VPN obfuscation

Updated 21 September 2026 · How we research

Obfuscation hides the fact that you are using a VPN. Encryption protects the contents of your traffic; obfuscation attacks the shape of it, so that deep packet inspection cannot classify the connection in the first place.

How VPN traffic gets identified

Port. The crudest signal. Blocking UDP 500, 4500 and 1194 stops IKEv2 and default OpenVPN outright.
Handshake fingerprint. WireGuard, OpenVPN and IKE each have a recognisable opening exchange that matches regardless of port.
Packet timing and size. Tunnels produce distinctive patterns even when contents are opaque.
Active probing. The network connects to your server itself to see whether it behaves like a VPN endpoint.

Common techniques

All obfuscation trades speed for resistance to detection.

Technique	Idea	Limitation
Run on port 443	Use the port every network must allow	Defeats port blocking only; DPI still sees the handshake
TLS wrapping	Put the tunnel inside a genuine TLS session	Adds overhead and often forces TCP
Obfuscation layers	Scramble the handshake so it matches no known signature	Vulnerable to active probing if the server answers unusually
Proprietary transports	Vendor-specific designs such as ZoogVPN's Shadow and ZoogTLS	Shadow has no public specification; ZoogTLS is vendor-described as OpenConnect-based but its implementation is not published. Neither has been independently assessed.

Nothing here is guaranteed

Censorship systems are actively maintained and adapt. A transport that works today may be detected next month. Treat any provider's claim of guaranteed access to a specific restricted network as unverifiable — including claims made in vendor marketing.

ZoogVPN's options

ZoogVPN publishes two in-house transports aimed at restricted networks: Shadow, listed for Windows, macOS, iOS and Android, and ZoogTLS, listed for Windows only. Both are described by the vendor as moderate speed, which is consistent with how obfuscation works. Shadow has no public specification; ZoogVPN describes ZoogTLS as based on OpenConnect with TLS encryption, which is at least a documented starting point.

Legal and personal risk

Rules on circumventing network restrictions differ sharply between countries and can carry serious consequences. Understand your own situation before relying on any of this. Nothing on this page is legal advice.