Most proxies ride TCP, and TCP interprets packet loss as congestion — so when a censor deliberately drops packets to throttle you, a TCP proxy politely slows down to a trickle. Hysteria2 runs over QUIC (UDP) with a congestion controller designed to power through loss instead of backing off, so a network engineered to be frustrating stays usable. On the wire it masquerades as HTTP/3 — increasingly common, ordinary traffic — and its Salamander obfuscation scrambles the packet headers a DPI box would look at. Where REALITY optimizes for stealth, Hysteria2 optimizes for speed under adversarial conditions.
What the protocol actually is, how it hides, and where it's strongest — described honestly. No proxy is magic; the right one for your network is.
A proxy is a tiny process — it needs a clean IP and steady bandwidth, not a big machine. Every plan is unmetered NVMe VPS with full root, rented with a token and paid in crypto.
Closest latency to Iran, Turkey and the Gulf comes from Netherlands and Romania; Moldova is the budget pick. For Russia any European node is fine. QUIC's loss tolerance means Hysteria2 forgives a longer path better than most, so even a slightly distant node stays usable.
From a blank VPS to a working endpoint. Commands are copy-paste ready for Ubuntu 24.04.
VPS-S is enough. Pick the jurisdiction closest to you — Netherlands or Romania for Iran and Turkey. Pay in crypto, get root on a clean IP.
Key-only SSH, then allow UDP on 443 in the firewall — Hysteria2 is UDP, not TCP, so this step matters.
One official install script drops in the single binary and a systemd unit.
bash <(curl -fsSL https://get.hy2.sh/)A short YAML: listen on :443, a self-signed cert (fine here), Salamander obfs with a password, and an auth password. That's the whole file.
# /etc/hysteria/config.yaml
listen: :443
tls:
cert: /etc/hysteria/cert.pem # self-signed is fine
key: /etc/hysteria/key.pem
obfs:
type: salamander
salamander:
password: CHOOSE_A_SECRET
auth:
type: password
password: CHOOSE_A_SECRETImport the hy2:// URI into NekoBox, v2rayN, sing-box or Streisand. On a throttled network the difference from a TCP proxy is immediate.
systemctl enable --now hysteria-server
# import the hy2:// URI into NekoBox, v2rayN, sing-box or StreisandCensorship isn't always a wall — often it's a swamp. Regulators tell carriers to degrade international traffic: inject packet loss, add latency, cap throughput. TCP treats every lost packet as a sign of congestion and backs off, so a TCP-based proxy crawls to a stop exactly when you need it. Hysteria2 runs on QUIC and uses a congestion controller (based on Brutal) that treats loss as noise, not a stop sign — it keeps sending at the bandwidth you configured. On a network engineered to be miserable, that's the difference between a video call that connects and one that spins forever.
Raw QUIC has a recognizable handshake, so Hysteria2 adds Salamander — an obfuscation layer that scrambles the packet headers a DPI box inspects, making the stream look like generic encrypted UDP. Combined with running on 443/UDP (where legitimate HTTP/3 lives), there's little for a censor to fingerprint without blocking QUIC wholesale — which breaks a growing share of the normal web and carries real collateral cost. Set a strong Salamander password and your obfuscation is unique to your server.
If your problem is 'they can tell it's a proxy and block it', REALITY's stealth is the answer. If your problem is 'it connects but it's unusably slow', Hysteria2 is the answer. In practice, Iran's throttling makes Hysteria2 a favorite there, while China's active probing makes REALITY the default. Because you have full root, the pragmatic move is to run both on one VPS — Hysteria2 on UDP/443, REALITY on TCP/443 isn't possible on the same port, so use a second port — and switch clients depending on what the network is doing that week.
Some networks throttle or rate-limit UDP, and a few block QUIC outright during crackdowns — it's the main scenario where Hysteria2 struggles and a TCP protocol like REALITY or Shadowsocks wins. But blanket-blocking UDP/443 also breaks HTTP/3 for the whole population, so censors are reluctant to keep it up. The honest guidance: try Hysteria2 first if your issue is speed; keep a TCP-based fallback on the same box for the periods when UDP is squeezed. Rotating between the two covers almost every situation.
Related reading: Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN · The First Hour of VPS Hardening: A Checklist · Self-hosted VPN use case