Get online where VPNs are blocked
Censors in Iran, China and Russia block standard VPN protocols, blocklist server addresses and probe anything that looks suspicious. PremierVPN gives you three layers of tools to get past them, from one tap in our apps to a tunnel carried inside DNS lookups.
Included with every subscription · No add-ons · 30-day money-back guarantee
- AmneziaWG
- Stealth relay
- VLESS
- Cloak
- DNSTT
- NaiveProxy
- StormDNS
Example
- Layer 1 · WireGuard®Blockedno handshake reply
- Layer 1 · Auto modeBlockedAmneziaWG, REALITY, xHTTP, CDN and Stealth relay tried in turn
- Layer 2 · DNSTT in SlipNetConnectedencrypted data inside ordinary DNS queries
- Layer 3 · StormDNSStandbyfor when nearly everything is blocked
- Layer
- 2 of 3
- Port
- 53 / UDP
- Looks like
- DNS
How censors stop ordinary VPNs
They don't need to break your encryption. They only need to recognise VPN traffic, or the servers it goes to.
Fingerprints
DPIDeep packet inspection spots the handshakes of WireGuard®, OpenVPN and IKEv2 and cuts them off, often within minutes.
Blocklists
IPsKnown VPN server addresses go on national blocklists. However well disguised the traffic, it can't reach a blocked address directly.
Active probing
ProbesCensors connect to servers that look suspicious to test whether they are proxies, then block the ones that give themselves away.
Shutdowns
Cut-offsDuring unrest, international traffic can be cut almost entirely. DNS lookups are often one of the few things still getting out.
Three layers, easiest first
Each layer gets through a different way. Start at the top and only go further when you need to.
In the app
EasiestAmneziaWG, Stealth relay, VLESS (REALITY, xHTTP, CDN) and Cloak, built into the PremierVPN apps. Auto mode and Bypass do the trying for you.
Layer 1 →Tunnel protocols
Some setupSix protocols that carry your traffic inside DNS, HTTPS or TLS: DNSTT, Slipstream, VayDNS, NaiveProxy, StunTLS and NoizDNS.
Layer 2 →StormDNS
Last resortYour connection split into pieces and sent as DNS queries through public resolvers. Slower, but it keeps messaging and browsing going.
Layer 3 →Start with the app you already have
No extra apps and no setup. These protocols are built into PremierVPN and work with the same account.
AmneziaWG
FastA version of WireGuard that disguises its handshake with padding and junk packets, so it no longer matches WireGuard's fixed pattern. Close to WireGuard speeds.
Stealth relay
TLSWireGuard wrapped inside TLS, so the network sees an encrypted TLS connection instead of WireGuard's UDP packets.
VLESS
Port 443REALITY runs a genuine TLS 1.3 handshake that borrows a well-known site's certificate, with Chrome's fingerprint. xHTTP looks like everyday web requests. CDN goes through a content delivery network, so blocking our IPs doesn't stop it.
Cloak
WindowsOpenVPN disguised as HTTPS on port 4443/TCP. Part of Bypass mode in the Windows app.
Auto mode and Bypass
iPhone & iPad · Auto mode (on by default) tries each in turn, keeps the first that works and remembers it for each Wi-Fi network:
- WireGuard®
- AmneziaWG
- REALITY
- xHTTP
- CDN
- Stealth relay
Windows · Bypass Auto does the same with the Windows bypass methods:
- AmneziaWG
- Cloak
- VLESS
On iPhone and iPad, the kill switch works with WireGuard, AmneziaWG and Stealth relay. iOS can't use a kill switch with REALITY, xHTTP or CDN. On Windows, VLESS runs as a Windows proxy, covering your browser and proxy-aware apps.
Stealth options by device
- Windows
- Bypass mode: AmneziaWG, Cloak and VLESS, plus a kill switch and DNS leak protection.
- macOS
- Choose a VLESS server and connect. Mac App Store.
- iPhone & iPad
- AmneziaWG, VLESS (REALITY, xHTTP, CDN) and Stealth relay, with Auto mode.
