation enabled.

As you can see in the table above, connecting to an obfuscated server reduced the speeds of every VPN we tested. However, there are large fluctuations in exactly how much they were affected.

For example, Surfshark and ExpressVPN experienced minimal speed loss when connecting to short and long distance servers with obfuscation enabled. In contrast, PIA’s speeds dropped from 88Mbps on a local US connection to a disappointing 15Mbps on a long-distance UK connection.

We found that Surfshark had the most impressive download speeds. With NoBorders mode enabled, our speeds only dropped by 1% when connected to a local server.

However, there is a trade off: Surfshark is incredibly bad at bypassing the Great Firewall of China. In the past year, Surfshark has successfully circumvented the Great Firewall of China just 35% of the time, which suggests it’s only so fast because it’s not doing a great job at obfuscating its connection.

Every VPN has its own obfuscation technology that works in different ways. If speed is your main concern, we recommend using Surfshark, Astrill VPN, or ExpressVPN.

Is Obfuscation 100% Reliable?

VPN obfuscation technology is not 100% reliable. In fact, some VPN services go through regular cycles of working and then failing to successfully obfuscate your VPN connection and bypass firewalls.

However, as long as the VPN has a strong no-logs policy and is based outside the 14 Eyes Alliance, your IP address and online activity will be safe from prying eyes.

To further mitigate risks associated with your VPN traffic leaking, we recommend using a VPN with a working kill switch, too.

Many VPN services offer obfuscation technology, but only a few have effective features that effectively hide the fact you’re using a VPN, circumvent firewalls, and facilitate torrenting in countries with restrictions.

Here’s a table comparing our VPN recommendations with the best obfuscation features and technology:

VPNs use different obfuscation and stealth techniques to disguise their traffic, including different VPN connection protocols and proxies. The most common obfuscation methods are listed below:

• Shadowsocks
• SoftEther
• OpenVPN over SSL/TLS
• SSTP
• Obfsproxy
• OpenVPN/XOR Scramble
• V2Ray/VMess

Shadowsocks

Pros	Cons
Open-source	No official audit
Fast speeds	No port forwarding
Uses less RAM

Shadowsocks is a free and open-source obfuscation proxy protocol. The protocol was created in 2012 by a Chinese programmer named clowwindy, and is widely used by people in China to circumvent government censors without being detected.

Loosely based on the Socket Secure 5 or ‘SOCKS5’ protocol, Shadowsocks is a proxy that reroutes your internet connection through a third server, making it look like you’re in a different location. It also hides your VPN traffic by making it look like HTTPS traffic.

It’s important to note that regular proxies are unsafe because they do not encrypt your traffic. To combat this, Shadowsocks uses an AEAD cipher – similar to SSH tunneling – to encrypt your web traffic and prevent it from being read by your ISP.

AEAD is a form of encryption that allows a recipient to check the authenticity and integrity of data. It is associated with the industry-standard AES encryption cipher and makes up part of its cipher suites.

Unfortunately, Shadowsocks is not a common feature in VPN services because the setup process is complicated for both the VPN provider and users.

SoftEther

Pros	Cons
Open-source	Extremely rare in VPN services
Great for bypassing online censorship and restrictions	Requires manual configuration to be safe
Incredibly fast speeds	Vulnerable to man-in-the-middle-attacks

SoftEther VPN is an open-source, multi-protocol VPN software created by Daiyuu Nobori in Japan. SoftEther VPN runs on Windows, macOS, Linux, FreeBSD, and Solaris. Once implemented, it can create fast, low-latency connections that can circumvent sophisticated firewalls.

SoftEther’s VPN protocol uses Ethernet over HTTPS (HTTP over SSL) to establish a VPN tunnel. This works well to bypass firewalls because HTTPS is the industry standard for secure communications across the internet, which makes it difficult for ISPs and governments to detect.

SoftEther’s VPN software is not only compatible with its own protocol – it also supports OpenVPN, L2TP/IPSec, L2TPv3, and EtherIP protocols.

