What obfuscation is trying to do
A VPN encrypts what you send, but a network can still see that you are using a VPN. Protocols have recognizable patterns, and filters on office, campus, hotel and national networks can block those patterns. Obfuscation changes how the traffic looks so the filter does not recognize it. NordVPN describes NordWhisper as making VPN traffic look like regular web traffic, so network filters and firewalls are less likely to detect it. [1]
Vendors take different approaches. Proton's Stealth uses obfuscated TLS tunneling over TCP, so the traffic looks like common HTTPS connections. Proton contrasts this with most popular protocols, which use UDP. [2] AmneziaWG, which GL.iNet routers support, keeps WireGuard but adds junk packets before the handshake, changes packet headers and adds random prefixes. Version 2.0 can also send custom packets that mimic protocols such as QUIC or WebRTC. [3] Each one aims to get past deep packet inspection, and none guarantees it. Proton's own claim is that Stealth can bypass most firewalls and VPN blocking methods, not all of them. [2]
The options side by side
This table covers what each vendor documents about the method, where it runs and what it costs.
| Option | How it disguises traffic | Where it runs | Plan | Router use |
|---|---|---|---|---|
| Proton Stealth | Obfuscated TLS tunneling over TCP, aiming to look like HTTPS [2] | Proton apps on Windows, macOS, Android, iOS, iPadOS and Android TV; Linux GUI only via the Proton Protocols beta [4] | All plans, including Free [2] | Not documented; Proton's router page names OpenVPN and WireGuard only [5] |
| NordVPN Obfuscated Servers | Now run on NordWhisper instead of OpenVPN; traffic made to look like regular web traffic [1] | NordVPN apps on Windows, macOS, Android, iOS, Android TV and Linux [6] | NordVPN subscription | Cannot be reached with NordVPN's OpenVPN manual method [1] |
| NordWhisper on any server | Same protocol as above, for restrictive networks [7] | Windows, Android, Linux, iOS and macOS, plus Android TV [7] | NordVPN subscription | Not mentioned in NordVPN's router guidance, which centres on OpenVPN [8] |
| AmneziaWG | WireGuard plus junk packets, dynamic headers and random prefixes [3] | GL.iNet routers on firmware 4.9 or later, to an AmneziaWG server [3][9] | Depends on the server: your own GL.iNet router, or a provider such as Amnezia Premium or StarVPN [9] | Yes, but clients without AmneziaWG support cannot connect [9] |
| TCP instead of UDP (fallback) | Not a disguise; NordVPN says TCP is more resilient against blocks than UDP [10] | Most apps and routers | Any | Yes; GL.iNet's OpenVPN supports both [11] |
Proton Stealth in practice
Proton lists Stealth as a protocol choice in its apps, described as designed to bypass internet blocks by hiding your VPN connection. It is available in the Windows, macOS, Android, iOS, iPadOS and Android TV apps. On Linux it appears only in the GUI app after you turn on the Proton Protocols beta. [4] To use it, you select Stealth as the protocol in the app's settings. [4]
Stealth is on every plan, including Free. [2] Because it runs over TCP, expect it to be slower than WireGuard over UDP on a healthy network. Proton's own speed guide says WireGuard is usually its fastest protocol and that UDP is faster than TCP. [12] Use Stealth when the normal connection fails, not as your everyday setting.
NordVPN obfuscated servers and NordWhisper
NordVPN changed what its Obfuscated Servers category means. It now runs on NordWhisper instead of OpenVPN. NordVPN says the change brings faster connections and a larger choice of server locations, though it publishes no measurements. [1] In the apps, you find it under Specialty servers, Obfuscated. On Linux you set the protocol with nordvpn set protocol nordwhisper. [6] NordVPN's troubleshooting guide notes that obfuscated servers appear only when the protocol is set to Auto or NordWhisper. [10]
There are trade-offs. NordWhisper is not compatible with Dedicated IP, Meshnet or Onion Over VPN servers. [7] NordVPN also says you can no longer reach obfuscated servers through the OpenVPN manual connection method. [1] That is the method most third-party routers use.
