[{"data":1,"prerenderedAt":76},["ShallowReactive",2],{"blog-post-self-hosted-vpns-how-they-work-and-why-the-protocol-you-choose-matters":3},{"id":4,"meta":5,"title":21,"author":22,"body":26,"introduction":64,"date":65,"tags":66,"category":74,"blog_image":75,"intro":64,"featured":10},1200,{"type":6,"detail_url":7,"html_url":8,"slug":9,"show_in_menus":10,"seo_title":11,"search_description":11,"first_published_at":12,"alias_of":13,"parent":14},"blog.BlogPage","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fapi\u002Fv2\u002Fpages\u002F1200\u002F","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fdoprax-blogs\u002Fself-hosted-vpns-how-they-work-and-why-the-protocol-you-choose-matters\u002F","self-hosted-vpns-how-they-work-and-why-the-protocol-you-choose-matters",false,"","2026-04-22T08:32:39.915676Z",null,{"id":15,"meta":16,"title":20},109,{"type":17,"detail_url":18,"html_url":19},"blog.BlogIndexPage","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fapi\u002Fv2\u002Fpages\u002F109\u002F","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fdoprax-blogs\u002F","Doprax Blogs","Self-Hosted VPNs: How They Work, and Why the Protocol You Choose Matters",{"id":23,"username":24,"full_name":25},5,"Swetlana","Swetlana A",[27,34,40,46,52,58],{"type":28,"value":29,"id":33},"section",{"title":30,"content":31,"subsections":32},"VPN ≠ VPN","\u003Cp data-block-key=\"wxfkz\">What surprises a lot of people the first time they try it is how differently various VPN setups behave on real-world networks. Two servers running \"a VPN\" can have completely different reliability on hotel Wi-Fi, corporate guest networks, mobile carriers, or any network that does some form of traffic inspection. The difference usually comes down to the protocol.\u003C\u002Fp>\u003Cp data-block-key=\"aqnu6\">This post walks through how modern VPN protocols compare from a detection and reliability standpoint, and what that means if you're deploying one yourself.\u003C\u002Fp>",[],"4b106752-c220-4f6b-98c9-2ee08fae56d7",{"type":28,"value":35,"id":39},{"title":36,"content":37,"subsections":38},"Why managed VPN services can be flaky","\u003Cp data-block-key=\"wxfkz\">Before getting into protocols, it's worth understanding why commercial consumer VPNs sometimes stop working on particular networks. A few structural reasons:\u003C\u002Fp>\u003Ch2 data-block-key=\"33cfc\">\u003Cb>Shared IP ranges\u003C\u002Fb>\u003C\u002Fh2>\u003Cp data-block-key=\"7qqna\">Large VPN providers rent IP space from a small pool of datacenter operators. Those ranges are well-known and often end up on blocklists used by streaming services, banks, corporate firewalls, and public Wi-Fi providers. Your tunnel works fine; the destination just refuses traffic coming from that subnet.\u003C\u002Fp>\u003Ch2 data-block-key=\"ce1hn\">\u003Cb>Control-plane dependencies\u003C\u002Fb>\u003C\u002Fh2>\u003Cp data-block-key=\"dvihm\">Many commercial clients phone home to a login or config server before they establish the tunnel. If that control plane is unreachable — or gets filtered — the client fails to connect even when the VPN servers themselves are up.\u003C\u002Fp>\u003Ch2 data-block-key=\"3qjrb\">\u003Cb>Protocol fingerprints\u003C\u002Fb>\u003C\u002Fh2>\u003Cp data-block-key=\"att7q\">Most commercial services default to standard protocols that are easy to identify with deep packet inspection (DPI). Networks that filter by traffic class, not just by destination, can tag and drop these flows.\u003C\u002Fp>\u003Cp data-block-key=\"5iuu0\">A self-hosted VPN sidesteps the first two problems automatically: you pick your own IP, and there's no third-party control plane. The third one — fingerprinting — is where protocol choice becomes interesting.\u003C\u002Fp>",[],"5c0ecebc-c1ba-4676-bf74-2a4d93191ff9",{"type":28,"value":41,"id":45},{"title":42,"content":43,"subsections":44},"The four tiers of VPN protocols","\u003Cp data-block-key=\"wxfkz\">It's useful to sort VPN protocols by how easy they are to distinguish from ordinary traffic. Think of it as a spectrum from \"obviously a VPN\" to \"indistinguishable from a normal web request.\"\u003C\u002Fp>\u003Cp data-block-key=\"1325n\">\u003C\u002Fp>\u003Cimg alt=\"The four tiers of VPN protocols: It's useful to sort VPN protocols by how easy they are to distinguish from ordinary traffic. Think of it as a spectrum from "obviously a VPN" to "indistinguishable from a normal web request."