Which VPN Protocol Should You Use?

On a narrow screen the table scrolls sideways. Every transport ends at the same exit node, and websites see that node's IP address whichever one you use.

Every node offers it and nearly every app runs it. The connection is a real TLS 1.3 handshake on port 443 that borrows a large website's name and certificate; a probe that knocks on the node gets that website. It has the lowest latency and is the right first choice. It fails when the node's address is blocked or only approved services are reachable. More on VLESS Reality

QUIC over UDP with Salamander, which scrambles every packet so no QUIC header or server name is visible. It copes best with lossy mobile links and gets through where long TCP sessions are throttled. It does not connect at all where UDP is blocked, which is common on mobile and corporate networks. More on Hysteria2

The same REALITY handshake as Reality, but the traffic moves as separate HTTP requests and responses instead of one long stream, for networks that flag long, steady TLS sessions. It needs an Xray-core app and uses its own TCP port, so it fails where only ports 80 and 443 are open. It is not fronted by a CDN: your app connects to the node. More on XHTTP

Your app joins a video call on a major video-conferencing service and the node sits in the same call, so your device never contacts the node. It works where only approved services are reachable, and it carries UDP, so calls and games work. It is the slowest of these, each node takes only a few olcRTC users at a time, and it needs an app that implements olcRTC, such as Ghostlane. More on olcRTC

1. Start with Reality.
2. If Reality is slow or keeps getting cut and UDP works on your network, try Hysteria2.
3. If UDP is blocked too, try XHTTP.
4. If none of them connect, or only a few approved services are reachable, use olcRTC. If foreign addresses are blocked outright, a 2-hop route through an entry node also helps the first three.

You do not need a new link to switch. In the dashboard's Subscription URL block, set Transports in subscription to All and every route appears once per transport.

The list for Happ, Hiddify and V2RayNG carries Reality, Hysteria2 and XHTTP; the list for Ghostlane carries olcRTC too.

Each transport fails in a different place, so the setup that helps is the one where the next transport is a tap away. Ghostlane, an open-source client, runs Reality, Hysteria2, XHTTP and olcRTC in one app, and of the apps in the table it is the only one that runs olcRTC. On Android and on a computer its Smart connect checks an exit's transports before connecting and uses the first that gets through, ending on olcRTC in the same country.

Ghostlane open source

One app for VLESS Reality, Hysteria2, XHTTP and olcRTC, on iPhone, iPad, Android, macOS, Windows and Linux.

• macOS, Windows, Linux and the Android APKGitHub Releases
• Linux serversthe ghostlane command: apt, dnf, Docker

Apple, the Apple logo, iPhone and iPad are trademarks of Apple Inc., registered in the U.S. and other countries and regions. App Store is a service mark of Apple Inc. Google Play and the Google Play logo are trademarks of Google LLC.

If you already use Happ, Hiddify, V2RayNG or Streisand, keep it: it goes on working for the transports it runs (the Apps row of the table says which), and the guides for Hiddify and V2RayNG cover the setup. Ghostlane setup, step by step

Both are fast, well-studied VPN protocols, but neither was built to hide. Each opens with a fixed, recognisable handshake, and filters in several countries block them by that signature. ProofKit therefore does not offer them to your device. WireGuard appears only inside a 2-hop route, as the default tunnel between the entry and exit nodes (other tunnel types are used where it is blocked); your traffic inside it is already encrypted by the transport you connected with.

The transport changes how your traffic looks. Reality, Hysteria2 and XHTTP cost the same: the node's per-GB price plus the 20% network fee, locked when you connect, from your TON deposit in escrow. olcRTC costs the same until 20 November 2026; from then on it has one network-wide price per GB, read when the traffic moves and starting at 0.0208 TON (about $0.03). The olcRTC page lists the steps. Unused balance can be withdrawn.