- Android
- Stealth, and a VLESS tab with Reality (try first), xHTTP, CDN and Vision. VLESS needs a 64-bit phone.
- Linux
- AmneziaWG, Stealth and VLESS, with a kill switch on every protocol.
How the VLESS options work: REALITY explained · xHTTP explained
Six tunnels for when the app can't connect
These run on separate tunnel servers, outside the main VPN network. Instead of connecting to a VPN server the usual way, your traffic is encrypted and wrapped inside something the network has to let through: DNS lookups, HTTPS on port 443 or a TLS connection.
On Android you use all six through the free SlipNet app. On iPhone and iPad, NaiveProxy works through the Shadowrocket app from the App Store. The DNS-based protocols need SlipNet, so they are Android only.
You set them up in the client area, import the connection into the app, and switch protocol in seconds if one stops working.
Tunnel servers and apps
- Servers
- Frankfurt, Germany and Helsinki, Finland. Both run all six protocols, giving you two separate routes.
- Android
- SlipNet (free): all six protocols.
- iPhone & iPad
- Shadowrocket: NaiveProxy.
- Setup
- Activate a server in the client area, then import the connection into the app.
- Devices
- One device at a time per tunnel server. You can be active on both servers at once.
- Cost
- Included with every subscription.
Subscribe
Any PremierVPN plan includes the tunnel servers. Card, PayPal and crypto are accepted.
Activate a server
In the client area, open the tunnels page and activate Germany, Finland or both.
Install the app
SlipNet on Android, or Shadowrocket on iPhone and iPad for NaiveProxy. Import your connection.
Connect
Start with DNSTT. If it is blocked or slow, switch to another protocol from the table below.
Which tunnel to use
Each protocol gets through a different way. If one is detected on your network, switch to another.
| Protocol | Speed | Stealth | Port | Android | iOS | Use when |
|---|---|---|---|---|---|---|
| DNSTT | ●●● |
●●● |
53/UDP | Yes | No | Default. Start here. |
| Slipstream | ●●●● |
●● |
53/UDP | Yes | No | You need speed for calls or downloads |
| VayDNS | ●●● |
●●●● |
53/UDP | Yes | No | DNSTT is being detected |
| NaiveProxy | ●●●● |
●●● |
443/TCP | Yes | Shadowrocket | DNS tunnels are blocked, HTTPS still works |
| StunTLS | ●●● |
●●● |
8443/TCP | Yes | No | Quick fallback, or DNS is filtered locally |
| NoizDNS | ●● |
●●●● |
53/UDP | Yes | No | DNSTT is caught by traffic analysis |
Speed and stealth are relative, out of four. Android uses the SlipNet app.
DNSTT
Start hereHides your traffic inside DNS queries, the lookups every device makes to find websites. Each packet is encrypted with Curve25519 keys before it goes into the DNS records. Blocking DNS breaks the internet, so it usually stays open even during shutdowns.
- Carried in
- DNS queries
- Encryption
- Curve25519
- Port
- 53/UDP
- Speed
- Medium
- Use when
- You're starting out. The most reliable of the six.
Slipstream
FastestQUIC, the protocol behind HTTP/3, tunnelled inside DNS. Higher throughput than DNSTT with the same DNS cover. QUIC copes well with packet loss and can move between Wi-Fi and mobile data without dropping the connection.
- Carried in
- QUIC over DNS
- Port
- 53/UDP
- Speed
- Fastest DNS tunnel
- Use when
- Video calls and larger downloads on a reasonably stable network.
VayDNS
Most stealthKCP, a reliable transport built on UDP, tunnelled through DNS. It can use nine DNS record types: TXT, CNAME, A, AAAA, MX, NS, SRV, NULL and CAA. If censors learn to spot one pattern, we can switch it on the server, with nothing to change on your phone.
- Carried in
- KCP over DNS
- Record types
- 9, switchable
- Port
- 53/UDP
- Speed
- Medium
- Use when
- DNSTT has been detected on your network.
