What DPI is and why some VPNs get blocked while others do not

DPI (Deep Packet Inspection) is equipment at the provider that looks not only at where traffic goes but at what it looks like.

How DPI finds a VPN

DPI does not read encrypted content, but every protocol has a recognisable signature:

• a distinctive handshake. OpenVPN and WireGuard greet the server in their own way, and that exchange is easy to spot;
• packet sizes and rhythm. A tunnel moves data differently from a normal browser;
• the destination. Thousands of long encrypted sessions to one address put it on a suspicious list.

Once the protocol is recognised, the system can drop the connection, slow it until it is unusable or block the server address.

Why disguise works

The most reliable way not to stand out is to look like something that cannot be blocked. Ordinary HTTPS traffic to large websites is needed by everyone, and nobody cuts it off entirely.

VLESS Reality works exactly like that. When connecting it presents the real certificate of a popular website, and from the outside the session looks like a visit to that site. Telling it apart by the handshake is practically impossible.

Why two more protocols then

No disguise lasts forever: filtering methods change. So every device gets three protocols at once:

• VLESS Reality — for networks with active filtering;
• Hysteria2 — a fast UDP protocol when the network lets it through;
• OpenVPN — for routers and older devices.

If one method stops working, the next is already set up and switching takes seconds.

Summary

DPI looks for recognisable protocols. The more a VPN resembles ordinary traffic, the longer it keeps working. Still, the safest approach is not to rely on a single protocol but to keep a spare at hand.