How ISPs block VPNs: deep packet inspection
Deep packet inspection (DPI) is when a network looks past the address on a packet and examines the traffic itself — its size, timing, and the byte patterns of a connection's opening handshake. VPN blocking on restrictive networks is mostly DPI: the network recognises a VPN handshake and throttles or drops it. That is why a VPN can work one hour and fail the next, and why switching protocol often fixes it while switching apps does not.
What DPI can and cannot see
A VPN encrypts the *contents* of your traffic, so DPI cannot read the websites you visit inside the tunnel. But the tunnel itself has a shape:
- Handshake fingerprint — the first packets of a WireGuard or OpenVPN connection have recognisable structure and sizes.
- Port and protocol — classic VPN ports (1194, 51820, 500/4500) and raw UDP stand out.
- Traffic pattern — a steady high-bandwidth flow to a single IP for hours looks different from normal browsing.
- Destination — the server IP may already be on a block list.
Blocking uses any of these. The more your VPN traffic resembles an ordinary visit to a normal website, the less DPI has to work with.
Why WireGuard is blocked first
WireGuard is fast and simple, which is also its weakness under DPI. It runs over UDP, its handshake is a fixed, distinctive size, and it has no built-in disguise. Networks that fingerprint protocols catch it quickly. OpenVPN is a little more flexible — it can run over TCP on port 443 — but its handshake is still identifiable, and dedicated DPI catches OpenVPN too.
This is covered in more depth in VLESS vs WireGuard on restricted networks.
What gets past DPI
- TLS camouflage — wrapping the tunnel so it looks like a normal HTTPS connection to a normal website on port 443. Most "stealth" and "obfuscation" modes do a version of this.
- No fixed handshake — transports like VLESS carry very little of their own signature; the disguise comes from the TLS layer around them.
- Anti-probing — some networks actively connect to a suspected VPN server to test it. The Reality transport is built to make that probe see a real, unrelated website instead. See what Reality is.
- Blending in — port 443, ordinary-looking traffic timing, and rotating server addresses all reduce the signal.
None of this is permanent. DPI vendors adapt, and so do VPNs. The practical takeaway on a restrictive network is to use a transport designed to blend in, and to be able to test it on your own connection.
Where AVEE fits
AVEE uses VLESS with Reality so that, by default, the connection looks like ordinary TLS web traffic and resists active probing. It is not immune to DPI — nothing is — but it starts from a much smaller fingerprint than WireGuard or OpenVPN. You can test it free (about 1 GB, up to 3 days) on the network that is giving you trouble. See the country guides for Pakistan and Turkey.
AVEE uses VLESS/Reality and lets you test compatibility on your connection before paying.
FAQ
- Can DPI see which websites I visit through a VPN?
- No. The contents are encrypted. DPI works on the shape of the tunnel — handshake pattern, port, traffic timing, and destination IP — not the pages inside it.
- Does a VPN over port 443 always get past DPI?
- It helps, but no. Advanced DPI still fingerprints the OpenVPN or WireGuard handshake even on 443. Port 443 plus TLS camouflage is much stronger than port 443 alone.
- What is "active probing"?
- The network connects to a server it suspects is a VPN and checks how it responds. If it does not behave like a normal web server, the network blocks it. The Reality transport is designed to defeat this.
Sources
- BleepingComputer — how DPI identifies VPN protocols by signature — checked 2026-08-29