AnyProxy

Get Pro
Glossary · Adjacent

Obfuscation

Also calledprotocol obfuscationtraffic obfuscation
Definition

Obfuscation means disguising a VPN or proxy connection so that network filters cannot recognise what kind of traffic it is and block it.

Explanation

In depth

Encryption hides what you send; it does not hide that you are using a VPN. Protocols like WireGuard, OpenVPN and IPsec have recognisable packet sizes, handshakes and ports, and deep packet inspection can spot them without decrypting anything. Obfuscation changes that outer appearance. Some tools make traffic look like random noise (Tor's obfs4), some make it look like ordinary HTTPS to a normal website (Shadowsocks, V2Ray and Trojan setups), and some hide it among other services' traffic (Tor's Snowflake and meek). Domain fronting, which hid a destination behind a large cloud provider's domain, was largely shut down in 2018 when Google and Amazon changed their infrastructure. A web proxy needs no extra disguise on your side, because what your network sees is an HTTPS connection to the proxy's website. That has limits. The proxy's domain name is visible, so a network that puts it on a blocklist stops it. On the other side, the connection from the proxy to the site is ordinary HTTPS too: a Cloudflare trace we took through AnyProxy showed TLS 1.3, HTTP/2 and 'sni=plaintext', meaning the site name was visible on that leg.

In practice

Obfuscation in the real world

Obfuscation disguises tunnel traffic so filters cannot tell what it is. One technique, domain fronting, hid traffic behind a big provider's domain; it ended for most apps in April 2018, when Google and Amazon changed their infrastructure to stop it and Signal had to drop the method it used in Egypt, Oman, Qatar and the UAE. Today's tools mostly make traffic look like random bytes or ordinary HTTPS instead.

Sources: Signal — looking back on the front

We checked

What the proxy-to-site connection looks like

Plain-text Cloudflare trace through AnyProxy Virginia showing loc=US, colo=ATL, TLSv1.3, http/2, sni=plaintext, IP line hidden

Cloudflare trace (one.one.one.one/cdn-cgi/trace) through AnyProxy

Worked · US exit · 2026-10-15

Trace reports loc=US, colo=ATL, http=http/2, tls=TLSv1.3, sni=plaintext, warp=off, kex=X25519MLKEM768.

Questions about Obfuscation

What is domain fronting?
Sending traffic to a large, unblockable domain and naming the real destination only inside the encrypted request. Major cloud providers stopped allowing it in 2018.
Is a web proxy obfuscated?
It looks like ordinary HTTPS to a normal website, which is a form of blending in - but it is not hidden if the proxy's own domain is on a blocklist.
Does obfuscation make a VPN slower?
Usually a little. The extra wrapping adds bytes and processing, and some methods route through additional relays. On filtered networks that cost is the price of connecting at all.

Related terms

TorTor is a free network and browser that sends your traffic through three volunteer-run relays, each adding a layer of encryption, so no single relay knows both who you are and what you are visiting.Bridge relayA Tor bridge is a Tor entry relay whose address is not published in the public relay list, so networks that block the known Tor relays cannot easily block it.DPI (Deep Packet Inspection)Deep packet inspection (DPI) is network equipment that looks beyond a packet's addresses into its contents and patterns, to recognise and block or slow specific sites and apps.GFW (Great Firewall of China)The Great Firewall is the filtering system on mainland China's international internet links that stops people inside China from reaching blocked foreign sites and apps.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page