When a censor can't block you, it slows you to a crawl — deliberate packet loss that makes normal proxies unusable. Hysteria2's QUIC transport and aggressive congestion control are built for exactly that: it punches through throttled, lossy mobile networks and looks like ordinary HTTP/3 doing it. Deploy on a fresh offshore IP, paid in crypto.
Most proxies ride TCP, and TCP interprets packet loss as congestion — so when a censor deliberately drops packets to throttle you, a TCP proxy politely slows down to a trickle. Hysteria2 runs over QUIC (UDP) with a congestion controller designed to power through loss instead of backing off, so a network engineered to be frustrating stays usable. On the wire it masquerades as HTTP/3 — increasingly common, ordinary traffic — and its Salamander obfuscation scrambles the packet headers a DPI box would look at. Where REALITY optimizes for stealth, Hysteria2 optimizes for speed under adversarial conditions.
Its congestion control powers through packet loss instead of slowing down — the difference between a usable link and a dead one on a throttled network.
QUIC on 443/UDP is ordinary modern web traffic. Salamander obfuscation hides the headers, so DPI sees nothing worth flagging.
No panel, no dependencies — a single binary and a short YAML file. Up and running in about ten minutes.
QUIC handles changing networks and weak signal gracefully, so it holds up on the phone-tethered, throttled connections censorship pushes people onto.
What the protocol actually is, how it hides, and where it's strongest — described honestly. No proxy is magic; the right one for your network is.
| Server software | Hysteria 2 |
|---|---|
| Transport & camouflage | QUIC / UDP + Salamander obfuscation |
| DPI resistance | High — masquerades as ordinary HTTP/3 |
| Throughput | Best on lossy / throttled links (brutal congestion ctrl) |
| RAM footprint | ≈ 40 MB |
| Setup | single binary + one config, ≈ 10 min |
| Port(s) | 443 UDP |
| Strongest in | Iran (throttled mobile), high packet-loss networks |
A proxy is a tiny process — it needs a clean IP and steady bandwidth, not a big machine. Every plan is unmetered NVMe VPS with full root, rented with a token and paid in crypto.
One person on a throttled network: VPS-S runs Hysteria2 easily and the speed gain is what you'll feel, not the specs.
A few users pushing video through a bad network: VPS-M's extra cores and 2 Gbps uplink keep everyone fast.
Serving many on hostile networks: VPS-L handles concurrent QUIC sessions and heavy throughput with headroom.
Closest latency to Iran, Turkey and the Gulf comes from Netherlands and Romania; Moldova is the budget pick. For Russia any European node is fine. QUIC's loss tolerance means Hysteria2 forgives a longer path better than most, so even a slightly distant node stays usable.
| Location | CPU | RAM | Storage | Uplink | Price | |
|---|---|---|---|---|---|---|
| Moldova Budget Offshore | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $7.50/mo | Order |
| Russia Western-Proof | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $7.50/mo | Order |
| Panama No Data Retention | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $8.50/mo | Order |
| Romania Anti-Retention | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $8.50/mo | Order |
| Netherlands Best Peering | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $9.00/mo | Order |
| Iceland Free Speech Haven | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $10.00/mo | Order |
| Switzerland Premium Privacy | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $11.00/mo | Order |
From a blank VPS to a working endpoint. Commands are copy-paste ready for Ubuntu 24.04.
VPS-S is enough. Pick the jurisdiction closest to you — Netherlands or Romania for Iran and Turkey. Pay in crypto, get root on a clean IP.
Key-only SSH, then allow UDP on 443 in the firewall — Hysteria2 is UDP, not TCP, so this step matters.
One official install script drops in the single binary and a systemd unit.
bash <(curl -fsSL https://get.hy2.sh/)A short YAML: listen on :443, a self-signed cert (fine here), Salamander obfs with a password, and an auth password. That's the whole file.
# /etc/hysteria/config.yaml
listen: :443
tls:
cert: /etc/hysteria/cert.pem # self-signed is fine
key: /etc/hysteria/key.pem
obfs:
type: salamander
salamander:
password: CHOOSE_A_SECRET
auth:
type: password
password: CHOOSE_A_SECRETImport the hy2:// URI into NekoBox, v2rayN, sing-box or Streisand. On a throttled network the difference from a TCP proxy is immediate.
systemctl enable --now hysteria-server
# import the hy2:// URI into NekoBox, v2rayN, sing-box or StreisandCensorship isn't always a wall — often it's a swamp. Regulators tell carriers to degrade international traffic: inject packet loss, add latency, cap throughput. TCP treats every lost packet as a sign of congestion and backs off, so a TCP-based proxy crawls to a stop exactly when you need it. Hysteria2 runs on QUIC and uses a congestion controller (based on Brutal) that treats loss as noise, not a stop sign — it keeps sending at the bandwidth you configured. On a network engineered to be miserable, that's the difference between a video call that connects and one that spins forever.
Raw QUIC has a recognizable handshake, so Hysteria2 adds Salamander — an obfuscation layer that scrambles the packet headers a DPI box inspects, making the stream look like generic encrypted UDP. Combined with running on 443/UDP (where legitimate HTTP/3 lives), there's little for a censor to fingerprint without blocking QUIC wholesale — which breaks a growing share of the normal web and carries real collateral cost. Set a strong Salamander password and your obfuscation is unique to your server.
If your problem is 'they can tell it's a proxy and block it', REALITY's stealth is the answer. If your problem is 'it connects but it's unusably slow', Hysteria2 is the answer. In practice, Iran's throttling makes Hysteria2 a favorite there, while China's active probing makes REALITY the default. Because you have full root, the pragmatic move is to run both on one VPS — Hysteria2 on UDP/443, REALITY on TCP/443 isn't possible on the same port, so use a second port — and switch clients depending on what the network is doing that week.
Some networks throttle or rate-limit UDP, and a few block QUIC outright during crackdowns — it's the main scenario where Hysteria2 struggles and a TCP protocol like REALITY or Shadowsocks wins. But blanket-blocking UDP/443 also breaks HTTP/3 for the whole population, so censors are reluctant to keep it up. The honest guidance: try Hysteria2 first if your issue is speed; keep a TCP-based fallback on the same box for the periods when UDP is squeezed. Rotating between the two covers almost every situation.
Its QUIC transport and Brutal-based congestion control keep sending through packet loss instead of backing off like TCP does. On a deliberately throttled network that's a night-and-day difference; on a clean network it's comparable to the others.
That's its home turf. Iran's approach leans on throttling and packet loss, which is exactly what Hysteria2 is built to power through. Many Iranian users make it their daily driver for that reason.
Some throttle UDP, and a few block QUIC during crackdowns — the one scenario where a TCP protocol wins. But blocking UDP/443 also breaks HTTP/3 for everyone, so it's rarely sustained. Keep a TCP fallback (REALITY or Shadowsocks) on the same VPS for those windows.
No — a self-signed certificate is fine for Hysteria2, and the config generates in minutes. No domain purchase, no CA, no cert renewal to babysit.
NekoBox and v2rayN on desktop/Android, sing-box everywhere, Streisand on iOS, plus the official Hysteria client. Import the hy2:// link and you're connected.
A VPS-S from $7.50/mo runs it comfortably with unlimited bandwidth — important, since Hysteria2's whole point is pushing data fast without a cap getting in the way.
Related reading: Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN · The First Hour of VPS Hardening: A Checklist · Self-hosted VPN use case
Hysteria2 on a fresh offshore IP, QUIC speed through the worst networks, paid in crypto. From $7.50/mo, live in minutes.