How VPNs get blocked, and what we do about each way
Most "how we bypass censorship" pages describe one technique and imply it handles everything. It doesn't — censors reach for several distinct techniques, and a VPN that answers one can still fall to another. This page lists them separately, states which of our two engines addresses each, and says plainly where neither does.
Two engines, not one
Unblock Master ships two VPN engines because no single one answers every technique below. Faster runs AmneziaWG — WireGuard with its fixed fingerprint removed — and is the default for most networks. Unblocker runs Reality, which doesn't disguise a VPN connection so much as replace it with a real TLS connection to a real website. Switching between them is one tap in the app, not a reinstall, which matters because the right engine depends on which technique the network in front of you is actually using.
For what each protocol individually gives away, see the protocol comparison. This page is organised the other way round: by censor technique first, with our answer to each.
| Blocking technique | Faster (AmneziaWG) | Unblocker (Reality) |
|---|---|---|
| Protocol / handshake fingerprinting | Directly answered | Directly answered |
| SNI filtreleme | Not addressed | Directly answered |
| TLS fingerprinting (JA3/JA4) | Not addressed | Directly answered |
| Aktif sondalama | Partially answered | Directly answered |
| IP address blocking | Not addressed | Not addressed |
| Yavaşlatma | Not addressed | Not addressed |
"Directly answered" means the engine's design specifically targets this technique. "Partially answered" means it helps but a residual signal remains — read the entry, not just the badge. "Not addressed" is stated as plainly as the other two; a page that only ever says yes isn't measuring anything.
Protocol / handshake fingerprinting
Matching a fixed byte pattern in the first packet or two — the same fingerprint that makes plain WireGuard trivial to block on sight.
Faster (AmneziaWG)
Directly answered
Unblocker (Reality)
Directly answered
Faster (AmneziaWG) exists specifically to remove this fingerprint: junk packets ahead of the handshake, padding that changes the packet sizes, and the four fixed message-type bytes replaced by values both sides agree on in advance. The one DPI rule that catches WireGuard's constant 148/92-byte handshake catches nothing here. Unblocker (Reality) sidesteps the question entirely — it isn't a UDP handshake a censor can pattern-match, it's a TLS connection shaped like any other HTTPS request.
AmneziaWG's protection depends on both ends agreeing on every obfuscation parameter; a configuration that is wrong rather than rejected will still connect while quietly carrying a matchable pattern. We control both ends, so this is an operational risk on our side, not something the user manages.
Şartlar: deep-packet-inspection · amneziawg · junk-packets · header-magic
SNI filtreleme
Blocking an HTTPS connection by reading the plaintext site name sent at the start of the TLS handshake, before encryption begins.
Faster (AmneziaWG)
Not addressed
Unblocker (Reality)
Directly answered
Faster doesn't use TLS at all, so there is no SNI field to read — but that only matters on networks that inspect traffic; a network that instead only permits traffic that looks like ordinary TCP/443 web browsing will not let AmneziaWG's UDP through regardless. Unblocker's Reality connection presents the TLS handshake, SNI included, of the genuine website it is impersonating — so the SNI a censor reads is the cover site's name, not ours.
This is the specific case Unblocker exists for: it is our answer when a network filters on TLS metadata rather than on UDP protocol shape.
Şartlar: sni-filtering · reality · vless
TLS fingerprinting (JA3/JA4)
Identifying the software behind a TLS connection from the exact order it offers its ciphers, extensions and curves — a signature of the library, sent before encryption starts.
Faster (AmneziaWG)
Not addressed
Unblocker (Reality)
Directly answered
Not applicable to Faster, since AmneziaWG has no TLS handshake to fingerprint in the first place. Reality's entire design is aimed at this technique specifically: it borrows the genuine TLS handshake of a real site rather than approximating one, so the JA3/JA4 signature a censor collects is indistinguishable from a real visitor's.
Imitating the handshake correctly is necessary, not sufficient — see active probing and traffic-shape analysis below for what a correct handshake does not cover on its own.
Şartlar: tls-fingerprinting · reality
Aktif sondalama
The censor connects to a server you just used and checks whether it answers like a proxy — identifying the server from its own behaviour rather than from your traffic.
Faster (AmneziaWG)
Partially answered
Unblocker (Reality)
Directly answered
A Faster server gives a prober without the right key no distinctive reply to recognise — but a server that responds to nothing except this one unusual pattern is still, on inspection, a server doing one unusual thing. Unblocker is built against this case directly: a prober without the correct key is passed straight through to the real site being impersonated and gets that site's real certificate back. Probing confirms the cover story instead of exposing anything.
For the toughest networks — where active probing is routine — Unblocker is the engine we recommend switching to, and the app makes that a one-tap change rather than a reinstall.
Şartlar: active-probing · reality
IP address blocking
Dropping all traffic to a specific address, regardless of what protocol it's carrying — blunt, and an arms race of pure arithmetic between how many addresses a provider runs and how fast a censor can enumerate them.
Faster (AmneziaWG)
Not addressed
Unblocker (Reality)
Not addressed
Neither engine hides a server's address — we don't claim otherwise. Our answer to this technique is operational, not protocol-level: servers across many countries, so a block against one address costs a user a tap to switch country rather than the app stopping working. That is resilience, not evasion, and the two should not be confused.
A censor that enumerates and blocks an entire address range a provider operates from — not just one server — is not something either engine answers. No VPN's does.
Şartlar: ip-blocking · asn · datacenter-ip
Yavaşlatma
Slowing a connection deliberately instead of blocking it outright, until it's too painful to use — harder to measure than a block, and increasingly preferred by censors for exactly that reason.
Faster (AmneziaWG)
Not addressed
Unblocker (Reality)
Not addressed
Neither engine can stop a network from rate-limiting traffic it has already identified as encrypted-and-unrecognised, protocol notwithstanding. What the app offers is a fast way to find out whether switching helps: if the network is throttling by protocol shape, moving from Faster to Unblocker changes that shape entirely, which is the one thing worth trying when a connection is slow rather than dead.
If both engines are throttled equally, the network is almost certainly rate-limiting by volume or by the destination rather than by protocol, and no VPN engine changes that.
Şartlar: throttling · confirmed-vs-anomaly
Why two engines instead of one better one
The table above has no row where a single engine covers everything, and that isn't a gap we haven't closed yet — it's structural. Reality's strength against SNI filtering, TLS fingerprinting and active probing comes from paying a real TLS handshake's cost on every packet; that cost is exactly why it's the fallback and not the default. Faster is lighter and faster precisely because it doesn't pay that cost, which is also why it has nothing to say against SNI or TLS fingerprinting. Neither engine is the unfinished version of the other.
Nothing here addresses IP blocking or throttling at the protocol level, and no VPN's engine does — those are answered operationally (more servers, more countries) or not at all. Claiming otherwise is the kind of thing this page exists to avoid.
Compare the underlying protocols Burada kullanılan terimlerin sözlüğü