The protocol works by dividing all TCP connections into two groups. The first group is designated for uplink and the second group is only for downlink. This segregation helps to fool any firewall and DPI into thinking the connection is a typical HTTPS connection.

A sophisticated firewall is able to detect an abnormally long TCP connection. To combat this, SoftEther VPN connections also set a time limit for all TCP connections, which forces them to terminate before they are detected.

Despite its good qualities, SoftEther has notable downsides. Mainly, it’s only available on Hide.me. A majority of VPN services have unfortunately avoided SoftEther because of its extremely complicated setup process, which is both convoluted for VPN providers and their customers.

In 2019, researchers discovered two vulnerabilities in Hide.me’s implementation of SoftEther. Firstly, the client did not verify the server’s certificate. This meant that a network attacker could perform a man-in-the-middle-attack and obtain the victim’s credentials and network traffic.

Secondly, Hide.me’s back-end management interface did not require password authentication, which also exposed users to man-in-the-middle attacks.

OpenVPN over SSL/TLS

Pros	Cons
Open-source software	SSL is more common but outdated
TLS 1.3 was updated in 2018	Difficult to configure manually
Commonly used by VPNs

OpenVPN over SSL (Secure Sockets Layer) or TLS (Transport Layer Security) is a combination of the OpenVPN protocol and a layer of SSL or TLS encryption. It’s designed to hide the fact that you are using a VPN from your ISP.

In order to implement OpenVPN over SSL/TLS obfuscation, the VPN service will have to use Stunnel, another type of open-source software. However, many VPNs are put off by the complexity of the setup process.

OpenVPN over SSL/TLS provides robust encryption, but it’s not suited to the individual user. It’s very rare to find a VPN that has SSH or SSL enabled and none of the top-rated VPNs have it configured.

SSTP

Pros	Cons
Effective at bypassing firewalls	Closed-source
AES-256 encryption	Dubious links with the NSA
Fast speeds

Secure Socket Tunnel Protocol (or SSTP) is a secure VPN protocol developed and owned by Microsoft. It’s supported on Windows, Linux, Android, and a variety of routers. SSTP was made in 2007 to replace the very outdated and vulnerable PPTP protocol.

SSTP used to be vulnerable to Man-in-the-Middle (or Poodle) attacks, where an attacker redirects your web traffic or injects malicious content into an existing data packet. Nowadays, SSTP is secure because it’s implemented using TLS 1.2 and 1.3, whereas Poodle attacks relied on SSL3.

Unfortunately, SSTP is only available with a few VPNs out of the 62 we’ve tested. Hide.me is the only VPN in the top 10 which offers SSTP – since IPVanish discontinued it in 2022.

The fact of the matter is the VPNs that work best against censorship have dropped the protocol and moved onto more sophisticated systems.

It’s now a protocol that’s also commonly used in Windows 10 for people working away from the office that want to safely connect to their corporate network.

There are also dubious links found between Microsoft and the NSA established by Edward Snowden in 2013. For example, it was revealed that Microsoft helped the NSA to circumvent its encryption to intercept web chats on Outlook.com.

Obfsproxy

Pros	Cons
Completely random patterns of handshake	Obfsproxy traffic stands out in comparison to other protocols
Requires less bandwidth	Difficult to set up for the VPN service and servers

Obfsproxy, short for Obfuscation Proxy, was originally adopted by the Tor community to obfuscate Tor traffic and hide their internet activity from their ISP.

Obfsproxy works by using obfs2, obfs3, scramblesuit, obfs4, or meek to implement an obfsproxy tunnel that your VPN traffic is routed through. It also adds an extra layer of encryption. It’s lightweight and uses less bandwidth, but this also makes it less secure.

Scramblesuit, obfs4, and meek are currently the only protocols with obfsproxy that we would recommend using to bypass censorship, as the others are out of date and easily detected by DPI.

It’s rare to see a VPN adopt this technology because it’s extremely difficult to set up. However, we see some VPN services adopt it due to its success rate at bypassing firewalls and circumventing censorship.

