Stealth VPN: How VPN Obfuscation Works and When You Need It

A stealth VPN (also called an obfuscated VPN) disguises VPN traffic so a network can't tell it's a VPN, and so can't block it. It matters on hotel, school and office Wi-Fi that filter VPNs, and in countries that block them. Obfuscation methods range from wrapping WireGuard in TCP to protocols like VLESS + REALITY, whose traffic looks like a real visit to a real HTTPS website. The strongest ones look like ordinary TLS 1.3 on port 443 and stand up to active probing. The weakest only scramble bytes, and modern firewalls catch those.

How do networks detect and block VPNs?

Before choosing a stealth VPN, it helps to know what it's hiding from.

Commercial firewalls make this a checkbox. Fortinet's FortiGuard, for example, puts OpenVPN and WireGuard in its "Proxy" category, described as "Proxy and VPN applications". Fortinet's own guidance for blocking third-party VPNs is to block that category and the IKE signatures, turn on deep inspection and inspect all ports. An office or hotel admin can do that in a few clicks.

What makes a VPN truly stealthy?

Researchers have shown how easily naive obfuscation fails. At USENIX Security 2022, a team fingerprinted more than 85% of OpenVPN flows on a million-user ISP network with negligible false positives. They also flagged 34 of 41 "obfuscated" OpenVPN setups they tested. At USENIX Security 2023, another team described how China's Great Firewall blocks "fully encrypted" protocols such as Shadowsocks, VMess and obfs4. Since November 2021 it has used simple heuristics, such as how many bits are set and how much of the data is printable text.

The lesson: random-looking traffic stands out. Normal internet traffic isn't random at the start of a connection. It begins with a recognisable TLS handshake. So the best stealth protocols don't hide that they're TLS. They are TLS, indistinguishable from a browser visiting a popular site.

A truly stealthy VPN needs four properties:

1. Uses TCP port 443, like every HTTPS website, so port rules can't block it without blocking the web.
2. Speaks real TLS 1.3, with a handshake fingerprint identical to Chrome's.
3. Survives probing. A scanner that connects without credentials sees a real, plausible website.
4. Has no certificate or domain that gives it away, or a perfectly ordinary one.

The main stealth methods, compared

Each vendor name above is a real product, documented by its maker:

• Proton VPN Stealth (launched October 2022) is "WireGuard tunneled over TLS", in Proton's words.
• NordVPN's obfuscated servers now run on NordWhisper, a web-tunnelling protocol launched in January 2025. Manual OpenVPN connections to them no longer work.
• Surfshark's Camouflage Mode "hides typical VPN traffic patterns by using the OpenVPN protocol."
• Mullvad offers several options for WireGuard: UDP-over-TCP, Shadowsocks (October 2024), QUIC (September 2025) and Lightweight WireGuard Obfuscation (November 2025).
• Astrill StealthVPN is proprietary and "inspired by OpenVPN".

Is a stealth VPN slower?

Often, yes. But the cost comes from how it hides, not from hiding itself.

• Wrapping UDP in TCP is the expensive kind. WireGuard over TCP and OpenVPN over TCP stack two layers of retransmission. On a lossy café network the two fight each other ("TCP meltdown"), and speed collapses.
• Wrapping in TLS adds a second encryption layer to traffic that is mostly HTTPS already.
• VLESS + REALITY with XTLS Vision avoids both. It carries streams rather than packets, so there's no TCP-over-TCP penalty. Vision passes already-encrypted HTTPS through without encrypting it twice.

Our own measurements of VLESS + REALITY + Vision (November 2026):

• 2.0 Gbit/s on a single connection, London to Frankfurt.
• 182–202 Mbit/s against 183 Mbit/s direct on café Wi-Fi. The Wi-Fi was the limit, not the VPN.

If a stealth mode makes your VPN crawl, that's usually the older wrapping methods at work. See why VPNs get slow for the other usual suspects.

When do you actually need a stealth VPN?

You need one if any of these sound familiar:

• Your VPN won't connect on hotel, café, airport or coworking Wi-Fi, but works at home. That's almost always UDP or port blocking. Here's how to diagnose it.
• Your school or campus network blocks VPN apps by signature.
• You travel to countries that filter VPNs. Stealth isn't optional there, and only the strongest methods hold up. Check local law before you go.
• Your VPN connects but drops every few minutes on a particular network. Some firewalls let a connection start and then reset it once they classify it.

You probably don't need one on your own home fibre, where any modern protocol works.

What stealth can't do: if your company laptop has a corporate root certificate and inspects all TLS, no VPN gets through it, stealth or not. Don't try to evade your employer's security controls on a managed device. Follow its policy, or use your own device on your own network.

How SleekDart does it

SleekDart runs VLESS + REALITY + XTLS Vision on TCP 443 on every server, with nothing to switch on:

• Each server borrows the TLS 1.3 handshake of a real site, chosen by measured handshake speed from that server. We avoid the giant CDNs whose IP ranges are easy to cross-check.
• A probe without your key gets the real website and its real certificate. We check this on every server we deploy.
• Key exchange uses the hybrid post-quantum X25519MLKEM768, so traffic recorded today stays private later. More in our post-quantum VPN guide.
• No activity logs. The access log is off.