Protocol Guide
VPN Protocols
OrbVPN ships four battle-tested tunnel protocols — WireGuard, VLESS, OrbConnect, and SSH Tunnel — each engineered for a different mission. Pick the right one, or let Smart Connect choose for you.
Protocol Overview
A VPN protocol defines how your data is encrypted, transmitted, and authenticated between your device and the VPN server. Different protocols make different tradeoffs between speed, security, and the ability to bypass network restrictions. OrbVPN gives you four production-ready tunnel protocols — plus Auto (Smart Connect), which races them for you and picks whichever combination of protocol, transport, and disguise actually works on your network right now.
WireGuard
Fast, modern, and lightweight. The newest generation of VPN technology — the speed champion for open networks.
VLESS
Censorship-resistant by design. Its default Reality transport makes your traffic indistinguishable from real HTTPS to major websites.
OrbConnect
OrbVPN's own HTTPS-tunnel protocol, written in pure Go with FIPS 140-3 cryptography. Looks like ordinary web traffic; survives the hardest networks.
SSH Tunnel
A secure-shell tunnel with optional obfuscation (OSSH). Blends with legitimate SSH/HTTPS traffic and slips through deep packet inspection.
Reality is a VLESS transport, not a separate protocol
You will not find a standalone "Reality" entry in the protocol picker. Reality is the default obfuscation transport of VLESS (XTLS-Vision). When you choose VLESS, Reality is doing the stealth work under the hood. See the VLESS transport section below.
Coming Soon: OrbX Native
A fifth protocol, OrbX Native, is in development and will appear in the picker when it ships. Everything documented here is available and shipping today across iOS, Android, macOS, Windows, Linux, Android TV, and FireTV.
WireGuard
WireGuard is a modern, open-source VPN protocol that has rapidly become the industry standard for high-performance VPN connections. Its lean codebase and state-of-the-art cryptography deliver exceptional speed with minimal overhead.
Best-in-Class Speed
WireGuard's streamlined architecture and efficient cryptographic primitives deliver the fastest speeds of any VPN protocol, often with negligible impact on throughput.
Modern Cryptography
Uses ChaCha20 for encryption, Poly1305 for authentication, Curve25519 for key exchange, and BLAKE2s for hashing. All state-of-the-art algorithms.
Minimal Attack Surface
With roughly 4,000 lines of code compared to hundreds of thousands in older protocols, WireGuard has a dramatically smaller attack surface.
Instant Connections
WireGuard establishes connections in under a second. Roaming between networks is seamless with near-zero reconnection time.
When to Use WireGuard
Best For
Streaming, gaming, large downloads, video calls, and any activity where speed is the top priority. WireGuard is the recommended default protocol for most users in unrestricted network environments.
Considerations
WireGuard traffic has a recognizable signature. In networks that actively block VPN protocols through deep packet inspection, WireGuard connections may be detected and blocked. In such environments, consider VLESS or OrbConnect instead.
VLESS
VLESS is a lightweight, proxy-based protocol designed for environments where traditional VPN protocols are blocked. It disguises VPN traffic as regular HTTPS web browsing, making it extremely difficult for firewalls and censorship systems to detect.
Censorship Resistance
VLESS traffic mimics standard HTTPS traffic, making it nearly indistinguishable from regular web browsing to deep packet inspection systems.
Lightweight Design
Minimal protocol overhead means VLESS maintains excellent speeds while providing strong obfuscation capabilities.
TLS Encryption
All traffic is wrapped in TLS 1.3 encryption, identical to the encryption used by secure websites, providing both security and stealth.
Firewall Bypass
Passes through most corporate firewalls, school networks, and government censorship systems that block traditional VPN protocols.
When to Use VLESS
Best For
Restricted networks, regions with internet censorship, corporate environments that block VPN traffic, and any situation where WireGuard connections are being detected and blocked.
Considerations
VLESS may have slightly higher latency than WireGuard due to the additional TLS wrapping layer. For unrestricted networks where speed is the sole priority, WireGuard typically delivers better raw performance.