\" class=\"richtext-image full-width\" height=\"436\" src=\"\u002Fd\u002Fmedia\u002Fimages\u002FDoprax-self-hosted-vpn-wireguard-shadowsocks-c.width-800.jpg\" width=\"800\">\u003Cp data-block-key=\"6bvvv\">\u003C\u002Fp>\u003Ch2 data-block-key=\"e3tes\">\u003Cb>Tier 1 — easy to identify\u003C\u002Fb>\u003C\u002Fh2>\u003Cp data-block-key=\"e2120\">WireGuard, OpenVPN in UDP mode, IKEv2, and legacy protocols like L2TP. These have simple, stable packet signatures; some can even be matched on port number alone. Perfectly fine on networks that don't filter by traffic class, which is most networks. But if a network does any protocol-level inspection, these are the first to get dropped or throttled.\u003C\u002Fp>\u003Ch2 data-block-key=\"etqie\">\u003Cb>Tier 2 — TLS-based, but still fingerprintable\u003C\u002Fb>\u003C\u002Fh2>\u003Cp data-block-key=\"92lov\">Protocols that wrap themselves in TLS, like OpenVPN in TCP mode or standard SOCKS proxies. In principle they should look like HTTPS. In practice the TLS handshakes have subtle quirks that distinguish them from real browsers, and those quirks make decent fingerprints for anyone doing TLS inspection.\u003C\u002Fp>\u003Ch2 data-block-key=\"b5n80\">\u003Cb>Tier 3 — camouflaged as web traffic, mostly convincingly\u003C\u002Fb> \u003C\u002Fh2>\u003Cp data-block-key=\"avd4a\">Protocols like OpenConnect\u002FAnyConnect, OpenVPN with the XOR patch, Shadowsocks, and SoftEther tunnels. They look a lot like normal web traffic, and simple DPI rules won't catch them. More sophisticated detection can still succeed though — for example by analyzing the statistical entropy of headers, or by \"active probing,\" where the inspecting system itself tries to open the same destination as a normal web client to see if it behaves like a real web server.\u003C\u002Fp>\u003Ch2 data-block-key=\"6stfd\">\u003Cb>Tier 4 — genuinely hard to distinguish from web traffic\u003C\u002Fb> \u003C\u002Fh2>\u003Cp data-block-key=\"ecn0u\">This is where modern obfuscation plugins live: v2ray, VLESS, wstunnel, Cloak, and others. These aren't VPN protocols on their own — they're mimicry layers you bolt onto an existing tunnel. The design separates \"the thing carrying your data\" from \"what the thing looks like on the wire,\" and it lets you update one without touching the other.\u003C\u002Fp>\u003Cp data-block-key=\"42kv6\">That separation got standardized as \u003Cb>Pluggable Transports\u003C\u002Fb>, an interface originally designed for Tor in 2012. Shadowsocks added support later, and in the last few years OpenVPN has gained unofficial Pluggable Transport support as well. The practical result is that you can mix and match: pick a tunnel you trust, pick a camouflage layer that suits your network environment, and combine them.\u003C\u002Fp>",[],"f495e265-ca51-4b24-9281-69d3ead89b90",{"type":28,"value":47,"id":51},{"title":48,"content":49,"subsections":50},"Cloak, and why the \"donor website\" idea is clever","\u003Cp data-block-key=\"e5np7\">\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fcbeuw\u002FCloak\">Cloak (by Andy Wang \u002F cbeuw on GitHub)\u003C\u002Fa> is worth calling out because it takes the mimicry idea further than most. Older tools like obfs4 randomize traffic so it doesn't look like any particular protocol. Cloak does something more active: you configure a \u003Ci>donor website\u003C\u002Fi>, and when anyone who isn't a valid client connects to your server, they get served that site's real content.\u003C\u002Fp>\u003Cp data-block-key=\"7kfmm\">Concretely, if someone probes your server without the right handshake, they get what looks like an ordinary website — because that's what your server is also serving. The real VPN clients authenticate via a hidden handshake the probe doesn't know about. To outside observers, your host is indistinguishable from a vanilla web server.\u003C\u002Fp>\u003Cp data-block-key=\"bd9vp\">It isn't magic. A poorly configured TLS certificate will still give you away — but it's probably the most robust obfuscation approach widely available in open-source form today.