How to choose
- High stability demand, daily browsing → Reality.
- CDN or TCP-443-only paths → VLESS-WS.
- Throughput or lossy paths → Hysteria2; system VPN → AmneziaWG. Stock WireGuard is leftover only.
Documented by what we deploy. Primaries include Reality / VLESS-WS / Hysteria2 / AmneziaWG; Trojan / WireGuard / SS / OpenVPN per node.
Complex nets · browsing
TLS 1.3 standard HTTPS protocol encapsulation.
Read the protocol pageCDN / TCP 443 edge
VLESS + WebSocket + TLS. CDN can terminate 443; origin defaults to 8443. Skip cert verify for self-signed.
Read the protocol pageStreaming · bulk · games
QUIC. Better throughput when packets drop.
Read the protocol pageSystem VPN · anti-DPI
Kernel tunnel with Amnezia obfuscation. Import conf in the official Amnezia client; do not run beside stock WireGuard.
Read the protocol pageLegacy compatibility
Light and fast when the path is calm. New rollouts prefer AmneziaWG. Subscription includes the public key.
Read the protocol pageTLS-compatible clients
Self-signed TLS tunnel. Skip cert verify where the client requires it.
Read the protocol pageLegacy clients
Classic proxy stack on selected nodes.
Read the protocol pageEnterprise / legacy clients
Classic VPN stack on selected nodes.
Read the protocol pageBy what we actually deploy. A node may not run every protocol.
| Protocol | Role | Transport | Fit |
|---|---|---|---|
| VLESS-Reality | Primary | TCP + TLS | Complex nets · browsing |
| VLESS-WebSocket | Primary | TCP + TLS | CDN / TCP 443 edge |
| Hysteria2 | Primary | QUIC / UDP | Streaming · bulk · games |
| AmneziaWG | Primary | UDP | System VPN · anti-DPI |
| WireGuard | Support | UDP | Legacy compatibility |
| Trojan | Support | TCP + TLS | TLS-compatible clients |
| Shadowsocks | Support | TCP | Legacy clients |
| OpenVPN | Support | UDP | Enterprise / legacy clients |
协议写清楚,节点看得见。