Hysteria2 VPN With Salamander Obfuscation

Plain QUIC is easy to recognise: its first packet carries a version field and a TLS handshake with the server name in it. Salamander scrambles every packet, that first one included, with a key made from the password in your link and a fresh random salt per packet. A filter sees UDP datagrams of random-looking bytes: no QUIC header, no handshake, no server name to read.

Instead of trusting a certificate authority, your app checks the node's self-signed certificate against the fingerprint in your link (pinSHA256), so a machine in the middle cannot pose as the node.

• TCP is throttled, UDP is not. Some networks slow down long TCP sessions to foreign servers but leave UDP alone.
• Lossy or long links. QUIC recovers from packet loss better than TCP, so Hysteria2 often moves more data on mobile networks and over long distances, at a little extra latency.
• Reality is being flagged. If a filter has learned to single out Reality on your network, Hysteria2 looks nothing like it.

• UDP blocked or throttled. Many mobile and corporate networks block or slow UDP. Then Hysteria2 does not connect at all: use Reality or XHTTP, which run over TCP.
• Unknown UDP treated as suspect. Random-looking traffic has no signature to match, but some filters throttle any UDP they cannot classify.
• Address blocks. Like Reality and XHTTP, it connects straight to a node's IP address. If that is blocked, use a 2-hop route through an entry node, or olcRTC.

Hysteria2 listens on a UDP port of the exit node, 443 by default. On a 2-hop route the entry node forwards your UDP packets unopened to the exit over the tunnel between the two nodes; the QUIC session ends at the exit. Your app signs in with the same personal ID it uses for Reality.

Hysteria2 runs in Happ, Hiddify and V2RayNG. The dashboard's list for those apps carries Reality only until you change it:

1. Connect to a node in the marketplace.
2. In the dashboard, open Subscription URL, set Your app to Happ · Hiddify · V2RayNG and Transports in subscription to All (every transport as its own entry) or Hysteria2.
3. Copy the URL, add it as a subscription and pick an entry ending in · Hysteria2.

The Config button on each session in the dashboard also shows a Hysteria2 link and QR code for that one route.

Nothing extra. Hysteria2 uses the same per-GB price as Reality and XHTTP: the node's price plus the 20% network fee, locked when you connect and paid from your TON deposit in escrow. Only olcRTC has a price of its own, from 20 November 2026. Unused balance can be withdrawn.