ZoogVPN Shadow protocol

Updated 21 September 2026 · How we research

Shadow is one of ZoogVPN's two proprietary transports. It is aimed at networks that do not merely block VPN ports but actively identify and drop VPN traffic.

What we can and cannot tell you

Shadow is proprietary. There is no public specification, no RFC and no independent implementation, so the description below reflects what ZoogVPN publishes plus general knowledge of how obfuscated transports behave. We have not tested it and cannot confirm its effectiveness in any specific country.

What ZoogVPN says

According to ZoogVPN

ZoogVPN's help centre describes Shadow as "specifically designed for bypassing censorship in highly restricted regions, with unmatched firewall evasion". It lists availability on Windows, macOS, iOS and Android, rates its speed as moderate, and describes it as very good for torrenting and P2P. "Unmatched" is the vendor's wording, not an assessment we can verify.

Where a transport like this fits

Standard protocols announce themselves. A WireGuard handshake, an OpenVPN header and an IKE negotiation all have recognisable shapes that deep packet inspection can match even when the port is unremarkable. Obfuscated transports exist to remove those signatures, usually by wrapping the tunnel so that it resembles ordinary encrypted web traffic. The general techniques are covered in VPN obfuscation.

Realistic expectations

Obfuscation costs speed. Extra wrapping and a TCP transport both add overhead, which is consistent with the moderate speed rating ZoogVPN publishes.
No obfuscation is permanent. Censorship systems adapt, and a transport that works one month may be detected the next.
Active probing defeats naive designs. Some networks connect to a suspicious server themselves to see how it responds.
Use it only when you need it. On an ordinary network, WireGuard will be faster and simpler.

Legal note

Circumventing network restrictions is regulated differently across countries, and in some places it carries real personal risk. Understand the rules that apply to you before relying on any obfuscated transport. Nothing here is legal advice.

Alternatives if Shadow is unavailable

ZoogVPN lists Shadow on Windows, macOS, iOS and Android but not on Linux or routers. On those platforms the practical fallback is OpenVPN TCP on port 443 — see OpenVPN TCP vs UDP. On Windows, ZoogTLS is the other proprietary option.

Save 82%

Shadow and ZoogTLS are included with a standard ZoogVPN subscription rather than sold as add-ons.

$2.49/month+ 3 months free

2-year plans

Unlimited devices30-day guarantee

Get ZoogVPN Deal Read our full review

Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing shown as published on VPN Sherlock; confirm current terms at checkout.