Obfsproxy can disguise your Tor or OpenVPN traffic as any type of traffic you would like. However, it’s not always guaranteed to bypass firewalls and DPI because it does have some recognizable patterns.

A majority of protocol handshakes are very clearly defined, and easily recognizable. And so, obfsproxy traffic stands out because it looks like completely random data in comparison. ISPs can use entropy tests, which analyze the randomness of data, to potentially identify obfsproxy traffic.

It’s used to circumvent online firewalls and was created for people in China, Iran, or Russia, where there are strict online censors.

OpenVPN/XOR Scramble

Pros	Cons
Open-source	Weak encryption keys
	Sometimes can’t bypass sophisticated firewalls
	Hackers use XOR to hide malware

OpenVPN Scramble, or XOR obfuscation, is a third-party patch for OpenVPN that adds an extra layer of obfuscation.

It works by applying the bitwise XOR cipher, a substitution-based algorithm, to OpenVPN traffic. This replaces each character in a data string and disguises the fact it is OpenVPN traffic. OpenVPN Scramble will make your VPN traffic look like UDP traffic.

This type of VPN obfuscation has two major downsides. First, it can be easily deciphered by reapplying the same XOR cipher with the key to the data string. This makes it one of the least secure methods of obfuscation on this list.

Secondly, it can be an unreliable tool for bypassing online firewalls and censors. As mentioned in our IPVanish tests, its scramble features have been failing in our weekly tests to circumvent the China firewall.

However, StrongVPN’s implementation of OpenVPN Scramble is very effective at bypassing the Gret Firewall of China.

Overall, OpenVPN Scramble provides a low level of security and rudimentary obfuscation compared to some other tools.

V2Ray/VMess

Pros	Cons
Highly customizable	Extremely rare in VPNs
	Complicated implementation for VPN providers
	Hasn’t undergone a security audit

V2Ray is an open-source platform and subsection under Project V, where any developer can use a protocol called VMess to develop new proxy software.

Both Shadowsocks and V2Ray were created with the specific aim to help people in China circumvent the Great Firewall. However, Shadowsocks is designed to make the process as simple as possible, whereas V2Ray has a much more complicated configuration process.

VPN.AC is the only VPN we’ve reviewed that has implemented V2Ray tunneling. The feature is available in its native Windows app, but not in macOS or mobile versions. It can be found in advanced settings.

In our tests, enabling V2Ray on VPN.AC caused our VPN connection to drop and sometimes blocked us from connecting to the VPN server altogether.

As you can see in the image above, you can choose between a direct connection through VPN.ac’s obfuscation proxy servers, or a connection to VPN.ac’s proxy servers through Cloudflare.

Obfuscated servers and protocols aren’t necessary for everyone. They can be inconvenient to enable every time you access the internet, and they can also be complicated to configure.

However, there are some specific cases where VPN obfuscation technology is needed or very useful. Most importantly, you should use obfuscated servers if you’re a regular torrenter, journalist, or a person living in a country with internet restrictions.

Here’s a brief summary of when you should use VPN obfuscation:

1. For Increased Privacy and Security

Journalists and political activists often need unrestricted access to the internet. This way they can freely research, share information, and securely communicate with contacts.

If you deal with sensitive information on a regular basis and you’re based in a country with online firewalls, having a reliable VPN with obfuscation is essential.

Otherwise, regulators using deep packet inspection could identify your web activity or VPN use and flag you as a target for surveillance.

2. To Bypass Online Censorship

Internet censorship is the control or suppression of information and media published on the internet, often authorized by governments regulators. Network companies may also engage in self-censorship for business or moral reasons.

Online censorship can occur through site blocking, content filtering, and complete internet shutdowns. It occurs more often in anticipation of political events such as elections, protests, and riots.

For example, Russia has banned Instagram, Twitter, Google News, BBC News, and many more websites in 2022. As a result, demand for VPNs that work in Russia rose by more than 2,500% between the months of February and March.