OrbConnect
OrbConnect is OrbVPN's own VPN protocol, written from the ground up in pure Go. It tunnels your traffic inside a standard HTTPS session on TCP 8443, so to any firewall it looks like an ordinary visit to a secure website. It is named OrbConnect because it is ours — it is not OpenVPN and not Cisco AnyConnect / OpenConnect.
FIPS 140-3 Cryptography
Standards-validated cryptographic primitives — the same caliber of encryption trusted in regulated, high-assurance environments.
Looks Like Plain HTTPS
Your session rides inside a real TLS/HTTPS tunnel on port 8443. To a censor, it is indistinguishable from normal encrypted web traffic.
Region-Aware Connect Hints
Before connecting, OrbConnect can fetch anti-censorship hints from the server — TLS fingerprint to imitate, fake SNI, traffic padding, and region-tuned fallback servers.
Cloudflare CDN Fronting
Optionally bridges through Cloudflare's CDN via WebSocket to TCP 8443. A censor cannot block it without blocking millions of websites on the same CDN.
When to Use OrbConnect
Best For
Heavily censored networks (Iran, Russia, China), networks that blackhole UDP or fingerprint WireGuard/VLESS, and any situation where you need a standards-grade, HTTPS-disguised tunnel that can fall back to Cloudflare CDN fronting. See the full OrbConnect deep dive.
Considerations
OrbConnect runs over TCP inside HTTPS, so on a completely open network WireGuard will usually give you lower latency and higher raw throughput. OrbConnect's advantage is resilience: it keeps working when faster protocols are blocked.
SSH Tunnel
SSH Tunnel routes your traffic through an encrypted secure-shell (SSH) session, presented to your device as a local SOCKS5 proxy and bridged to the system tunnel with tun2socks. SSH is one of the most widely permitted protocols on earth — administrators rarely block it — which makes it a quietly effective way through restrictive networks.
Universally Allowed
SSH traffic is expected on virtually every network. It blends in where dedicated VPN protocols stand out and get blocked.
Obfuscated SSH (OSSH)
The optional OSSH mode scrambles the SSH handshake into random-looking bytes using ChaCha20 with an Argon2id-derived key, defeating signature-based DPI.
Tunnels Over WebSocket & CDN
OSSH can be carried over WebSocket, or fronted through Cloudflare's CDN, for networks that only permit HTTP/HTTPS.
Proven, Auditable Security
Built on the battle-hardened SSH protocol with modern key exchange, then wrapped in OrbVPN's obfuscation layers for stealth.
When to Use SSH Tunnel
Best For
Networks where WireGuard, VLESS, and OrbConnect are all detected, university and corporate networks that whitelist SSH, and censored regions where obfuscated SSH (OSSH) slips through DPI. See the full SSH Tunnel deep dive.
Considerations
A single SSH tunnel is TCP-based, so it shares TCP's latency characteristics with OrbConnect and is typically slower than WireGuard on open networks. Its strength is reach: when nothing else connects, an SSH or OSSH tunnel often still does.
Transports: Every Protocol Adapts to Your Network
A protocol decides how your data is encrypted; a transport decides how it travels to the server. Every OrbVPN protocol ships with multiple transports so it can keep working when a censor blocks one path. When CDN Fronting is available, your traffic enters Cloudflare on the ubiquitous HTTPS port and is bridged to the server — the only way to block it would be to block Cloudflare itself.
VLESS Transports
VLESS carries its tunnel over several transport layers. The default, Reality, is what makes VLESS censorship-resistant.
Reality (TCP) — Default
XTLS-Vision Reality. Performs a genuine TLS handshake using a real website's certificate, so your traffic is cryptographically indistinguishable from normal HTTPS. The most secure and undetectable choice.
Direct (Plain) TCP
Raw TCP with no TLS layer — a minimal protocol signature. Purpose-built to bypass DPI in Iran, Russia, and China where even TLS handshakes are scrutinized.
