- A recent study finds that popular VPN protocols can be easily identified and blocked by ISPs.
- VPNs that use TLS or SSH-based protocols are much harder to detect and block because their traffic resembles normal web or secure shell traffic.
- Attempting to block protocols like IPSec could disrupt legitimate services, such as mobile network calls and corporate systems.
In recent years, governments worldwide have stepped up efforts to monitor and restrict the use of Virtual Private Networks (VPNs). From India’s 2022 order requiring VPN providers to log user data, to Russia and Iran’s attempts to ban VPN services altogether, policymakers increasingly view VPNs not as tools for privacy and security, but as obstacles to control.
But how easy is it for a government or an Internet Service Provider (ISP) to detect and block VPN traffic? Should ordinary users be afraid that their VPN connections will soon stop working?
These were the questions we set out to explore in our recent study, “VPN or Vpwn? How Afraid Should You Be of VPN Traffic Identification?” presented at the Network Traffic Measurement and Analysis Conference (TMA 2025).
Popular VPN Services Are at Risk
From examining the different tunneling protocols—OpenVPN, WireGuard, TLS, IPSec/IKEv2, SSH, and proprietary alternatives—of seven popular VPN services, including NordVPN, ExpressVPN, ProtonVPN, VyprVPN, Windscribe, Perfect Privacy, and Cloudflare’s WARP, we found:
- OpenVPN is vulnerable. Still one of the most widely used protocols, it is surprisingly easy to fingerprint and block. Unless it uses special modes like “pre-shared key,” which are harder to scale, OpenVPN can usually be spotted by ISP-level filters.
- WireGuard isn’t immune either. Although more modern and efficient, WireGuard leaves telltale patterns in its handshake packets that make it detectable.
- TLS and SSH-based VPNs are more complicated to spot. Because they look like normal web or secure shell traffic, VPNs using TLS 1.3 or SSH are far more difficult to block without accidentally disrupting legitimate services. Some VPN providers (like ProtonVPN’s Stealth mode or VyprVPN’s Chameleon) already use this.
- Blocking can cause collateral damage. Protocols like IPSec are widely used in mobile networks (e.g., for VoLTE calls) and corporate systems. Attempting to block them outright could break essential services, making governments more cautious.
Can VPNs Fight Back?
The study didn’t just look at detection; it also explored how VPNs can resist it. A few key strategies stood out:
- Hiding in plain sight. VPNs can blend with web traffic by modifying specific metadata fields (like disguising the TLS handshake information).
- Splitting patterns across packets. Adjusting the size of packets can scatter identifying markers, confusing middleboxes that try to scan traffic.
- Dummy or malformed packets. Sending “noise” alongside real data can disrupt simple filtering algorithms.
We also proposed a new method for OpenVPN that uses per-session cryptographic handshakes to hide identifiable information without sacrificing scalability.
Why This Matters
Our results highlight a crucial point for policymakers and the public: blocking VPNs isn’t as straightforward as it might sound.
Yes, some protocols like OpenVPN can be identified and restricted. However, many alternatives, especially those using TLS and SSH, are far more resilient. Worse (for censors), blocking them risks breaking essential services used in everyday communications and businesses.
For ordinary users, the takeaway is that VPNs are not all created equal. Choosing a provider that supports advanced or obfuscated protocols can make the difference between staying connected and being cut off.
Our findings also point toward practical design improvements for VPN providers, such as disguising authentication messages or adopting scalable obfuscation schemes that could make their services much more complicated to censor.
The struggle between censorship and circumvention is often described as a “cat-and-mouse game.” Our study shows that this is still true in the VPN space. Governments may try to block VPNs, but many services have tools to evade detection, and outright bans can backfire by disrupting legitimate systems.
As debates about privacy, surveillance, and Internet freedom continue, policymakers must recognize the technical complexity of their efforts. Blocking VPNs may sound appealing in theory, but in practice, it risks collateral damage and pushes users toward more sophisticated tools.
We hope that by shedding light on what makes VPNs identifiable, we can inform a more nuanced conversation about Internet governance.
For those interested in the detailed technical analysis, please read our paper VPN or Vpwn? How Afraid Should You Be of VPN Traffic Identification? (TMA 2025).
Tanmay Rajore is a computer security researcher specializing in privacy, cryptography, and network security.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of the Internet Society.