VPN protocols compared: VLESS, WireGuard, AmneziaWG, OpenVPN, and others

Why are there so many protocols and how do they differ?

A VPN protocol is an agreement between the app and the server on how to package data, encrypt it, and verify your identity. All modern protocols use strong encryption, so we choose between them based on other factors.

They generally fall into two families. The first includes classic VPNs: WireGuard, OpenVPN, and IPsec/IKEv2. They were built to connect a remote employee to an office network or link two branches together. There was no need to hide the VPN traffic, so each protocol has a recognizable "handshake" at the start of the connection, like a signature doorbell ring.

The second family consists of proxy protocols: Shadowsocks, VMess, VLESS, Trojan, and Hysteria2. They emerged in networks where VPN traffic is detected and restricted. They are designed to make the connection look like regular web browsing or meaningless noise. To make your phone treat this connection as a VPN, the app creates a virtual network interface. For the user, it feels exactly the same: the same connect button and a key icon in the status bar.

AmneziaWG stands between these two families. It is WireGuard with altered signatures, keeping the original encryption and speed.

Modern protocols from both families are secure. They use strong encryption, so neither your ISP nor the people on the same cafe Wi-Fi can see your traffic. What matters more is who controls the server. The server owner sees which websites you visit regardless of the protocol. Choose a trustworthy service first, then look at the protocol. To refresh the basics, read our article on what a VPN is in simple terms.

How protocols differ: a comparison table

What we know about protocol restrictions in Russia

Roskomnadzor (Russia's communications regulator) does not publish how or which protocols it restricts, so the picture is pieced together from media and industry reports.

• In August 2023, subscribers of major mobile networks reported massive OpenVPN and WireGuard outages. ComNews reported a large-scale block of these protocols. Since then, users and media report that classic VPN protocols run unreliably on Russian networks, especially mobile ones.
• In November 2023, according to Kommersant, Shadowsocks was added to the blocklist for the first time.
• In December 2025, RBC reported that Roskomnadzor updated its deep packet inspection (TSPU) equipment and started restricting SOCKS5, VLESS, and L2TP. Experts analyzing the news suggested VLESS is detected through indirect signatures.

There are also restrictions of a different kind. During mobile internet blackouts in certain regions, whitelists are enforced: only approved services open. In this scenario, none of the protocols mentioned in this article will connect, no matter how they work.

However, using a VPN is not illegal. Read our article on whether using a VPN in Russia is legal to see exactly what the law regulates and what can lead to fines.

Why the same protocol works for a friend but not for you

Filtering in Russia is inconsistent. TSPU equipment is installed at the ISP level, and user complaints show that rules trigger differently across regions and networks. Mobile internet is usually restricted more strictly than home broadband: the 2023 OpenVPN and WireGuard disruptions reported by ComNews affected mobile operators but skipped major broadband providers like Rostelecom.

The second factor is the specific server setup: the port, transport protocol, the decoy website used by Reality, and the hosting provider. Two services using the same VLESS protocol might behave differently, and one location of a service might work while a neighboring one fails.

The third factor is time. Restrictions are tightened and loosened. What worked last month might stop working, and vice versa. Searching for the "perfect" protocol once and for all is pointless. It is more practical to use a service that monitors this for you and sends new settings via a subscription. If your connection completely drops, start by checking why your VPN won't connect.

How to check which protocol you are using

You can easily identify the protocol by what the service provides. Links usually start with the protocol name, while classic VPNs typically provide a configuration file.

If you use a subscription link, you can usually see the protocol of each server in the app: either next to the server name or in its properties.

A brief look at each protocol

VLESS

A lightweight protocol from the Xray ecosystem, introduced in 2020. VLESS handles identifying the client and routing data, while TLS or Reality handles the encryption and disguise. Reality borrows the appearance of a real, major website, and the Vision mode removes the distinctive pattern of double encryption. A subscription link often offers several VLESS variants for one location with different transports, like TCP with Reality and XHTTP with TLS. Read more about this in our article explaining VLESS in simple terms.

WireGuard

A modern VPN protocol with highly compact code, built into the Linux kernel since 2020. It uses a proven set of cryptography (Noise, Curve25519, ChaCha20, Poly1305, BLAKE2) and only runs over UDP. It connects quickly and handles network changes smoothly, like switching from Wi-Fi to LTE. Its weak point in Russian networks is its visibility: the first packets of a WireGuard connection are always identical in size and structure.

AmneziaWG

A WireGuard fork by the Amnezia team. Before the handshake, it sends a few random-length packets, adds random bytes to service messages, and alters the headers that usually give WireGuard away. Versions 1.5 and 2.0 introduced the ability to disguise traffic as other popular UDP protocols. The cryptography remains the same as WireGuard, so the speed is identical. If you disable the cloaking parameters, the configuration is compatible with standard WireGuard. See the Amnezia documentation for details.

OpenVPN

A veteran protocol around since the early 2000s. It negotiates keys over TLS, works over both UDP and TCP, and is supported by a massive number of routers and corporate systems. This versatility comes at the cost of CPU load, making it slower on weak devices. In TCP mode, packet loss drops speed drastically because OpenVPN and TCP retransmissions interfere with each other. It is still widely used for corporate access, but its handshake is easily recognizable.