\u003C\u002Fp>",[],"62eaa26d-6845-4265-90ff-c7f3c86ed8c2",{"type":28,"value":53,"id":57},{"title":54,"content":55,"subsections":56},"Putting it together on your own VM","\u003Cp data-block-key=\"e5np7\">The nice thing about self-hosting is that you can choose exactly the stack you want, and change it later if a particular network gives you trouble. A reasonable setup on a cloud VM might look like:\u003C\u002Fp>\u003Col>\u003Cli data-block-key=\"8dj8n\">\u003Cb>A VM with a clean IP.\u003C\u002Fb> Any general-purpose VM on a developer-focused cloud works; you just want somewhere you control the networking and can expose the ports you need. (This is a natural fit for a \u003Ca href=\"https:\u002F\u002Fwww.doprax.com\u002F\">Doprax VM\u003C\u002Fa>, which gives you a dedicated IP and lets you spin up and tear down instances per-hour.)\u003C\u002Fli>\u003Cli data-block-key=\"d94ri\">\u003Cb>A tunnel protocol.\u003C\u002Fb> WireGuard is fast, modern, and easy to configure — a great default when you're not worried about DPI. OpenVPN is a solid fallback when you want more flexibility in how it's wrapped.\u003C\u002Fli>\u003Cli data-block-key=\"2cf8n\">\u003Cb>An obfuscation layer, if needed.\u003C\u002Fb> If your target network does any protocol inspection, put Cloak or a similar pluggable transport in front of the tunnel and run it on TCP\u002F443. To outside observers, your server looks like it's serving a website.\u003C\u002Fli>\u003C\u002Fol>\u003Cp data-block-key=\"4btpn\">Projects like \u003Ca href=\"https:\u002F\u002Famnezia.org\u002F\">AmneziaVPN\u003C\u002Fa> package this whole stack — WireGuard, OpenVPN, IKEv2, Shadowsocks, and OpenVPN\u002FShadowsocks over Cloak — with a point-and-click installer that connects to your server over SSH and deploys each service in its own Docker container. Each container exposes a single port and speaks a single protocol, which keeps the setup auditable. The project is open source, and went through an independent security audit by 7ASecurity (funded by the Open Technology Fund) with a \u003Ca href=\"https:\u002F\u002Fwww.opentech.fund\u002Fresults\u002Fsecurity-safety-audits\u002Famnezia-vpn-apps-mobile-desktop-pentest-report\u002F\">public report\u003C\u002Fa>.\u003C\u002Fp>\u003Cp data-block-key=\"9vqc8\">You can also assemble the pieces yourself. Docker images for WireGuard, OpenVPN, Shadowsocks, and Cloak are all maintained and well-documented, and any cloud VM with a public IP is enough to host them.\u003C\u002Fp>",[],"3a508662-5a21-4dc6-8b16-6bfdba162f2b",{"type":28,"value":59,"id":63},{"title":60,"content":61,"subsections":62},"Practical takeaways","\u003Cp data-block-key=\"e5np7\">A few things worth keeping in mind if you're deploying a VPN for yourself or a small team:\u003C\u002Fp>\u003Cp data-block-key=\"8efi9\">A single protocol is a single point of failure. It's cheap to run more than one — for instance WireGuard for speed on normal networks, plus a Cloak-wrapped fallback for the cases where plain WireGuard gets filtered. Flip between them as needed.\u003C\u002Fp>\u003Cp data-block-key=\"ec2nf\">Stable, unlisted IPs matter more than most people think. A dedicated IP on a VM you control won't be on any commercial VPN blocklist, which tends to be the actual cause of \"why does this site not load over my VPN\" complaints.\u003C\u002Fp>\u003Cp data-block-key=\"eb6po\">And if you care about the tunnel actually being private, self-hosting on infrastructure you control is a much stronger story than trusting any provider's no-logs claim. The server, the keys, and the logs (if any) all belong to you.\u003C\u002Fp>\u003Cp data-block-key=\"tv1b\">Whether you use a packaged tool like AmneziaVPN or roll your own stack out of Docker images, the economics have shifted. A personal VPN used to mean either paying a subscription or managing a server carefully by hand. On a modern developer cloud, it's closer to a ten-minute project.\u003C\u002Fp>",[],"b19a1ec6-0805-4c1e-9543-c465c47f935a","\u003Cp data-block-key=\"vvepb\">Running your own VPN has become a pretty common use case : for teams that want a private entry point into their infrastructure, for developers testing geo-specific behavior, for travelers who want a stable exit IP, or just for anyone who prefers to own the tunnel rather than rent it. Spinning one up on a VM takes minutes.\u003C\u002Fp>","2026-04-22",[67,68,69,70,71,72,73],"dpi","ikev2","openvpn","private vpn server","shadowsocks","vpn","wireguard","updates","\u002Fd\u002Fmedia\u002Foriginal_images\u002FDoprax-self-hosted-vpn-wireguard-shadowsocks-cloak-dpi-vless-docker_2.png",1792480193067]