Why some VPNs get blocked and others do not

Why VPN protocols get blocked

Millions of people use VPNs, for safety on public Wi-Fi, to get around regional blocks, or for privacy.

VPNs differ in the technology underneath, and that technology decides whether a connection gets through or gets detected and blocked.

Censorship is a technology too, and it improves over time. Methods that worked years ago are now easy to detect and shut down. Early protocols such as PPTP and L2TP date from the late 1990s, and today even basic filters can block them because their traffic follows predictable patterns.

Later protocols such as OpenVPN and WireGuard brought better reliability and stronger encryption. They still have a weak spot: a protocol fingerprint, a recognizable pattern that DPI (deep packet inspection) can use to tell that the traffic is a VPN and not ordinary HTTPS. A 2022 study identified over 85% of OpenVPN connections on a real network with a million users, with almost no false positives (USENIX Security ’22). Once a filter spots such traffic, it can block it or slow it down.

Each new wave of blocking produces new ways around it. Internet providers and state filters rely more and more on DPI, port blocking, certificate checks and analysis of how traffic behaves. Developers and enthusiasts respond with better ways to make a VPN connection look like legitimate traffic.

One of the tools that came out of that contest is Xray-core, an open-source proxy platform. It runs VLESS, a protocol, and Reality, a transport security layer, and it runs on both the client and the server. Used together, they make traffic much harder to tell apart from normal web browsing. The aim goes further than encryption: to most filters, the connection should look like an everyday visit to a website.

Unpacking the stack

Foundation: TCP and TLS

Think of the internet as a huge postal service: TCP is the reliable courier, and TLS is the sealed envelope.

• TCP is a reliable courier that collects a signature for every delivery, so nothing goes missing unnoticed.
• TLS is the encrypted envelope: anyone who intercepts it sees only that a sealed letter exists, not what is inside.

The basic idea is to put the VPN connection inside this familiar envelope so that it looks like normal HTTPS. Modern filters still catch a clumsy disguise, so the imitation has to copy how real browsers behave.

Xray: the camouflage workshop

In the postal analogy, Xray is the packing and sorting room, and there is one at each end: on your device, where outgoing parcels are prepared before they leave, and on the server, where they are unpacked. Technically, Xray-core is an open-source proxy platform: it runs the protocols described below and decides what happens to each piece of traffic. On the sending side it handles a parcel in three steps:

• Packs it: puts the traffic into a protocol and a transport, so it leaves in a plain box instead of an envelope stamped “VPN.”
• Sorts it: follows routing rules that decide which traffic goes through the tunnel and which goes directly to the website.
• Labels it: sets the visible details of the connection, such as the site name in the handshake and the browser it imitates, to match an ordinary browser visit.

Xray decides how each parcel is packed and sent. VLESS and Reality both run inside it, so it is the control center of the setup.

VLESS: the lightweight, inconspicuous courier

The parcel is packed and sealed with TLS. Now it needs a courier. Some couriers look suspicious and get stopped at the door. VLESS is a newer kind of courier that does not stand out.

Technically, VLESS is a lightweight, stateless protocol that identifies the user with a single ID and adds very little control data of its own. By default it does not encrypt anything itself, so it is meant to run inside TLS or Reality, which provide the encryption.

Inside that layer it adds no obvious VPN markers, so to an internet provider the session resembles a regular site visit. The disguise has limits. A TLS connection carried inside another TLS tunnel has a detectable shape, and a 2024 USENIX Security paper showed how to detect it. That is why newer modes such as XTLS Vision exist.

VLESS works well as the courier because it is light and fast and carries very little of its own that a filter could single out.

Reality: the main bypass technique

Reality is the clever part. Picture a guarded office building. A courier with a fake badge could be stopped at the entrance: the letter was sealed with TLS, but the courier still looked out of place.

With Reality, the courier walks in alongside the real employees, and the guard sees no reason to look twice.

What this means technically

With Reality, the connection opens the way a visit to a real, well-known website does. The client puts that site’s name in the SNI field of the TLS handshake and imitates the TLS fingerprint of a common browser such as Chrome. A filter that probes the server without the secret key is passed through to the real site and gets back its genuine certificate, so there is no fake certificate to catch.

Limits: an arms race with no guarantee

Very aggressive filters can use heavier methods, such as blocking whole ranges of IP addresses. In many cases Reality gives a filter no obvious reason to interfere, but this is an arms race and nothing about it is guaranteed. In 2025 users in Russia reported connections, including VLESS with Reality, being frozen after the first few kilobytes of data.

How Xray, VLESS and Reality work together

Each part has a specific job in getting past blocks, and together they form one mechanism:

• Xray-core is the foundation and control center. It runs on both the client and the server, carries the protocols and applies the routing rules.
• VLESS is the inconspicuous courier that carries traffic without obvious VPN traits. Inside TLS its sessions resemble regular web traffic, although the pattern of TLS inside TLS can still give them away.
• Reality is the camouflage that makes the connection look like a genuine visit to a popular website.

The connection is encrypted and also blends into ordinary web traffic, so a filter has little to single out.

Today a connection built this way is hard to tell apart from an ordinary site visit. Filters keep improving, though, and the 2025 reports from Russia show that a setup that works one month can be throttled the next.