Anti-censorship VPN: four ways through, and how to switch

• Protocol fingerprints. OpenVPN, WireGuard and IPsec have recognisable handshakes, and filters drop them on sight.
• Addresses and site names. Known server addresses are blocked, and encrypted connections are blocked by the site name they announce.
• Active probing. The censor connects to a suspicious server itself, to see whether it answers like a proxy.
• Behaviour. One long encrypted stream to a foreign server, or bytes that look like no protocol at all, can be slowed or cut without being identified.
• Whitelists and shutdowns. In the hardest cases only an approved list of services stays reachable, or connections abroad are cut entirely.

Each transport below answers some of these and fails against others. How it plays out in practice: Russia, Iran, China.

Direct: your app connects straight to the exit node abroad. It is the fastest and cheapest route, at the exit’s price plus the 20% network fee, and every transport the exit offers works on it. olcRTC traffic is the exception: from 20 November 2026 it has one network-wide price per GB, read when the traffic moves.

2-hop: your app connects to an entry node that stays reachable from inside your country, and the entry carries your still-encrypted traffic to the exit over a tunnel between the two nodes. It helps where connections abroad are throttled but domestic ones are not, and the exit sees the entry’s address instead of yours. It costs both nodes’ prices plus the fee, and works with Reality, Hysteria2 and XHTTP.

Which entry countries exist changes as nodes come and go; the marketplace lists them for every exit.

1. In your dashboard’s subscription block, choose your app and set Transports in subscription to All. The list for Happ, Hiddify and V2RayNG starts with Reality only; the list for an olcRTC-capable client can include olcRTC.
2. Add the subscription link to your app once. It refreshes itself, so new lines appear without new links.
3. In the marketplace, connect to two or three exits, and to a 2-hop route if there is one for your country. Each connection becomes a line in your app, and a line costs nothing until traffic flows through it.
4. When a line stops working, pick another: the same exit over a different transport, a different exit, or the 2-hop line.

App guides: Hiddify, V2RayNG. All protocols side by side: protocol comparison.

Censors block one address at a time. ProofKit’s exits sit in many countries, each with its own address, so a blocked address takes out one exit, not your access. The network is open: anyone can run a node, set its price and stake 1 TON on it. You pay per GB, so moving to another exit wastes nothing.

The marketplace shows each exit’s price and uptime before you connect, and the platform sends probe traffic through the nodes it lists to check that they carry what they report.

• No transport works everywhere or forever. Censors adapt, and a line that works today may not work tomorrow.
• During a full shutdown of connections abroad, no VPN gets through.
• olcRTC is slower than the other transports: a video call carries far less data than a direct connection.
• Hysteria2 needs UDP, and XHTTP needs an Xray-core app.

Rules on VPN use differ by country and change often. Check what applies where you are.