WebSocket
Wraps VLESS in a WebSocket stream, so it blends with ordinary web-app traffic. Works well on restricted networks that only permit HTTP/HTTPS.
gRPC
Efficient, multiplexed transport over HTTP/2-style framing. A strong option on networks that allow modern API traffic but fingerprint plain tunnels.
CDN Fronting (Cloudflare)
Routes VLESS through Cloudflare's CDN via WebSocket. Maximum stealth — impossible to block without blocking millions of websites. Deployed on all servers.
A note on HTTP/2
An HTTP/2 transport for VLESS is in development and is not yet selectable. The transports above are the ones available today.
To choose a transport, open the VLESS transport selector on the connection screen (or in Connection settings) and pick the one that matches your network. If you are unsure, leave it on the default Reality transport — and remember that Smart Connect can select the optimal transport for you automatically.
WireGuard Transports
Direct UDP — Default
Standard WireGuard over UDP. The fastest, most efficient path on open and lightly filtered networks.
CDN Fronting (Cloudflare)
Bridges WireGuard's UDP through a Cloudflare WebSocket, so it survives networks that blackhole UDP or block WireGuard outright.
OrbConnect Transports
Direct HTTPS Tunnel — Default
A standard HTTPS tunnel straight to the server on TCP 8443. Fast and secure for unrestricted and lightly filtered networks.
CDN Fronting (Cloudflare)
Bridges OrbConnect through Cloudflare's CDN via WebSocket to TCP 8443 — maximum stealth for state-level censorship.
SSH Tunnel Transports
Direct SSH — Default
A standard SSH connection. Simple, fast, and widely permitted on most networks.
Obfuscated SSH (OSSH)
Transforms the SSH handshake into random-looking data (ChaCha20 + Argon2id) to defeat signature-based deep packet inspection.
OSSH over WebSocket
Carries obfuscated SSH inside a WebSocket stream for networks that only allow HTTP/HTTPS.
OSSH over CDN (Cloudflare)
Fronts obfuscated SSH through Cloudflare's CDN for maximum stealth in the most hostile networks.
Let Smart Connect handle it
You never have to memorize which transport survives which firewall. Auto (Smart Connect) races protocols, transports, and mimicry profiles for your region, verifies that real traffic flows, and remembers what worked so the next connection is instant.
Protocol Comparison
Use this guide to quickly determine which protocol suits your current situation.
Speed
WireGuard leads in raw speed (UDP), followed by VLESS. OrbConnect and SSH Tunnel run over TCP, trading a little speed for resilience. All four are suitable for streaming and everyday use.
Censorship Resistance
VLESS (Reality), OrbConnect (HTTPS), and SSH Tunnel (OSSH) are all built to defeat DPI. WireGuard is the fastest but the easiest to fingerprint — give it CDN Fronting in restricted regions.
Security
Every protocol uses strong modern encryption. OrbConnect adds FIPS 140-3 cryptography and traffic verification; VLESS adds Reality's authentic-TLS stealth; OSSH adds ChaCha20 obfuscation.
How to Switch Protocols
Changing your VPN protocol is simple and takes effect on your next connection.
Disconnect if Active
If you are currently connected to the VPN, disconnect first. Protocol changes cannot be applied during an active session.
Open Protocol Settings
Navigate to Settings and tap on Protocol Selection, or use the protocol selector on the main connection screen.
Choose Your Protocol
Select Auto (Smart Connect), WireGuard, VLESS, OrbConnect, or SSH Tunnel from the available options. A brief description of each protocol is displayed to help you decide.
Reconnect
Return to the main screen and tap the connect button. OrbVPN will establish a new connection using your selected protocol.
Protocol and Server Availability
Not all servers support every protocol. When you switch protocols, the server list updates to show only servers that support your selected protocol. Your previously selected server may change if it does not support the new protocol.
Four Protocols, One Mission
Whether you prioritize speed, stealth, or unbreakable censorship resistance, OrbVPN has the right protocol for you — and Smart Connect to choose it automatically. Download now and experience the difference.