Selfhosted

(I don’t need strong censorship resistance; it just has to work in offices and hotel WiFis.

Wireguard on 443 or OpenVPN + Stunnel on 443

Wireguard is easier to setup because there's no OpenVPN app that packages stunnel (afaik), so you have to run 2 apps on your phone to make it work.

A server like caddy can also accept HTTPS traffic for some regular websites next to the VPN server.

Wireguard uses UDP, so just run whatever you want on 443 TCP with caddy (unless you want QUIC for some reason?)

Anything beyond that and you'd be looking at using a proper obfuscation solution like Shadowsocks or obfs4, in which case you should look into Amnezia or Tor bridges.

If you want a decently hidden VPN, I recommend setting up an OpenVPN instance, with a TCP tunnel, encapsulated within Stunnel. It manages to stay hidden even with DPI.

The setup is a bit convoluted, especially if you want everything to use certificates for maximum security. It's also not the fastest VPN, and TCP isn't the most efficient for a VPN. But it's decent enough for a normal user.

You can set it up on both Linux and Windows, even having both ends of the tunnel on Windows, but it's easier and better to set it up on Linux.

You can obfuscate Wireguard with a SOCKS proxy.

You can use stunnel to make your VPN look like HTTPS.

Wireguard on a VPS and run it through port 443. That should get you through most things that don't do TLS inspection

My go to choice for this is ocserv to run a Cisco AnyConnect server, and sniproxy to sit on port 443 and handle traffic routing. You configure sniproxy to go to a different server by hostname, and configure ocserv as the fallback option to access the VPN. Any host I expose via sniproxy provides its own HTTPS certificate via my Traefik server.

Amnezia?

resistant to blocking?

That's going to be the sticky wicket right there. It is rather trivial for server admins to know what IPs go with VPNs and not. Wireguard is about the best thing on the planet right now, imho, but it will also get blocked. Occasionally, I will happen on a site that outright blocks me. If I can't bend the site to my will, I just move on. The information on the blocked site will 9 times out of 10 be found duplicated somewhere else.

One 'trick' I've found works fairly well is Opera. So, when I go to pay my bills online, my VPN coupled with the way I have Firefox configured, will trigger a block. I can fire up Opera, engage it's built in VPN, still keep my local VPN connected, and have no problem accessing my bills. It's not an elegant solution, and some users have preclusions to Opera. However, that generally works for me.

I've run Wireguard on 443 (on my router) for exactly that purpose and never had a problem, even when my standard WG port was blocked by some businesses. I've since had to move to port 587 due to router conflicts and it's worked fine so far too.

The battery drain on Android is negligible (at least for my uses) and WG is activated by Tasker whenever my home wifi is out of range. From what I can see WG is configurable via Docker compose.

Use xray. I suggest the REALITY + XHTTP setup where you look like another h2 server

You can docker compose your panel for managing your server, get a free subdomain from afraid.org and set up tls on it

I use the v2rayng mobile app since I don't switch servers much, I only have two

It's not quite a VPN, but it is very resistant against blocking:

https://programming.dev/comment/22662028

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #171 for this comm, first seen 16th Mar 2026, 17:30] [FAQ] [Full list] [Contact] [Source code]