How network filtering works, and how tunnels respond
A reference library on deep packet inspection, VPN protocols, TLS fingerprinting and diagnosing a blocked connection — written to be useful whichever provider you use.
11 guides · last reviewed 2026-09-15
Fundamentals
How network filtering actually works, from the packet up.
What is deep packet inspection?
Deep packet inspection reads the contents of network traffic, not just its addresses. Here is what a DPI box actually looks at, what it can and cannot see inside encrypted connections, and why it is the technique behind most modern VPN blocking.
Read · 7 minHow DPI blocks VPNs
A step-by-step account of how a filtering system detects and blocks a VPN — protocol fingerprints, SNI matching, IP blocklists, active probing and throttling — and which parts a protocol design can address.
Read · 7 minTLS fingerprinting and SNI, explained
The TLS handshake happens before encryption starts, and it leaks more than most people expect: the hostname you asked for, and a fingerprint of the software you used. Here is what JA3, JA4 and SNI filtering actually do.
Read · 5 minObfuscation versus encryption
Encryption stops traffic being read. Obfuscation stops it being recognised. They defend against different adversaries, and confusing the two leads to the wrong protocol choice.
Read · 4 minA glossary of VPN and network-filtering terms
Plain definitions for the vocabulary around tunnelling and network filtering — from AEAD and active probing to XTLS — written so that each entry makes sense without the others.
Read · 4 min
Protocols
What the tunnelling protocols do differently, and why it matters.
VPN protocols compared: WireGuard, OpenVPN, IKEv2 and VLESS
An honest comparison of the major VPN and tunnelling protocols on speed, battery use, reliability and — the part most comparisons skip — how each one behaves on a network that is actively filtering.
Read · 6 minWhat is REALITY?
REALITY avoids the weakest link in TLS-based tunnelling — the certificate and the domain — by completing its handshake against a genuine third-party website, and handing unauthenticated visitors through to that site.
Read · 4 minWhat is XTLS Vision?
Tunnelling HTTPS inside TLS encrypts everything twice and produces a distinctive packet-length pattern. XTLS Vision addresses both by passing already-encrypted records through rather than re-encrypting them.
Read · 4 min
Troubleshooting
Working out what is blocking a connection, and what to change.
Privacy
What a tunnel does and does not hide, stated precisely.
What a VPN does not hide
A tunnel moves the point at which your traffic joins the internet. It does not make you anonymous. Here is precisely what changes, what does not, and who can still see what.
Read · 5 minWhat “no logs” actually means
Every VPN keeps some records — a service that kept none could not bill anyone or stop abuse. What matters is which records, for how long, and whether the claim is specific enough to be checked.
Read · 4 min