VPN obfuscation is the technique that hides the fact that you are using a VPN at all. Encryption hides what you send; obfuscation hides that you are sending it through a tunnel, which is a different problem with different solutions.
That distinction matters because a network can block a VPN without ever reading your traffic. It only needs to recognise the shape of a VPN connection and drop it. Obfuscation exists to make that recognition fail.
Three approaches dominate: Shadowsocks, Stealth and SoftEther. Here is how each one works, and which your provider is likely running.
How Networks Spot a VPN in the First Place
Blocking a VPN starts with detecting one, and networks have four reliable ways to do it. Understanding them explains why three separate obfuscation methods exist instead of one.
The first is deep packet inspection, which examines the structure of your traffic, not its contents. A WireGuard or OpenVPN connection has a distinctive shape, and a filter trained on that shape spots it immediately without decrypting anything.
The second is port blocking. VPN protocols default to recognisable ports, and closing those ports stops a connection before it starts. The third is handshake fingerprinting, where the initial exchange between client and server carries a signature the network learns to match.
The fourth, and the most aggressive, is VPN active probing. Here the firewall sends deliberately malformed test packets to a suspected server and watches how it responds. A VPN server replies differently than a web server would, and that reply confirms what it is.
Each obfuscation method below answers a different combination of those four.
Shadowsocks: Built to Look Like Nothing
Shadowsocks is an encrypted proxy protocol, created in China in 2012 specifically to get through the Great Firewall. It is not a VPN protocol, which is the first thing to understand about it.
- How it hides: a Shadowsocks proxy aims to look like unremarkable random traffic, with no handshake to fingerprint and no pattern to match
- Who runs it: Mullvad, as the basis for its bridge connections, plus many self-hosted setups
- Where it stops: it is a proxy, so it does not tunnel every app on your device by itself
Its origin shaped its design. Built by developers inside a heavily censored network, it was made to be lightweight, hard to classify, and cheap to deploy, which is why it survived years of active countermeasures.
Stealth: Wrapping the Tunnel in TLS
Stealth is Proton VPN’s obfuscation protocol, and it hides a VPN connection inside an ordinary-looking encrypted web session. The technique is TLS tunneling.
- How it hides: wraps the tunnel in TLS on port 443, so a filter sees what looks like a browser talking to a website
- Who runs it: Proton VPN, on paid plans only, not the free tier
- Where it stops: TLS is the only card it plays, so a network scrutinising 443 closely leaves it nowhere to go
Because every secure website uses TLS, blocking that traffic wholesale would break normal browsing. Proton built Stealth to defeat both deep packet inspection and active probing, since a probed server answers the way a TLS endpoint should.
SoftEther: HTTPS With Somewhere Else to Go
SoftEther is an open-source VPN protocol from an academic project at the University of Tsukuba, released under the Apache 2.0 licence. Its obfuscation starts where Stealth does and then keeps going.
- How it hides: tunnels through HTTPS on port 443, then falls back to ICMP or DNS when 443 is watched
- Who runs it: GnuVPN, in-app, alongside four other protocols
- Where it stops: heavier overhead than a scrambled WireGuard connection, so it is the tool for the hard cases
Those two fallbacks are the difference. ICMP and DNS are protocols almost no network dares block completely, which is why SoftEther has a reputation for getting through filtering that stops everything else.
GnuVPN, SoftEther, and AmneziaWG run together in one app, and the pairing is deliberate. SoftEther handles hostile networks, while AmneziaWG scrambles a WireGuard signature to defeat fingerprinting while keeping its speed.
Which One Your Provider Is Actually Running
Most providers pick one method and build on it, so the practical question is which. Here is where the main names stand, starting with the only one running two:
- GnuVPN runs SoftEther and AmneziaWG. GnuVPN obfuscation protocols come as a pair: HTTPS tunnelling with ICMP and DNS fallback for hostile networks, plus a scrambled WireGuard signature at close to WireGuard speed for everyday cover.
- Proton VPN runs Stealth, its TLS-tunneling protocol, on paid plans only.
- Mullvad uses Shadowsocks as the basis for its bridge connections.
- Surfshark runs Camouflage Mode, built on OpenVPN, which disguises traffic as HTTPS but ties obfuscation to that one protocol.
- NordVPN developed NordWhisper, wrapping traffic in web tunnels, available on Windows, Android and Linux.
Where the others give you a single method to work with, GnuVPN lets you switch between a heavy option and a fast one depending on what the network is doing.
Obfuscation Is a Moving Target
Obfuscation is not a feature you buy once and forget. Censorship systems study the methods that beat them, characterise the traffic, and adapt, which is why providers keep revising their protocols. Shadowsocks survived by looking like nothing, Stealth by looking like the web, and SoftEther by having somewhere else to go when both are watched.
The practical lesson is to weigh how many routes a provider actually gives you, because a single method is a single point of failure. GnuVPN’s pairing of SoftEther and AmneziaWG is a hedge against that cycle, not an escape from it.
FAQ
What is VPN obfuscation?
What is VPN obfuscation comes down to concealment of the tunnel itself. Encryption hides the contents of your traffic; obfuscation hides the fact that a VPN is being used, by making the connection resemble ordinary internet activity. Networks that block VPNs rely on recognising them, and obfuscation defeats that recognition.
How does VPN obfuscation work?
Three main ways. How does VPN obfuscation work depends on the method: Shadowsocks makes traffic look like random noise with no signature, Stealth wraps the tunnel in TLS so it resembles a web session, and SoftEther tunnels through HTTPS with ICMP and DNS as fallbacks. All three aim to make a filter classify the connection as something ordinary.
Is Shadowsocks a VPN?
No. Shadowsocks is an encrypted proxy protocol, not a VPN protocol. It routes and encrypts traffic for configured applications, but it does not create a full device-wide tunnel on its own. Providers using it generally pair it with a VPN instead of offering it as a replacement.
Does obfuscation slow down a VPN?
Usually a little. Obfuscation adds a processing layer on top of the tunnel, and heavier methods cost more than lighter ones. A scrambled WireGuard connection stays close to normal WireGuard speed, while HTTPS tunnelling through obfuscated servers carries more overhead. On a network that would otherwise block you entirely, the trade is worth it.
Can obfuscation be detected?
Sometimes, eventually. Sophisticated systems use deep packet inspection, VPN analysis alongside traffic timing and volume patterns, and no method is permanently invisible. Censorship systems and obfuscation techniques evolve against each other, which is why providers update their protocols and why having more than one method available is useful.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
