Protocol guide
Which VPN protocol should you choose? DXVPN's 7 protocols compared
Start with VLESS + Reality if your network uses heavy DPI; it is the hardest of DXVPN's 7 protocols to tell apart from ordinary HTTPS. Pick AmneziaWG for speed and routers, Hysteria2 when TCP is throttled, VLESS + WebSocket to hide behind a CDN, and Trojan or Shadowsocks 2022 as fallbacks. Your subscription link carries every protocol on your plan, so switching takes seconds.
Key points
- VLESS + Reality is the first pick where DPI is strongest.
- AmneziaWG is usually the fastest, and it is the one that runs on MikroTik routers.
- Hysteria2 uses QUIC over UDP and helps when TCP is slowed down.
- Keep two or three protocols ready; censors change tactics.
The quick answer
If your VPN keeps getting blocked, start with VLESS + Reality. If your network is not heavily filtered and you want speed, start with AmneziaWG.
That covers most people. The rest of this guide explains the other six protocols, when each one earns its place, and which ones to try first in Russia, China, Iran and Turkey. With DXVPN you do not have to commit to one. A single subscription link gives your app every protocol on your plan. The app can then fall back to another one when the first stops working.
All 7 protocols compared
Which of them a given server offers can vary; the live status page lists each server and its protocols.
The table below sums up DXVPN's 7 protocols. DPI resistance is DXVPN's own 1–5 rating from our DPI bypass page; it describes how hard each protocol is to fingerprint, not a guarantee.
| Protocol | DPI resistance | Speed | Best for | Platforms |
|---|---|---|---|---|
| VLESS + Reality | 5/5 | Fast, single TLS layer | The hardest DPI; looks like HTTPS to a real site | v2ray-, Clash- and sing-box-compatible apps on iOS, Android, macOS, Windows, Linux |
| Trojan (TLS / Reality) | 4/5 | Fast | Networks that actively probe servers | Same as above |
| AmneziaWG | 4/5 | Fastest | Everyday speed, mobile, MikroTik routers | AmneziaWG-compatible clients; RouterOS 7.x container |
| Hysteria2 | 3/5 | Low latency over UDP | Networks where TCP is throttled | sing-box-based apps and other Hysteria2-capable clients |
| VLESS + WebSocket | 4/5 | Depends on the CDN path | Hiding behind a CDN when server IPs are blocked | v2ray-, Clash- and sing-box-compatible apps |
| Shadowsocks 2022 | 3/5 | Fast, light | Wide client support; a simple fallback | Most v2ray-, Clash- and sing-box-compatible apps |
| VMess | 3/5 | Good | Older clients that support it | v2ray-compatible apps |
Plain WireGuard is not in the list. DPI can spot it easily, so DXVPN offers AmneziaWG instead. See AmneziaWG vs WireGuard for the difference.
What each protocol is good at
Each protocol hides in a different way. Knowing the method tells you which one to try next when one fails.
VLESS + Reality
Reality presents the TLS fingerprint and certificate of a real website. A passive observer sees what looks like a TLS 1.3 visit to that site. A censor that blocks by site name risks blocking the real site too. Details in VLESS + Reality explained.
Trojan
Trojan wraps traffic in a TLS session. A connection with a wrong password is passed to a real web server, so a censor probing the server sees an ordinary website.
AmneziaWG
AmneziaWG is WireGuard with an obfuscated handshake: junk packets and randomised header bytes remove the standard WireGuard signature. It keeps WireGuard's speed and works on routers.
Hysteria2
Hysteria2 runs over QUIC (UDP) with TLS 1.3 inside and uses its own congestion control, called Brutal. It helps when a network slows down TCP connections.
VLESS + WebSocket
This variant can run behind a content delivery network. Blocking it by address would mean blocking the CDN's addresses, which many other sites share. That makes it a costly target.