NaiveProxy
iPhone tooNot a DNS tunnel. Your traffic travels as ordinary HTTPS on port 443, to a server with a real certificate. It uses Chrome's own network stack, so it looks like Chrome to anyone watching. A censor that probes the server finds an ordinary website.
- Carried in
- HTTPS
- Port
- 443/TCP
- Speed
- Fast
- Apps
- SlipNet (Android), Shadowrocket (iOS)
- Use when
- DNS tunnels are blocked or slow, or you're on iPhone.
StunTLS
No domainAn SSH tunnel wrapped in TLS. It connects straight to the server's IP address on port 8443, with no domain or DNS setup, so it doesn't depend on DNS at all. Optional WebSocket transport lets it run through a CDN.
- Carried in
- SSH inside TLS
- Port
- 8443/TCP
- Speed
- Medium
- Extra
- Optional WebSocket for CDN
- Use when
- DNS is filtered by local resolvers, or as a quick fallback.
NoizDNS
Anti-analysisUses the same servers and port as DNSTT, but SlipNet adds noise to the timing and size of the DNS queries. That makes the tunnel harder to pick out with statistical analysis. The cost is a little speed.
- Based on
- DNSTT
- Port
- 53/UDP
- Speed
- A little slower than DNSTT
- Use when
- DNSTT is being caught by traffic analysis.
For when nearly everything is blocked
StormDNS is a separate DNS tunnel. Your traffic is encrypted, split into small fragments and sent as DNS queries through public resolvers to our StormDNS server, which puts it back together and sends it on. Your device never connects to our server directly.
It is slower than a normal VPN. Use it for messaging and browsing when the app and the tunnel protocols can't connect. We have tested it in Iran, including during shutdowns, and in Russia and China.
Set up in the client area
- Travels as
- DNS queries through public resolvers
- iPhone & iPad
- Our PremierNexus app, with one-tap import from your dashboard
- Android
- WhiteDNS, free and open source
- Activate
- One click per server. Each gives you your own hostname.
- Iran
- Resolver lists for Iranian networks, refreshed regularly
- Best for
- Messaging and browsing
What to try on your network
- VPNs are blocked, but ordinary websites workLayer 1. Leave Auto mode on (iPhone, iPad) or turn on Bypass (Windows). On Android, start with a Reality server.
- Our server addresses seem to be blockedVLESS over CDN in the app. It goes through a content delivery network, so blocking server IPs doesn't stop it.
- Connections keep getting cut after a whileVLESS xHTTP. It shapes traffic like everyday web requests instead of one long connection.
- Nothing in the app connects, but DNS still worksLayer 2. Start with DNSTT in SlipNet. If it gets detected, move to VayDNS or NoizDNS.
- DNS tunnels are blocked or too slowNaiveProxy (HTTPS on 443) or StunTLS (8443). On iPhone, NaiveProxy through Shadowrocket.
- Nearly everything is blockedLayer 3. StormDNS, through public DNS resolvers. Slow, but enough for messaging and browsing.
Included with every subscription
All three layers come with every PremierVPN plan, from $4.99 a month. No extra fees and no separate tiers.
Every layer
The stealth protocols in the apps, both tunnel servers and StormDNS, all on one subscription.
Switch any time
If one method is blocked on your network, move to the next. Nothing to buy or upgrade.
Our own servers
We run our own servers. An independent company, funded by subscriptions, with no ads.
Real people
Stuck on a network? Open a ticket in the client area or email [email protected] and a person will help.
Country guides and protocol explainers
Anti-censorship questions
What makes a VPN anti-censorship?
Where should I start?
Does it work in Iran, China and Russia?
Is it slower than a normal VPN?
Does it work on iPhone and iPad?
Is it included in my subscription?
How many devices can I use?
Can my ISP see that I am using it?
More ways online when your network blocks VPNs
Stealth protocols in every app, six tunnel protocols on two servers, and StormDNS for the hardest days. All included.
- No activity logs
- Independent
- 30-day money-back
- Cancel anytime