VLESS Reality still works where Hysteria 2 gets blocked

VLESS Reality vs Hysteria 2 comes down to whether your network lets UDP through. Reality hides inside TCP port 443 and borrows a real website’s TLS handshake. Hysteria 2 rides QUIC and wins on lossy lines. It can now fake TCP headers too, for networks that block UDP.

How VLESS Reality borrows a real website’s TLS handshake

You do not run REALITY on its own. It is a feature of Xray-core that wraps VLESS in a TLS 1.3 handshake. That handshake completes against a real third-party site, so the client sees a genuine certificate. The Xray REALITY documentation limits it to three stream transports: RAW, XHTTP, and gRPC.

target names the borrowed site as host and port. serverNames lists the SNI values a client may claim. Those two fields carry the whole disguise, and the docs say they should stay consistent. Wildcards are not allowed.

Traffic that fails the check gets passed straight to the target. Poke at the IP and you get the real site’s answer. So Reality needs no domain of your own and no Let’s Encrypt certificate. If the borrowed site sits behind Cloudflare, though, your box turns into an open port forwarder for Cloudflare, and a scan will find it. Best practice is to borrow from a site in the same ASN as your VPS.

Client auth is an x25519 keypair plus a shortId. Short IDs are 8 bytes, so up to 16 hex characters. The count must be even, because one byte is two hex digits. aa1234 gets padded to a full 8 bytes, while aaa1234 throws an error.

xray x25519
xray tls ping example.com

The ping shows how a candidate site answers a handshake, including whether it supports the post-quantum key exchange X25519MLKEM768. minClientVer defaults to a recent release. Lowering it lets older clients connect, but their TLS fingerprints no longer look like a real browser’s.

The minimum server side:

{
  "inbounds": [{
    "port": 443,
    "protocol": "vless",
    "settings": {
      "clients": [{ "id": "<uuid>", "flow": "xtls-rprx-vision" }],
      "decryption": "none"
    },
    "streamSettings": {
      "network": "raw",
      "security": "reality",
      "realitySettings": {
        "target": "example.com:443",
        "serverNames": ["example.com"],
        "privateKey": "<x25519 private key>",
        "shortIds": ["aa1234"]
      }
    }
  }]
}

Reality runs over TCP. Any UDP your client sends, whether that is game traffic, QUIC, or a tunnel inside the tunnel, travels inside that TCP stream, and that nesting is what costs you latency.

How Hysteria 2 pretends to be an HTTP/3 file server

Hysteria 2 is a custom QUIC protocol. It is built to hold speed on lossy networks and to look like ordinary HTTP/3 traffic. It runs a real website of its own for cover.

The server config offers three masquerade modes: serve static files from a directory, reverse-proxy a real website, or return a fixed string. Point a browser at the server and you get a plausible page. The listenHTTP and listenHTTPS options also answer on TCP ports 80 and 443. Then the server reads as a normal site that happens to offer HTTP/3.

Auth is a password. The certificate comes from Let’s Encrypt or a self-signed file. So unlike Reality, Hysteria 2 needs a domain name you own.

listen: :443

acme:
  domains:
    - vpn.example.com
  email: you@example.com

auth:
  type: password
  password: <strong-password>

masquerade:
  type: proxy
  proxy:
    url: https://example.net
    rewriteHost: true

Salamander turns every packet into random-looking bytes, and the newer Gecko layer also chops up handshake packets. Either one breaks standard QUIC, so the server stops being a valid HTTP/3 server. Random UDP noise and a normal HTTPS site are two different disguises, and you have to pick one.

Port hopping spreads the connection across a UDP port range, which sidesteps per-port rate limits. Hysteria Realms punches through NAT so you can host from a home or cellular connection with no port forwarding.

VLESS Reality vs Hysteria 2 side by side

Both are supported by the same clients, so trying them is cheap. sing-box , v2rayN, and Nekoray all speak both.

The two disguises work in opposite directions:

Which one is faster on a bad connection?

Hysteria 2 wins on a lossy line because of its Brutal congestion control. Brutal sends at a fixed rate you declare and does not slow down when packets drop. If it misses the target rate, it measures the loss and speeds up to compensate. On a transpacific path with a few percent loss, that single design choice is most of the gap.

Reality uses whatever TCP the host kernel runs. One lost packet stalls the stream until it is sent again. BBR on the server helps, but head-of-line blocking does not go away.

