Press play to start listening
A VPN that works perfectly at home can stop working the moment its user lands in a country with a national firewall. The encryption hasn’t changed. Nobody has broken AES or cracked a WireGuard key. The tunnel is just as secure as it was the day before, and it still gets blocked within minutes.
That’s because a VPN hides what you send, not that you’re using a VPN. Censors don’t need to read your traffic to stop it. They read everything around it: the handshake that opens the connection, the size and timing of packets, the reputation of the server’s IP address, and how that server responds when someone else knocks on its door. Detecting VPN traffic is a contest over signals, not encryption strength, and the people building national firewalls have become very good at reading those signals.
The detection stack, from cheap to expensive
Network operators don’t rely on a single technique. They layer methods, usually starting with the cheapest and adding more expensive ones as their budget and motivation allow.
- IP reputation and blocklists. The simplest approach is to block the addresses VPN servers live on. Commercial VPNs run thousands of servers, but they sit in known datacenter ranges, and IP intelligence databases track which addresses belong to which providers. Streaming services and banking sites rely on this layer too, which is why a VPN can be “detected” by a website that never inspects a single packet.
- Port and protocol blocking. Many networks simply drop traffic on ports they don’t expect, or block UDP outright. OpenVPN defaults to UDP port 1194, and WireGuard has no mandatory port and uses UDP. Some providers carry its traffic inside an additional transport to get through network restrictions. Moving a VPN to TCP port 443, the port used by HTTPS, gets past a basic port filter. It isn’t a disguise, though. Port 443 tells a firewall where the traffic is going, not what it is.
- Deep packet inspection (DPI). DPI looks at the structure of the traffic, and the major VPN protocols are easy to recognize. WireGuard’s handshake uses fixed message types and sizes: the initiation message is always 148 bytes and the response is always 92. OpenVPN leaves telltale patterns in its packet headers.
- In a USENIX Security 2022 paper, researchers combined passive traffic analysis with active probing. Working with an ISP serving about a million users, they identified more than 85% of OpenVPN flows with negligible false positives. Their method also identified connections using 34 of the 41 obfuscated VPN configurations tested.
- TLS fingerprinting. Plenty of circumvention tools wrap their traffic in TLS so it looks like ordinary HTTPS. But the TLS handshake carries its own fingerprint: the cipher suites offered, the extensions requested and the order they appear in. A Chrome browser, a Python script and a VPN client all build that handshake differently. A firewall that expects to see browsers and sees something else has a reason to look harder.
Active probing requires the censor to make additional connections to suspected servers and examine their responses. When a censor suspects a server is a proxy, it connects to that server itself and sends test traffic to see how it reacts.
A real web server answers like a web server. A poorly built proxy might hang, reset the connection or respond in a way no normal website would. China’s Great Firewall has used active probing for years to discover hidden Tor bridges and Shadowsocks servers.
Each layer looks for a different clue, which is why fixing one problem rarely fixes the whole thing. Moving to port 443 beats a port filter but not DPI, and a clean IP address beats a blocklist but not a protocol fingerprint.
For a practical explanation of options such as changing ports and enabling obfuscation, this guide to making your VPN harder to detect discusses common approaches. Their effectiveness depends on how the network identifies and blocks connections.
For years, the standard advice for beating DPI was to make traffic look like nothing at all. Protocols like Shadowsocks, VMess and obfs4 encrypt every byte, including the handshake, so the stream looks like uniform random noise with no headers or fingerprints to match.
In November 2021, China’s Great Firewall turned that idea on its head. A USENIX Security 2023 study of how the Great Firewall detects and blocks fully encrypted traffic found that the censor had stopped trying to identify those protocols directly. Instead, it used simple, cheap rules to exempt traffic that was unlikely to be fully encrypted, and treated everything else as suspect.
The system allowed traffic that resembled recognised protocols such as TLS or HTTP, or met other exemption rules. Those rules examined the proportion of set bits and the number and position of printable ASCII characters in the first TCP data packet. Connections that did not qualify for an exemption could trigger blocking.
During their measurements, the researchers observed blocking focused on selected hosting-provider IP ranges, with a roughly 26% probability of a qualifying connection triggering it. Separately, applying the inferred detection rules to university network traffic would have classified about 0.6% of TCP connections for blocking. That simulation did not apply the firewall’s restrictions on destination ranges or sampling.
The lesson for anyone designing or relying on circumvention tools is uncomfortable. Randomness is itself a signal. On an internet where almost everything starts with a recognizable handshake, a connection that starts with nothing stands out.
How circumvention tools adapted
The response has been to stop looking like nothing and start looking like something ordinary.
- TLS mimicry. Many VPN providers now offer “stealth” or obfuscated protocols that wrap the tunnel inside traffic built to resemble a normal HTTPS session. Proton VPN’s Stealth protocol, launched in October 2022, uses obfuscated TLS tunneling over TCP, and Proton says it is more censorship-resistant than simply running a VPN over port 443, because DPI can still recognize a VPN handshake on any port. Some newer tools go further and borrow the TLS identity of a real, popular website, so that even an active probe gets a legitimate-looking reply.
- Wrapping WireGuard instead of replacing it. WireGuard is fast and well audited, but its fixed handshake makes it easy to spot. Rather than abandon it, providers wrap it inside other transports. Mullvad, which shut down OpenVPN support on January 15, 2026, now relies on anti-censorship methods that carry WireGuard over other protocols, including QUIC and Shadowsocks, so the network sees the wrapper rather than the WireGuard handshake underneath.
- Rethinking older obfuscation. The 2021 findings changed the calculation for plain Shadowsocks in particular. It is still useful on networks that only filter ports or match protocol signatures, but on a network running the Great Firewall’s entropy rules. These findings show why plain Shadowsocks can be blocked even without a conventional protocol signature. TLS mimicry offers another approach, but its effectiveness depends on the implementation and the network’s detection rules.
None of these approaches is permanent. Each one removes a signal the censor currently relies on, and each invites the censor to find a new one.
The same playbook runs on corporate and campus networks
National firewalls get the headlines, but scaled-down versions of the same stack run on office and university networks every day. Next-generation firewalls identify applications by behavior rather than port, flag known VPN protocols with DPI, and block datacenter IP ranges on guest Wi-Fi.
For security teams, that cuts both ways. The visibility that lets a firewall spot an unsanctioned VPN also exposes how much a network can infer about encrypted traffic without decrypting it. For users, it means “the VPN connected” doesn’t mean “the VPN went unnoticed.” A connection can be allowed through and still be logged as VPN traffic.
The legal and practical reality
Some countries restrict or ban VPN use, and in those places hiding a VPN can carry legal consequences that go well beyond losing a connection. On corporate and school networks, bypassing controls can break acceptable-use policies even where it breaks no law.
Practically, well-funded censors update their rules continuously. A setup that works this week may fail the next, and the more resources a network operator puts into detection, the shorter that window becomes.
Conclusion
VPN detection isn’t about breaking encryption. It’s about reading everything encryption leaves exposed: addresses, ports, handshakes, entropy and behavior under probing. The Great Firewall’s move against fully encrypted traffic showed how a censor can turn a protocol’s greatest strength into its weakness with a few cheap heuristics.
The tools that survive in this environment are the ones that blend in with ordinary traffic rather than hiding from it. As long as censors keep adding signals and tool builders keep removing them, the arms race will continue, and it will be fought over metadata, not math.
A VPN can protect the contents of a connection while leaving enough visible information for a network to identify or block it. Obfuscation can reduce some of those signals, but a successful connection does not prove that VPN use went undetected.
