VPNs are widely used to bypass content blocks and avoid censorship. A standard VPN setup is usually sufficient to unblock Netflix libraries. But bypassing sophisticated restrictions like the Great Firewall of China requires specialty obfuscated servers.
Out of the 30 we tested, only 5 didn’t have obfuscated servers or failed to make an obfuscated connection. There’s also a huge difference in how providers handle VPN obfuscation.
For example, Mullvad provides multiple obfuscation options, with one designed specifically for the WireGuard protocol. Meanwhile, IPVanish changes how its OpenVPN protocol routes data to avoid detection. Let’s dig into the different VPN obfuscation methods and see when exactly you should use them.
What Are Obfuscated Servers?
A VPN encrypts your traffic, protecting it from third-party surveillance. But it doesn’t hide the fact that you are using a VPN. To achieve this, VPNs offer specialty obfuscated servers.
Governments, ISPs (Internet Service Providers), and even streaming sites use several methods to identify and restrict VPN users. Streaming sites usually resort to IP lookup, identifying data center VPN IP addresses instead of the residential IPs that non-VPN internet users have.
Deep packet inspection (DPI) is a highly sophisticated VPN identification method. It searches for patterns that VPN protocols inevitably have. For example, the WireGuard protocol’s handshake initiation is always a 148-byte packet, which is a clear giveaway. The default OpenVPN port (the gateway to the internet) is 1194, which is another clear giveaway.
That’s where VPN obfuscation comes in. It aims to scramble these specific digital fingerprints that fall outside the encryption scope. In layman’s terms, it wraps VPN traffic in the kind of packaging that ordinary HTTPS traffic uses.
Obfuscation should not be confused with encryption. Encryption ensures data confidentiality, so that only the two authorized parties can inspect what is being sent. It also takes care of integrity, ensuring that data-in-transit has not been tampered with.
Meanwhile, obfuscation ensures VPN connection availability on restricted networks. Whether it’s a local university or workplace block or a nation-wide firewall blackout, it aims to pass through and grant access to the resources you want.
How Does VPN Obfuscation Work?
Essentially, VPN obfuscation modifies VPN traffic to look like ordinary HTTPS traffic or just random bits of data. Some methods are straightforward, used to bypass simple restrictions, while others are highly complex for challenging blocks.
The simplest method is switching the OpenVPN TCP port from 1194 to 443. The latter is the default port that HTTPS traffic uses. Light restrictions on university campuses and similar networks block port 1194 to deny VPN connections, which are then reestablished on the HTTPS port. However, this only changes the destination port without modifying the OpenVPN traffic itself.
Using the Shadowsocks proxy protocol is a more effective method. It was primarily designed to bypass the Great Firewall of China and is used to defeat deep packet inspection in general.
Shadowsocks, which runs on the client’s device, acts as an encrypted proxy. It re-encrypts the tunneled traffic and adds its own encrypted header, hiding the VPN’s protocol signature. To simplify, the observing firewall only sees a chaotic random stream of bytes, which evades automated DPI triggers.
TLS/SSL encapsulation is yet another method. It uses the Stunnel open-source library to wrap standard VPN traffic inside HTTPS, as explained by Windscribe. Once again, detection methods cannot separate it from an ordinary online data flow.
Why and When You Should Use Obfuscated Servers
VPN obfuscation can be highly complex. That means it adds significant overhead, which slows down the internet connection speed and drains the battery.
We recommend using obfuscated servers mainly to bypass network blocks. It’s very useful when facing lighter restrictions, like those at universities, libraries, or some public Wi-Fi networks that block VPN ports. For example, if you choose Surfshark’s OpenVPN TCP protocol, it will automatically use the default HTTPS port to avoid such blocks.
We strongly recommend the more complex methods if you live in or travel to authoritarian countries (like China, Russia, and Iran). The advanced VPN obfuscation methods you’ll find on the Mullvad and Windscribe apps are a more effective and safer option. Surfshark’s equivalent is NoBorders, and NordVPN offers its obfuscated NordWhisper protocol.
We do not recommend obfuscated servers for general online privacy protection. Their main goal is to maintain VPN connection availability. In reality, strong AES-256 encryption with a no-logs VPN policy is more than enough to protect your online data.
We also don’t recommend them for streaming. Streaming services rely on IP lookup and blocklisting to identify VPN IP addresses from data centers and restrict their access. Obfuscated servers do not change your IP and are not optimized for streaming.
How To Enable VPN Obfuscation
Connecting to obfuscated servers is easy, but the exact steps depend on your chosen VPN provider.
In Surfshark, which is the one I use, go to Settings → VPN settings and enable the NoBorders feature found under the Advanced Security section at the very bottom. Alternatively, you can choose the OpenVPN TCP protocol, as explained above.
In NordVPN, go to Settings → Connection and security → VPN protocol and select the NordWhisper protocol. Alternatively, you can choose obfuscated servers from its specialty server list.
In Windscribe, simply click the protocol option near the top of the app and choose the Stealth protocol from its list.
