Key takeaways
- REALITY presents the genuine TLS handshake of a real, well-known website. To a firewall, your connection is an ordinary HTTPS session to that site, because at the wire level it is one.
- Even active probing fails. When a censor connects to the server to see what answers, it gets the real website back, not a VPN giveaway.
- Commercial support is rare. Most people self-host Xray configs. VPNBaron is the exception that ships it on every plan with native apps.
VLESS is a lightweight proxy protocol from the Xray ecosystem. REALITY is its camouflage layer, and it is the best answer censorship circumvention currently has. A REALITY connection doesn’t look like ordinary HTTPS. To the firewall inspecting it, it is ordinary HTTPS: a genuine TLS session with a genuine, well-known website. That one distinction is why it connects where WireGuard, OpenVPN and the older stealth tricks get dropped.
Why the older tricks lost
Every obfuscation method before it faked something, and fakes can be pulled apart.
- OpenVPN over port 443 still carries a recognisable TLS-inside-TLS pattern. Deep packet inspection flags it fast.
- Shadowsocks encrypts everything, and "fully encrypted everything" is itself a statistical fingerprint. Censors learned to spot it.
- Trojan got closest: real TLS on a real domain. But you had to buy and run that domain and certificate yourself, and a censor's probe could still connect to your server and find tells in how it answered.
REALITY closed that last hole. The server doesn’t host an imitation of a popular site. It borrows a real site’s actual certificate presentation, so the handshake a firewall sees belongs to that site. And when a censor actively probes the server, connecting to it directly to see what it is, the probe gets the real website back. There is no wrong answer left to catch.
The scoreboard against the blocking toolkit
| Blocking technique | What it checks | Against REALITY |
|---|---|---|
| SNI filtering | The site name in the TLS handshake | Sees a well-known site’s real name. Passes. |
| TLS fingerprinting | Whether the handshake looks authentic | It is an authentic handshake. Passes. |
| Active probing | Connect to the server, see what answers | The probe gets the real website. Passes. |
| UDP blocking | Drop non-web UDP traffic wholesale | Irrelevant. REALITY runs over TCP port 443. |
This matters most where DPI-based blocking is national policy: China (our China guide covers the on-the-ground picture), Iran, Russia. It also matters on mundane hostile networks. Hotel Wi-Fi, campus networks and office firewalls kill anything VPN-shaped every day, and the fix is the same protocol (more in our blocked Wi-Fi guide).
Reality or Hysteria2?
REALITY runs over TCP port 443, the one port no network can afford to block. That makes it the fallback of last resort: it works even where UDP is dropped wholesale, which kills WireGuard and every QUIC-based protocol alike. Hysteria2 is its complement, built on QUIC for speed on lossy links. The practical split: Reality for maximum stealth, Hysteria2 for maximum speed, and a good app should switch between them without asking you. If you want the full side-by-side, VPNBaron’s docs keep a detailed Hysteria2 vs VLESS Reality comparison with a per-network cheat sheet.
The honest limit: REALITY hides what your traffic is, not which IP you connected to. If a censor decides to blocklist the server's address outright, no protocol survives that. This is why the provider behind the protocol matters: someone has to rotate addresses and ship new routes during crackdowns.
Where to actually get it
Mostly, you self-host. REALITY lives in the Xray ecosystem, and the usual route is a rented VPS plus a config file, or a friendlier wrapper like Amnezia (our guide to that route). It works, but congratulations, you are now a server admin.
Commercial VPNs almost never ship it, because their apps are built around WireGuard and OpenVPN and REALITY needs different plumbing. VPNBaron (rated 9.7, our current #1) is the rare one that does: VLESS Reality on every plan, native apps for Windows, macOS, iOS and Android, with Hysteria2 and IKEv2 alongside and its Pathfinder feature trying routes automatically when one is blocked. Pricing is $8.99/mo month-to-month or $3.49/mo effective on the yearly, and the renewal price is the same number. 5 devices, 7-day money-back window: enough time to test it on the exact network that blocks you.