If you have ever watched a VPN app spin on hotel Wi-Fi, on a campus network, or in a country that filters the internet, you have met the problem this post is about. The app worked at home. Here it connects for a moment, then stalls, or never connects at all. Nothing is wrong with the app. The network simply recognised it.
Blocking a VPN is easier than it sounds
A filter does not need to read your traffic to block it. It only needs to tell that the traffic is a VPN. The common protocols make that easy.
- They use their own ports. OpenVPN usually runs on port 1194, WireGuard on 51820, IKEv2 on 500 and 4500. A network that only allows web traffic drops everything else without looking at it.
- They have a recognisable shape. Even on another port, each protocol has a handshake and packet pattern of its own. Deep packet inspection matches those patterns in seconds, and the connection quietly stops.
- Their servers answer like VPN servers. Some filters probe an address they suspect. If it replies like a VPN server, the address goes on a block list, and so do the ones next to it.
- UDP gets throttled. Most VPN protocols prefer UDP for speed. Many mobile operators and public networks slow UDP down or block it, so the tunnel never gets going.
Two practical problems come on top. VPN download pages are often blocked where you need them most. And free VPNs share a few server addresses among millions of users, so those addresses are listed first.
Why encryption alone does not help
People sometimes ask for a stronger VPN, as if the filter were breaking the encryption. It is not. Nothing inside the tunnel is being read. The weakness is on the outside: the tunnel is easy to spot. So the fix is not stronger keys. The fix is traffic that does not look like a VPN at all.
What Stealth VPN does differently
Stealth VPN is the TorSentinel service for networks that block VPNs. Its app is StealthLink. It was designed around the four ways filters work, listed above.
It looks like a normal website visit
The connection goes to port 443, the same port every secure website uses, with a standard TLS handshake and a valid certificate from a public authority. To the network it looks like your device opened an HTTPS site. There is no VPN port to block and no VPN handshake to fingerprint.
It falls back to TCP on its own
The app tries a fast UDP path first. If the network throttles or blocks UDP, which mobile networks often do, it switches to TCP on port 443 by itself. You do not change a setting; the first connection may just take a few seconds longer.
Nothing leaks around the tunnel
Once connected, everything on the device goes through the tunnel, including DNS lookups, so the network cannot see which sites you resolve. IPv6 is blocked inside the app so it cannot slip past the tunnel and reveal your real address. Our free IP leak test and DNS leak test let you confirm both.
Several locations, chosen automatically
There are eight locations: Amsterdam, Lyon, Roubaix, Montreal, Sandefjord, Sevilla, Singapore and Tokyo. On Automatic, the app picks the fastest one that answers from where you are. If one slows down, pick another from the list.
You can get the app even when our site is blocked
If the download page is unreachable, email [email protected] and we send the installer. Email usually gets through where websites do not.
What it cannot do
No service connects on every network every day. During a full internet shutdown, nothing connects, including Stealth VPN. Filtering also tightens around elections, protests and exams. That is why free access exists: test it on your own connection, on Wi-Fi and on mobile data, before you pay. Keep a second method as a backup, and follow the laws that apply where you are.
Where it fits, and where it does not
Stealth VPN is for staying connected and private on networks that block VPNs: hotels, cafés and airports, campus and office networks, and countries that filter the internet. We publish country pages for Iran and China with the details that matter there.
It is not a torrenting VPN. For downloading and seeding, Armor is the right product: a WireGuard VPN with a forwarded port at every location, plus a SOCKS5 proxy for your torrent client, with Monitor included. One TorSentinel account can hold both plans.
Trying it takes about a minute
Install StealthLink for Windows, macOS, Linux or Android from the Stealth VPN page; iPhone and iPad are coming soon. Choose free access, enter your email, type the 6-digit code we send, and connect. Free access is limited to 5 Mbps, 30-minute sessions and 2 hours a day on one device, enough to find out whether it connects on your network. Full access removes every limit and covers up to 5 devices. Card payments have a 7-day money-back guarantee; crypto payments cannot be refunded, so try free access first.
If it does not connect, try another location, switch between Wi-Fi and mobile data, then open a ticket with your city, your ISP or operator and what you tried. A real person replies, usually within a few hours and always within 24 hours.