What Is VPN Obfuscation? (Stealth VPN Explained)
Obfuscation disguises VPN traffic so it looks more like ordinary HTTPS. Firewalls in China, Russia, and some offices spot a normal OpenVPN or WireGuard handshake and drop it. Obfuscated servers fail less often. They still fail. Travelers report a connection that works for a few hours and then dies. For a short trip, roaming or a travel eSIM that exits outside the country is often less fiddly than a commercial VPN.
How normal VPN traffic is detected
Encrypted VPN traffic has identifiable characteristics: specific packet sizes, timing patterns, protocol signatures, and port usage. Even without reading the encrypted content, a firewall using Deep Packet Inspection can say 'this looks like OpenVPN traffic' and block it. China's Great Firewall, Russia's FAPSI, and corporate firewalls all use DPI to detect VPN use.
How obfuscation works
Obfuscation wraps VPN packets in an additional layer to disguise them:
The better obfuscation uses the same port as normal websites, so a crude block would also break the web. An ISP or firewall that looks at the handshake can still tell a tunnel is there.
- XOR obfuscation: Applies XOR cipher to packet headers to mask VPN signatures. Basic but effective against basic DPI.
- Obfsproxy (Tor project): Designed to bypass censorship. Randomizes packet sizes and timing to prevent traffic analysis.
- HTTPS mimicry: Makes VPN traffic look more like regular website traffic, often on port 443. Harder to block. Not invisible.
- Shadowsocks: Originally designed to bypass China's Great Firewall. Uses SOCKS5 proxy protocol with encryption. Popular in China.
- V2Ray/VMess/VLESS: More advanced protocols designed for circumvention. Common in China and Iran.
- Stunnel: Wraps any traffic in TLS. Makes VPN traffic indistinguishable from HTTPS.
Which VPNs have obfuscation?
- ExpressVPN: Lightway protocol with obfuscation. Best for China — has extensive infrastructure there.
- NordVPN: 'Obfuscated servers' toggle in Settings. Uses XOR + custom TCP protocol.
- Surfshark: Camouflage Mode (automatic when using OpenVPN TCP). No extra steps needed.
- ProtonVPN: Stealth protocol — WireGuard wrapped in TLS. Works in censored regions.
- Mullvad: Obfuscation via Shadowsocks and DAITA (Defence Against AI-guided Traffic Analysis).
- Astrill: Specifically designed for China. StealthVPN and OpenWeb protocols both work there.
Do you need obfuscation?
- Yes, you need it: If you're in China, Russia, Iran, UAE, Oman, Turkey, or other countries that restrict VPNs. Also useful in restrictive workplaces or schools that use DPI to block VPNs.
- No, you don't need it: If you're in a country with unrestricted internet (US, UK, most of EU, Canada, Australia). Standard VPN protocols work fine.
- Maybe: If you're in a country with selective VPN restrictions, or if your ISP throttles known VPN traffic.
Frequently asked questions
Does obfuscation make the VPN slower?
Yes, slightly. The additional encryption and packet processing adds overhead — typically 10–20% speed reduction compared to standard WireGuard. For most purposes, this is barely noticeable. It's a worthwhile trade-off if you're in a censored network.
Which VPN works in China?
ExpressVPN is the most consistent choice for China, with extensive infrastructure and regular protocol updates as China's firewall evolves. Astrill, NordVPN obfuscated servers, and Surfshark Camouflage Mode also work. No VPN is 100% reliable in China — the Great Firewall adapts constantly.
Can my ISP tell I'm using a VPN if obfuscation is on?
Often, yes. Obfuscation makes the tunnel look more like ordinary HTTPS. It does not make it invisible. A network that only blocks known VPN ports may miss it. A network that inspects the handshake can still see that the traffic is a VPN.