Shadowsocks 2022 and VMess
Shadowsocks 2022 uses AEAD encryption only and looks like random bytes, with no SNI and no TLS handshake. Some censors flag fully random-looking traffic, so treat it as a fallback rather than a first pick. VMess is V2Ray's configurable protocol. Both have wide client support and make good fallbacks.
Bonus: MTProto proxy for Telegram
MTProto is not one of the 7 VPN protocols: it is a Telegram-only proxy, offered as a bonus. It does not protect other apps, but it gives you a link you can share so others can keep Telegram working. It is included on Family and Business plans.
Picks by situation
Match the protocol to the problem you actually have. Here are the common cases.
- The VPN connects, then drops within minutes. Likely DPI. Switch to VLESS + Reality, then Trojan.
- Nothing connects at all, on any protocol. The server address may be blocked. Try another node, then VLESS + WebSocket via CDN.
- It works but is very slow. Try AmneziaWG. If TCP seems throttled, try Hysteria2.
- You want the whole home network covered. Use AmneziaWG on a MikroTik router; see VPN on a MikroTik router.
- You only need Telegram, or want to help family use it. Share an MTProto proxy link.
- Your app is old or unusual. Shadowsocks 2022 or VMess is most likely to be supported.
Picks by country
Censors in different countries use different methods, so the best first choice differs too. These are the recommendations from DXVPN's DPI page, in order.
| Country | First choice | Second | Third |
|---|---|---|---|
| Russia | VLESS + Reality | AmneziaWG | Trojan |
| China | VLESS + Reality | Trojan | Shadowsocks 2022 |
| Iran | VLESS + Reality | Hysteria2 | Trojan |
| Turkey | VLESS + Reality | Trojan | Shadowsocks 2022 |
China's Great Firewall is known for active probing, which is why Trojan's decoy website matters there. In Iran, filtering tends to tighten around events, and UDP-based Hysteria2 is a useful alternative. For background on these methods, read what deep packet inspection is.
Which protocols your plan includes
Free, Pro and Family list all 7 protocols. Basic includes three: VLESS, Trojan and Shadowsocks. The shareable MTProto proxy link for Telegram comes with Family.
The Free plan gives you 1 device with 10 GB a month at up to 50 Mbit/s, with no card needed, which is enough to test which protocol works on your network. Pro costs 299 ₽ a month for 3 devices; Family costs 449 ₽ a month for 5 devices and adds the MTProto proxy. Full details are in pricing.
How to switch protocols
You switch protocols inside your app, not in your account. Import your subscription link once, and every protocol on your plan appears as a separate entry.
- Install a client from the download page.
- Import your subscription link or scan the QR code from the dashboard or @dxvpnbot.
- Pick a protocol from the list and connect. If it fails, pick the next one.
The link refreshes every 6 hours, so new settings reach your app without you doing anything. If every protocol fails, work through the blocked VPN checklist.
Questions
What is the best VPN protocol against DPI?
In DXVPN's rating, VLESS + Reality scores highest (5 out of 5) because it is designed to look like a TLS 1.3 visit to a real website. No protocol works on every network, so keep a fallback such as Trojan or Shadowsocks 2022 ready.
What is the fastest DXVPN protocol?
AmneziaWG is usually the fastest, because it keeps WireGuard's lean design and only adds obfuscation to the handshake. Hysteria2 is a good option for low latency when TCP is throttled.
Do I have to choose one protocol for good?
No. Your subscription link includes every protocol on your plan, and compatible apps let you switch in a tap or fall back automatically when one stops working.
Why doesn't DXVPN offer plain WireGuard or OpenVPN?
DXVPN's current plans include 7 protocols built for networks with DPI. Plain WireGuard is easy for DPI to spot, which is why AmneziaWG is offered instead. OpenVPN also has well-known patterns that DPI can recognise.
Sources
General information, not legal advice. VPN rules differ by country — check the law where you are.
See it for yourself
Run the “what the censor sees” check on the home page, or start on the free plan — no card needed.