Why Your VPN Gets Detected and Blocked

Your VPN gets detected because your VPN provider is lazy, and the people blocking it are not.

The Fingerprint Your VPN Leaves Behind

Every VPN connection has a digital signature. Your VPN client, your server, your protocol version, your cipher suite—they all combine into something a firewall can recognize. The blocking software doesn't guess. It matches patterns.

OpenVPN sends a specific handshake that includes a known TLS version, a known cipher, and a known server certificate. A firewall running Deep Packet Inspection (DPI) sees that handshake and says "That's OpenVPN." Block.

WireGuard is leaner, but it still has a signature. The handshake is a fixed-length message with a specific cryptographic structure. If a firewall looks for that structure on port 51820, you're done.

The fingerprint isn't just the protocol. It's the whole stack. If your provider uses the same server certificate on every node, that certificate becomes a signature. Block one, block all.

Why Your VPN's IP Address Looks Suspicious

Your VPN's IP address is probably on a list. Commercial blocklists from companies like MaxMind, IP2Location, and Spamhaus tag entire IP ranges as "VPN" or "hosting provider." NordVPN uses the 185.198.32.0/24 range. That range is flagged. So are most of the ranges from ExpressVPN, Surfshark, and ProtonVPN.

Netflix, banking sites, and corporate firewalls all use these lists. The moment your IP resolves to a known VPN provider, you get a CAPTCHA or a block.

Self-hosted VPNs have the same problem. Your DigitalOcean droplet's IP is in the 68.65.120.0/24 range. That's a known hosting range. It's flagged. The only way around this is to buy a residential IP—a real home internet address—from a service like OxyLab or Bright Data. That costs more and requires trust.

The Port and Protocol Telltale

OpenVPN defaults to port 1194. Every firewall on the planet knows this. Blocking port 1194 is a single line in a config file. Even if you change the port, the handshake still looks like OpenVPN. The port is just the first filter.

WireGuard defaults to port 51820. Many corporate firewalls and ISP-grade blocks now specifically target this port. If you move WireGuard to port 443, you improve your odds, but the handshake is still visible to DPI.

The best port to use is 443. It's the HTTPS port. It's open everywhere. But you can't just run OpenVPN on port 443 and expect to blend in. The handshake will still be readable. You need obfuscation to make the traffic look like real HTTPS.

How Deep Packet Catches Your VPN

Deep Packet Inspection doesn't just read the port. It reads the payload. It looks at the first few packets of any connection and tries to classify them. OpenVPN's control channel is plaintext for the first few bytes. DPI sees "OpenVPN" in the data. Block.

WireGuard is encrypted from the first packet, but the packet size and timing are distinct. A DPI system can measure packet lengths and inter-packet delays. WireGuard packets are all the same size—144 bytes. Real HTTPS traffic is variable. That pattern alone can trigger a block.

Chinese firewalls have been doing this for years. Now corporate firewalls and ISPs are adopting the same techniques. The Stealth setting in ProtonVPN uses a custom TLS wrapper to make the traffic look like a real TLS 1.3 handshake. It works against most DPI systems. ExpressVPN's Lightway protocol with its "Stealth" mode performed well in a 2023 test by VPNpro against Chinese-level DPI. It bypassed the block. But DPI evolves. What works today may not work next month.

When Obfuscation Actually Works (and When It Doesn't)

Obfuscation tools like Obfsproxy, Shadowsocks, and custom TLS wrappers work by making your VPN traffic look like something else. Usually HTTPS.

Shadowsocks is not a VPN. It's a proxy. It encrypts traffic and wraps it in a random-looking payload. It runs on any port, including 443. It's harder to detect than OpenVPN because it has no fixed handshake. But Shadowsocks has been blocked in China since 2018. The Chinese firewall learned to recognize Shadowsocks by analyzing packet sizes and connection patterns.

Obfsproxy is available in OpenVPN-based clients from Surfshark and ExpressVPN. It wraps OpenVPN traffic in an HTTP or HTTPS layer. On port 443, it looks like a normal web connection to a firewall that doesn't look too hard. Against a sophisticated DPI system, the wrapper itself has a signature. If the firewall knows what Obfsproxy looks like, it blocks it.

ProtonVPN's Stealth mode uses a custom TLS wrapper. It's more sophisticated than Obfsproxy because it mimics a real TLS 1.3 handshake with proper certificates. It worked in the VPNpro test. But it's slower. A 2023 test showed a 30% speed drop compared to standard WireGuard.

Obfuscation works against most firewalls. It does not work against a determined state-level firewall that updates its signatures daily. If you need to bypass that level of control, you need a custom solution, not a consumer VPN.

What to Do If Your VPN Is Blocked Right Now

Step 1: Change the port

Move your VPN to port 443. If you're using OpenVPN, change the config. If you're using WireGuard, change the ListenPort. This gets you past port-based blocks. It does not get you past DPI.

Step 2: Enable obfuscation

If your provider supports it, turn on obfuscation. ExpressVPN calls it "Stealth." Surfshark calls it "Camouflage Mode." ProtonVPN calls it "Stealth." These settings wrap your traffic in a TLS wrapper. They make the handshake look like HTTPS. Most corporate and ISP firewalls will pass this traffic.

Step 3: Switch protocol

If OpenVPN is blocked, try WireGuard. If WireGuard is blocked, try OpenVPN with obfuscation. If both are blocked, try Shadowsocks. ExpressVPN's Lightway protocol has built-in obfuscation and performed well against DPI in independent tests.

Step 4: Change your IP

If your provider's IP range is blocked, you need a new IP. Some providers offer "dedicated IP" for an extra fee. ExpressVPN charges $12.95/month for the base service. A dedicated IP is extra. Alternatively, you can self-host a WireGuard server on a VPS from DigitalOcean for $6/month. That gives you a fresh IP, but it's still a hosting IP. It will be flagged eventually.

Step 5: Use a residential proxy as a fallback

If you need to access a site that blocks all VPN and hosting IPs, you need a residential proxy. Services like Bright Data or OxyLab sell access to real home IPs. You route your traffic through those IPs. It's slower and costs more, but it works. Bright Data charges about $15 per GB of traffic.

Step 6: Test with a DPI check tool

Use a tool like DPI Check (available on GitHub) to see if your connection is being inspected. Run it while connected to your VPN. It will tell you if your traffic is being modified or blocked. If it is, you need a different obfuscation method.

Try the steps in this order. Most blocks are solved by moving to port 443 and enabling obfuscation. If that fails, change providers. Not all VPNs invest in DPI bypass. ProtonVPN, ExpressVPN, and Surfshark do. Most others do not.

Part of our guide to How Network Blocks Work, and How To Get Around Them.