VPNs are excellent at encrypting your data, unblocking websites, and hiding your activity from your ISP, but they are also easy to detect. If you live in a country that bans or punishes the use of VPN services, VPN obfuscation is necessary to bypass these website blocks and firewalls without being detected.

3. For Torrenting & P2P Activity

Some torrenting VPNs offer both P2P servers and obfuscated servers separately. Choosing between a P2P or obfuscated server for torrenting will depend on your location.

If you’re based in a country where torrenting is legal or allowed for personal use, we recommend using a VPN with a no logs policy and P2P-optimized servers.

However, if you’re based in a country with strict online firewalls and restrictions, we recommend using a VPN with inbuilt obfuscation, or a VPN with an obfuscation protocol and P2P-optimized servers.

In some cases, it’s best to use a combination of an obfuscated protocol and a P2P-optimized server:

Here’s a brief summary of when you should not use VPN obfuscation:

1. If Your Internet Speeds Are Slow

VPN obfuscation will slow down your internet connection speed. Obfuscating your VPN connection involves additional algorithms, codes, and layers of encryption, which means the data packets themselves become larger and take more time to travel between servers.

If you don’t have a high-speed internet connection, obfuscation can crash your online activities or cause lag.

2. To Bypass Geo-Restrictions on Streaming Services

Streaming services like Netflix actively scan for VPN traffic. If they identify a VPN or proxy user, they may block that user from the platform or restrict them to certain titles.

In theory, a tool that hides the fact you are using a VPN should be beneficial for unblocking streaming services.

In reality, we found in our VPN streaming tests that obfuscation protocols and servers didn’t increase the likelihood of bypassing geo-blocks on streaming services.

We also discovered that VPN obfuscation can actually hinder your streaming experience as it can slow down your internet connection, causing your video to buffer or lag.

Here’s a video showing you how to enable obfuscated servers. We’ve used VPNArea as an example:

Unless you’re in a region with highly restricted internet access, we recommend turning off obfuscation and switching to a normal VPN connection to reach the best speeds and performance.

Once you’ve enabled obfuscated servers or switched to an obfuscation protocol, you should be able to browse the internet without restrictions.

If you’re still encountering blocked pages or internet throttling, try the following instructions to continue accessing the open internet:

1Connect to the Nearest Obfuscated Server

The further away you are to a server, the slower your connection will be. If you’re having trouble connecting to an obfuscated server or you are experiencing slow speeds, try connecting to a server nearest to your physical location.

For example, if you’re based in China and trying to circumvent the Great Firewall, try VPN servers in Hong Kong, Taiwan, Japan, or South Korea. These are often the servers with the best results.

Alternatively, if you’re based in Russia, try connecting to servers in Latvia, Poland, Ukraine, or Finland.

2Use a Different Obfuscation Tool

Some VPNs offer more than one obfuscation feature, such as multiple stealth or cloaking protocols and proxies. It’s possible that one receives more resources than the other and therefore does better at obfuscating your VPN connection.

We recommend using a VPN’s newest obfuscation feature, as this one will often have more advanced and up-to-date technology.

Some VPNs offer more than one obfuscation feature, such as multiple stealth or cloaking protocols and proxies. It’s possible that one receives more resources than the other and therefore does better at obfuscating your VPN connection.

3Update Your VPN App

It’s possible the version of the VPN app you are using has been recently updated with a patch. Try checking in the VPN’s settings or the app store where you downloaded it from to see if the app is due a software update.

It’s also possible that the VPN app you downloaded isn’t the most optimized version. In which case, contact the VPN service’s customer support to find out which version is recommended for its obfuscation technology.

4Reinstall Your VPN App

If you’re an Android user, you can try uninstalling the VPN app from your device and downloading it again from the VPN’s official website. In some cases, VPNs might have different versions of the same app on the Google Play Store and on its website.

You can also contact customer support and ask for the best application version on your device.

5Subscribe to a Different VPN

Not every VPN can bypass sophisticated tracking and blocking systems. If you’ve tried all the methods above and your VPN obfuscation still isn’t working, we recommend switching to a different VPN that specializes in obfuscation.