Connecting on restrictive networks: obfuscation, HTTPS-like transport and troubleshooting
Hotel Wi-Fi, office firewalls and national filters often block VPNs by recognising them, not by reading your data. Here is how REALITY makes a VPN connection look like ordinary HTTPS, and what to try when you still can't connect.
You open your VPN on hotel Wi-Fi, at the office or in another country, tap connect, and nothing happens. The network hasn't broken your encryption. It has simply recognised that you are using a VPN and blocked it.
How networks detect VPNs
A firewall doesn't need to read your traffic to block it. It looks at the shape of the connection:
- Ports. Many corporate and hotel networks only allow web traffic (ports 80 and 443) and block everything else, including WireGuard's UDP port.
- Handshake fingerprints. OpenVPN, IKEv2 and WireGuard each start a connection with a recognisable pattern. Deep packet inspection (DPI) systems learn those patterns and drop them.
- Active probing. Stricter national firewalls go further: they connect to suspected VPN servers themselves to confirm what they are, then block them.
Strong encryption doesn't help against any of this. What helps is a connection that doesn't look like a VPN at all.
How SecureFox stays connected: VLESS over REALITY
For restrictive networks, SecureFox uses VLESS with the REALITY transport:
- The connection runs over TCP port 443, the same port every HTTPS website uses.
- The handshake is a genuine TLS 1.3 handshake that mirrors a real, well-known website, with a browser-like fingerprint. To an observer, you are simply visiting that site.
- If a firewall probes the server, it sees the real website's certificate. There's no VPN signature to learn and nothing obviously wrong to block.
Inside that disguise, your traffic is still encrypted end-to-end to the SecureFox server, and on our VLESS servers the key exchange is post-quantum hybrid (ML-KEM-768 + X25519).
WireGuard is great on open networks, but its handshake is easy to recognise and it needs UDP. On a restrictive network, VLESS + REALITY is usually the one that gets through.
Troubleshooting checklist
If you can't connect, work through these steps in order:
- Finish the captive portal first. Hotel, airport and train Wi-Fi often require you to accept terms in a browser page before any traffic is allowed. Open a normal website, complete the login page, then connect the VPN.
- Switch the protocol to VLESS. In Settings → Protocol, choose VLESS instead of WireGuard (or Auto). This moves you to the HTTPS-like transport on port 443.
- Try another server. In the server list, sort by Lowest Load or Lowest Ping and try two or three different locations. A single server or IP range can be blocked while others still work.
- Check the time on your device. TLS handshakes fail if your phone's clock is far off. Turn on automatic date and time.
- Toggle airplane mode or switch networks. Moving between Wi-Fi and mobile data gives you a fresh connection, and mobile networks are often less restrictive than public Wi-Fi.
- Keep the kill switch on. While the app retries, the kill switch makes sure nothing leaks over the unprotected network.
- Collect diagnostics. If it still fails, open Diagnostics in the app and send the log to support@securefox.xyz with the network type and location. It contains engine messages only, not your browsing.
A note on expectations
No VPN can promise to beat every firewall all of the time. Well-resourced national filters keep changing. What REALITY gives you is a connection with no VPN fingerprint for them to target, which is considerably more resilient than traditional VPN protocols.
Next step: if you're about to travel or use a network you know is strict, set Settings → Protocol to VLESS before you go, so you're not troubleshooting at the airport.