How VPNs get past deep packet inspection

Deep packet inspection cannot read an encrypted tunnel. That is worth stating first, because the phrase suggests otherwise. What it can do is recognise the tunnel's shape: the sizes of the first few packets, the timing between them, the constant fields in a handshake, the port. None of that requires decrypting anything.

What gives each protocol away

WireGuard has a fixed handshake structure. The initiation message is always 148 bytes and the response is always 92, with a message type field in a known position. That is a signature a middlebox can match in one comparison.

OpenVPN over UDP has its own recognisable opcode structure. Over TCP with tls-auth it is closer to TLS, and with tls-crypt the control channel is encrypted, which removes most of the signature.

IKEv2 uses fixed ports, UDP 500 and 4500, so it does not need fingerprinting at all.

OpenConnect and other SSL VPNs genuinely are TLS on port 443, which is why they are hardest to block.

What obfuscation layers do

They fall into three families.

Look like TLS. Wrap the tunnel inside a real TLS session, so a middlebox sees a certificate exchange and an encrypted stream to port 443. Stunnel does this generically; several providers build it in. It is effective and it costs throughput.

Look like nothing. Make every byte indistinguishable from random, with no fixed headers and no predictable sizes. Tor's obfs4 works this way. There is no pattern to match, though the absence of a pattern can itself be a signal on a network that expects protocols it recognises.

Look like something specific and boring. Mimic a common protocol closely enough that blocking it would break that protocol for everyone. This is the same strategy as running on port 443, taken further.

What it costs

Throughput. Every layer adds framing and processing. A tunnel inside TLS inside TCP is carrying three sets of headers and, in the TCP case, two reliability layers fighting each other.

Latency. More processing per packet at both ends.

Complexity. More code in the path, and more that can break.

Obfuscation is not something to leave on by default. It is what you enable when the ordinary connection does not work.

Why WireGuard has none built in

Deliberately. The protocol's design goal was a small, auditable codebase, and obfuscation is a large amount of code that changes with whatever it is trying to evade. The project's own documentation lists this among its known limitations and points at external wrappers.

So every provider offering obfuscated WireGuard is running WireGuard inside something else. That is a reasonable architecture — the tunnel keeps its properties and the wrapper is replaceable — and it is worth knowing that it is what is happening.

The arms race, honestly

Obfuscation works until the other side updates. A censor that identifies a particular wrapper blocks it, the wrapper changes, and the cycle continues. The practical consequences:

• What worked last month may not work today. This is normal rather than a fault in the provider.
• A provider that never updates its obfuscation is not doing much.
• Timing and volume analysis is harder to defeat than content analysis. A tunnel that looks like TLS but carries a constant high-bandwidth stream from a residential connection at 3am does not look like browsing, whatever its bytes resemble.

When you actually need it

• Networks that fingerprint and block VPN handshakes.
• Countries where VPN use is restricted and detected at the network level.
• Some corporate and campus networks with modern security appliances.

Not needed for: a network that blocks a port (use a different port), a network that blocks UDP (use a TCP-based protocol), or ordinary use anywhere.

The legal part

In several jurisdictions, using a VPN is legal and evading a state filtering system is not. Those are different acts, and obfuscation is squarely aimed at the second. Anyone in a country with restrictions should understand the local law before relying on a technical measure, because the technical measure does not change the legal position.

The server list covers what each country's network environment actually looks like, which is a better starting point than assuming a tool will handle it.