AmneziaWG vs VLESS vs Hysteria 2

The short answer

There is no universal winner. AmneziaWG is an efficient WireGuard-derived IP tunnel with added traffic masking. VLESS is a lightweight proxy protocol that normally relies on an outer security and transport stack; in this guide, “VLESS” means the widely used VLESS + XTLS Vision + REALITY over TCP. Hysteria 2 is a TCP and UDP proxy built on QUIC, designed to keep throughput up on lossy or high-latency links.

These technologies do not sit at exactly the same layer, so comparing protocol names alone can be misleading. A client may expose any of them as a system-wide VPN by creating a TUN interface, but what happens on the wire is different.

What is AmneziaWG?

AmneziaWG is a fork of WireGuard-Go. It keeps WireGuard’s cryptographic core and basic security model — Noise_IK, Curve25519, and ChaCha20-Poly1305 — while changing observable traffic characteristics that make ordinary WireGuard easy to fingerprint.

Current AmneziaWG 3.1 can vary message headers, packet sizes, padding, service-event timing, and handshake-adjacent packet sequences. It also supports header protection and custom signature packets that can imitate the beginning of common UDP protocols. These mechanisms are an obfuscation layer: they make classification harder, but they do not replace or strengthen WireGuard’s payload encryption.

Where AmneziaWG is strong

• Low overhead: the data path remains close to WireGuard, including kernel implementations on Linux.
• System-wide tunnelling: IP packets are routed through a virtual network interface without requiring every application to support a proxy.
• Mobile efficiency: a compact protocol and UDP transport are a good fit for always-on use.
• Configurable fingerprints: installations do not have to share one fixed WireGuard signature.

Where AmneziaWG is weaker

• It still requires UDP. Networks that block or severely rate-limit UDP can make it unusable.
• Client and server must support compatible AmneziaWG versions and matching server-side masking parameters.
• Traffic masking is not a guarantee against future statistical or active detection.
• Unlike REALITY, it does not naturally present itself as an ordinary HTTPS service on TCP/443.

What “VLESS” means in this comparison

VLESS itself is a stateless, lightweight proxy protocol used between Xray clients and servers. It is not, by itself, the complete security and camouflage story. VLESS is commonly combined with a transport method, transport security, and optional flow control.

For a useful real-world comparison, we use VLESS + XTLS Vision + REALITY over TCP. REALITY modifies the TLS-facing part of the connection to resemble an allowed target site. Connections that fail REALITY authentication can be forwarded to that target, which helps the endpoint withstand simple active probing.

Where VLESS + REALITY is strong

• TCP/443 compatibility: it works on many networks that block unfamiliar UDP traffic.
• TLS-like appearance: REALITY is designed to make the external handshake and traffic shape consistent with ordinary web use.
• Low latency on clean links: XTLS Vision avoids unnecessary work for eligible TLS traffic.
• Flexible deployment: VLESS can be paired with RAW, XHTTP, gRPC, TLS, or REALITY depending on the environment.

Where VLESS + REALITY is weaker

• Its behaviour depends on the whole stack. “VLESS” without naming transport and security settings is incomplete.
• As a TCP-based setup, packet loss can trigger head-of-line blocking and reduce throughput.
• A poor REALITY target, stale fingerprint, or configuration error can undermine both reachability and camouflage.
• Proxy-to-VPN behaviour depends on the client’s TUN implementation and routing rules.

What is Hysteria 2?

Hysteria 2 is a TCP and UDP proxy built on standard QUIC with datagram support. QUIC supplies encrypted multiplexed streams over UDP, while Hysteria adds proxy requests, authentication, traffic handling, and its congestion-control options.

By default, an unauthenticated Hysteria 2 endpoint can behave like a normal HTTP/3 server. Optional Salamander obfuscation scrambles every QUIC packet; newer implementations may also offer the experimental Gecko layer, which fragments and pads the recognisable shape of QUIC handshake datagrams.

Where Hysteria 2 is strong

• Lossy networks: independent QUIC streams avoid making every flow wait behind one lost packet.
• High-latency routes: modern congestion control can make better use of long-distance links.
• TCP and UDP relay: both kinds of application traffic can travel through one QUIC connection.
• Optional masking: HTTP/3 masquerading and Salamander address different blocking conditions.

Where Hysteria 2 is weaker

• It needs UDP. A network that blocks QUIC or all UDP can stop it completely.
• High-rate modes need sensible limits; aggressive bandwidth settings can cause loss and unfairness rather than more speed.
• When HTTP/3 itself is rare or blocked on a network, plain QUIC can be a conspicuous choice; obfuscation changes that trade-off but adds configuration.
• It generally has more moving parts than a WireGuard-style tunnel.

Side-by-side comparison

Which one should you choose?

Choose AmneziaWG when:

• You want WireGuard-like simplicity, speed, and battery efficiency with stronger resistance to simple WireGuard signatures.
• You control both ends or your provider offers a compatible AmneziaWG profile and client.
• UDP is reliable on the networks you use.

Choose VLESS + REALITY when:

• UDP or QUIC is blocked, throttled, or unreliable.
• You need the connection to fit into the TCP/443 and TLS-shaped part of the network.
• Your link is reasonably clean and low latency matters.

Choose Hysteria 2 when:

• Mobile data, public Wi-Fi, congestion, or a long route causes TCP transports to collapse.
• UDP works and sustained throughput matters more than minimum protocol complexity.
• You need both TCP and UDP applications to survive an unreliable path.

What this means in RAGE

In the RAGE server list, VLESS refers to the VLESS + XTLS Vision + REALITY option, while H2 refers to Hysteria 2. Start with VLESS on a normal connection and try H2 when packet loss, congestion, or a long route hurts performance. If the network blocks UDP, use a TCP-based option; the separate VLESS vs XHTTP guide explains the available fallback.

AmneziaWG is covered here as an important alternative technology. Availability of a protocol in a particular service or client should always be checked separately.

Security and censorship: two separate questions

Strong encryption protects the contents of a connection. Obfuscation tries to hide what kind of connection it is. A protocol can encrypt data securely and still be easy to identify; it can also resemble allowed traffic today and become classifiable later. None of the three is “unblockable,” and the server IP, DNS behaviour, client fingerprint, traffic volume, and surrounding infrastructure can matter as much as the protocol name.

Primary sources

• AmneziaWG documentation — protocol versions, masking mechanisms, and security model
• Xray VLESS protocol specification and REALITY documentation
• Hysteria 2 protocol specification — QUIC, authentication, TCP/UDP relay, and obfuscation