Brutal punishes you hard for lying about your bandwidth. The Hysteria docs warn in capitals: never set a value above what the line can carry. Overstate your capacity and you get a slow, unstable connection, wasted data, and worse speed than plain TCP.

disableLossCompensation stops the speed-up on loss. ignoreClientBandwidth lets the server refuse client bandwidth hints and fall back to BBR. Anyone running a shared box wants that one on. BBR itself has conservative and aggressive profiles, and New Reno is selectable too.

QUIC runs in userspace, so it needs more CPU per gigabyte than the kernel’s TCP stack. The project’s own performance notes say low-power devices and cheap CPU-throttled VPS plans become the bottleneck. On a clean, low-loss link the gap narrows a lot, and Reality with XTLS Vision keeps up. Treat any throughput figure quoted without a loss rate as meaningless.

Which one survives a censor’s block?

Reality survives more networks because of plain plumbing. It needs TCP 443, which no network can block without breaking the web. Hysteria 2 needs UDP, and plenty of networks throttle or drop it because little of the ordinary web depends on it.

Since 2024, China’s firewall has blocked QUIC to named domains, using a blocklist separate from the rest of its machinery. A USENIX Security paper on how China’s firewall censors QUIC by server name measured it.

The same paper shows the mechanism can be turned into a weapon that blocks UDP between arbitrary hosts in China and the rest of the world. Every UDP-only protocol carries that risk.

The researchers measured about 58,000 domains blocked over QUIC, and roughly 11,900 of those are blocked over QUIC alone.

The libraries answered first: quic-go added SNI slicing, which splits the first QUIC packet so a censor cannot rebuild the server name. sing-box picked that up within weeks, then Xray, then Hysteria. The net4people discussion of the paper tracks that timeline. An earlier report on China extending SNI censorship to QUIC had flagged the behavior before the paper landed.

A FOCI 2026 paper on Russia’s early introduction of QUIC SNI censorship dates the same trick to Russia, well before China.

Russia’s QUIC censorship is no longer limited to port 443, so Hysteria 2’s port hopping is not the escape hatch it looks like. Some tricks that work against China’s firewall also fail in Russia, because the two parse QUIC differently.

A censor can break Reality too, by checking which SNI values belong on which IP ranges and spotting you claiming a Microsoft hostname from an address Microsoft does not own. Running that check at national scale is expensive, which is why it has not been the common failure mode. Either way, a provider’s “99% DPI evasion” figure is marketing copy.

What each project shipped in 2026

The Hysteria releases show Hysteria closing the gap from its side. Version 2.11.0 added Chrome QUIC fingerprint parroting, on by default, so the client handshake looks like the browser’s. That is Reality’s uTLS trick ported to QUIC. Version 2.12.0 then added mimic, which disguises the connection as TCP for networks that restrict UDP.

Mimic attaches eBPF programs to a network interface and rewrites headers below the socket, so it runs on Linux only, needs root, and installs separately. It also cannot run alongside port hopping, and switching it on locks out every client that lacks it. Hysteria’s own notes add that it disables UDP segmentation offload, which costs throughput.

Reality has no matching move. Xray’s post-quantum work sits on the signature layer instead. It adds an optional ML-DSA-65 signature to the certificate handed to clients. A future quantum attacker then cannot break x25519 and slip into the middle. It only works when the borrowed certificate runs past 3500 bytes. That certificate needs to be large anyway, or its size becomes your fingerprint. VLESS post-quantum encryption can run alongside it, as the maintainers confirm in an Xray-core discussion on combining the two .

So which one should you run?

Match the protocol to the network in front of you.

• Network blocks, throttles, or slows UDP: pick Reality. That covers most work networks, hotel Wi-Fi, and several national firewalls.
• Lossy international link with UDP allowed: pick Hysteria 2, with the bandwidth set to the line’s real capacity.
• Gaming or voice, UDP allowed: pick Hysteria 2, because Reality tunnels your UDP inside TCP.
• Hosting from a home connection with no port forwarding: pick Hysteria 2 with Realms.
• No domain name and no wish to get one: pick Reality.

If you depend on this daily, stop choosing. Run both on the same server on different ports, and keep both in one client profile. Then switching is a single tap when conditions change, and the second protocol costs you one config block.

Do not run Brutal at an invented bandwidth figure on a shared VPS, because that is how an abuse ticket starts. And check your own country’s rules and your provider’s terms before you point any of this at a real network.