Shadowsocks and Outline

Shadowsocks emerged in 2012 as an encrypted proxy. It has no recognizable handshake: an encrypted stream starts from the very first byte. However, a stream where all bytes look entirely random stands out from regular traffic. Researchers have shown how fully encrypted traffic can be identified by byte statistics (USENIX Security 2023).

Outline was launched in 2018 by Jigsaw, an incubator within Google. It is now owned by the non-profit Outline Foundation. Outline uses Shadowsocks under the hood, and an "Outline key" is usually a link starting with ss://. Thus, the difference between VLESS and Outline comes down to the difference between VLESS and Shadowsocks: a VLESS connection with Reality looks like standard HTTPS, while Shadowsocks looks like a stream of noise.

Trojan

Trojan hides a proxy inside a genuine TLS connection: the client completes a standard handshake and then transmits a password hash. If the password is wrong or an outsider connects, the server forwards the connection to a regular web server, making it act like a website to outside observers. Xray supports Trojan, but without Vision mode, and the documentation advises enabling multiplexing for it. Otherwise, the "TLS inside TLS" pattern is easy to spot. Trojan links start with trojan:// and work in the same apps as VLESS links.

Hysteria2

It runs over QUIC (which HTTP/3 is built on) and tries to blend in as regular HTTP/3 traffic. Its custom Brutal congestion control algorithm helps maintain high speeds on lossy connections, like weak mobile internet or when connecting to distant servers. The downside is that everything goes over UDP. If a network throttles UDP, Hysteria2 will perform worse than TCP-based protocols. It is supported by sing-box clients, like Hiddify.

IKEv2, L2TP, and PPTP

These protocols are built into Windows, macOS, and iOS, requiring no third-party apps to set up. PPTP has long been considered insecure, and Apple removed it from iOS and macOS back in 2016. L2TP without IPsec does not encrypt data, and according to RBC, was also targeted by restrictions in late 2025. IKEv2/IPsec is secure but is just as easily recognized as other classic VPNs.

VLESS vs WireGuard: which to choose

On paper, WireGuard is faster: it is simpler, runs directly in the Linux kernel, and wastes almost no resources on overhead. VLESS with Vision adds almost no load either, so in practice, the speed of both is limited by the server, the routing, and the network load.

The real difference is how the protocols look from the outside. WireGuard does not hide, and in Russian networks, according to user and media reports, its connections often drop in the first few seconds or fail to establish entirely. VLESS with Reality or TLS looks like normal HTTPS traffic, though as mentioned earlier, it is also facing restrictions.

There are also minor differences. WireGuard handles switching from Wi-Fi to a mobile network seamlessly: the server simply starts responding to the new address. With TCP-based protocols, which usually include VLESS, connections have to be reopened in these moments, causing a brief pause.

Therefore, WireGuard is great where the network does not interfere: connecting to a home server, accessing a work network, or traveling abroad. For everyday VPN use on a phone and computer in Russia, getting VLESS from a subscription service is more practical, as the app will automatically fetch servers and update settings.

VLESS vs AmneziaWG

This question usually pops up for those looking to set up their own server. The AmneziaVPN app can automatically install a server on a rented VPS over SSH, offering AmneziaWG alongside Xray. VLESS is usually provided by a service or set up on a server using Xray control panels.

Technically, the difference is in the transport. AmneziaWG runs over UDP and delivers WireGuard speeds. VLESS usually runs over TCP and looks like HTTPS. Networks restrict UDP and TCP differently, so the exact same setup might work perfectly at home but struggle on mobile internet in another city.

If you use a ready-made service, you do not have to choose: the protocol is already built into the subscription. If you are setting up your own server, AmneziaWG is easier to configure. VLESS with Reality takes longer to set up, but it looks much less like a VPN.

VLESS vs Hysteria2

Here is the same TCP vs UDP split. Hysteria2 wins on lossy connections, like weak mobile internet or connecting to a server halfway across the globe. VLESS is more reliable on networks that throttle UDP. In such a network, Hysteria2 struggles just as much as AmneziaWG. If a service offers both and your client supports Hysteria2 (like Hiddify), you can compare them on your network.

What to choose for your phone, computer, router, and TV

For a detailed breakdown of phone and PC clients with their pros and cons, read our VLESS apps review. We also explain how keys and subscriptions work and how to add them in our article on VLESS keys and subscriptions.

For routers, it all depends on the firmware. Keenetic, for example, has native WireGuard support. According to Amnezia documentation, it supports AmneziaWG starting from KeeneticOS 4.2 (initially in test builds). From version 4.3.4, parameters are automatically fetched from the configuration file. For VLESS on a router, you generally need OpenWrt or third-party packages. Read more in our article on VPNs for routers.

If your subscription includes servers with different protocols or transports, start with the one the service recommends. Switch only if the connection is poor. It is fairer to compare options on the same network and at roughly the same time, as speeds fluctuate throughout the day, especially in the evening.

One caveat for those who already have a work VPN. On a phone, only one VPN connection works at a time: turning on a second one disables the first. On a computer, two VPN clients technically coexist but fight over routing, causing some websites or work systems to stop loading. If your employer provides a VPN, keep it and your personal one enabled one at a time.

Any of the protocols will work fine in cafes, airports, and hotels. For more tips on unfamiliar networks, read our article on public Wi-Fi security.

Byte VPN runs on VLESS with Reality and XHTTP/TLS. A single subscription link gives you all available locations, and the dashboard provides setup instructions for Incy, Happ, and Hiddify.