The 4 Tiers of VPNs:

🟢 Tier 1 — Easy to identify
WireGuard, OpenVPN/UDP, IKEv2, L2TP. Fast and simple, but have clear packet signatures. Fine on most networks, first to get filtered where traffic gets inspected.

🟡 Tier 2 — TLS-wrapped, still fingerprintable
OpenVPN/TCP, SOCKS proxies. Looks like HTTPS at a glance, but the handshakes have quirks that distinguish them from real browsers.

🟠 Tier 3 — Camouflaged as web traffic
Shadowsocks, OpenConnect, OpenVPN+XOR, SoftEther. Blends in well against simple inspection. More advanced detection (entropy analysis, active probing) can still spot them.

🔴 Tier 4 — Indistinguishable from web traffic
v2ray, VLESS, wstunnel, Cloak. Not VPNs themselves — mimicry layers you bolt onto a tunnel. Cloak even serves a real "donor" website to anyone probing your server 🎭

The takeaway: run more than one. WireGuard for speed, a Tier 3/4 stack as a fallback.

Read more 👉 https://www.doprax.com/blog/self-hosted-vpns-how-they-work-and-why-the-protocol-you-choose-matters