Why router setups usually cannot use them
A travel router connects to a provider with a standard WireGuard or OpenVPN profile. Proton's router page says your router must support OpenVPN or WireGuard as a client. [5] NordVPN's router page says a router needs an OpenVPN client, and its GL.iNet guide uses OpenVPN files. [8][13] Stealth and NordWhisper are app protocols. Neither provider documents a way to run them on a router, and NordVPN explicitly rules out reaching obfuscated servers through manual OpenVPN. [1]
That leaves three practical patterns. First, keep the router as a plain network and run the provider's app with obfuscation on each device. Second, use AmneziaWG to your own GL.iNet router at home. GL.iNet documents this with a Brume 3 as the server and a Beryl AX as the travel client, which needs firmware 4.9 or later and port forwarding if the home router is not the main router. [9] Third, try TCP before anything else. It is not a disguise, but it can get through where UDP is blocked. [10]
When a traveler actually needs obfuscation
Before reaching for obfuscation, rule out the simple causes on hotel Wi-Fi, such as an unfinished captive portal login or a blocked protocol. NordVPN's own order for restricted networks is a useful sequence. [10]
- Finish the captive portal login with the VPN off, then reconnect.
- Switch the protocol: WireGuard to OpenVPN TCP, or WireGuard UDP to TCP where the app offers it. [4][10]
- Still blocked on an office, campus, airport or conference network: switch to NordWhisper or Proton Stealth in the app. NordVPN names these networks as NordWhisper's intended use. [7]
- In a country that restricts VPN traffic: set NordWhisper and use Obfuscated servers, then try OpenVPN TCP, then a network reset, then a manual IKEv2 connection, per NordVPN's troubleshooting steps. [10] Install and test the app before you travel.
- Using a travel router: turn off the router's VPN and run the obfuscated protocol in the app on each device, or use AmneziaWG to your own server. [9]
- Check the local rules. Obfuscation changes how traffic looks on the network. It does not change what is permitted where you are.
Questions before you decide
Is Proton Stealth available on the free plan?
Yes. Proton says Stealth is available on all Proton VPN plans, including Free. It runs in the Windows, macOS, Android, iOS, iPadOS and Android TV apps, and on Linux through the Proton Protocols beta.
Can I use NordVPN obfuscated servers on a GL.iNet router?
NordVPN documents no router method. Its obfuscated servers now run on NordWhisper, and it says they cannot be reached through the OpenVPN manual connection method that most routers use.
Does obfuscation slow a VPN down?
Often. Proton's Stealth runs over TCP, and Proton's speed guide says WireGuard is usually its fastest protocol and UDP is faster than TCP. Use obfuscation only when a normal connection is blocked.
What obfuscation can a GL.iNet router do?
AmneziaWG, on firmware 4.9 or later. It adds junk packets and changes headers on top of WireGuard. Both ends must support it, such as two GL.iNet routers or an AmneziaWG provider.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- NordVPN Help Center: Obfuscated Servers are getting an upgrade, what changed Accessed 30 Oct 2026
- Proton VPN blog: Stealth VPN protocol Accessed 30 Oct 2026
- GL.iNet Router Docs 4: AmneziaWG obfuscation Accessed 30 Oct 2026
- Proton VPN Support: Change your VPN protocol Accessed 30 Oct 2026
- Proton VPN Support: Installing Proton VPN on a router Accessed 30 Oct 2026
- NordVPN Help Center: How to connect and disconnect from obfuscated servers Accessed 30 Oct 2026
- NordVPN Help Center: How to use NordWhisper on NordVPN Accessed 30 Oct 2026
- NordVPN Help Center: Setting up a router with NordVPN Accessed 30 Oct 2026
- GL.iNet Router Docs 4: How to set up VPN obfuscation Accessed 30 Oct 2026
- NordVPN Help Center: Troubleshooting VPN connection in a country with internet restrictions Accessed 30 Oct 2026
- GL.iNet Router Docs 4: OpenVPN TCP or UDP Accessed 30 Oct 2026
- Proton VPN Support: How to increase VPN speeds Accessed 30 Oct 2026
- NordVPN Help Center: GL.iNet setup with NordVPN Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.