VPN blocked? Which free VPN protocol to try first

If a VPN will not connect, the network you are on may be blocking it. Different VPN protocols look different to a network, so when one fails another often works. Here is the order we suggest.

1. V2Ray — looks like a normal website

V2Ray sends traffic inside an encrypted WebSocket connection on port 443, the same port every HTTPS website uses. It is usually the first thing to try when other VPNs are blocked. Import the QR code into v2rayNG (Android), Shadowrocket or V2Box (iPhone), or v2rayN (Windows).

Tip: if it fails, turn on automatic date and time on your device — a wrong clock breaks the secure connection.

2. SSH tunnel with SSL or WebSocket

SSH configurations work with apps such as HTTP Injector, HTTP Custom and NetMod. If the normal SSH port is blocked, use the SSL port (443) or WebSocket port (80) shown with your account.

3. SSTP over TCP

SSTP runs over TCP, which some networks let through when UDP is blocked, and it is built into Windows. (OpenVPN on our servers uses UDP, like WireGuard.)

4. WireGuard, OpenVPN and L2TP on open networks

WireGuard is our recommended everyday choice, OpenVPN works with almost every device, and L2TP/IPsec needs no extra app on Windows, Mac and iPhone. All three use UDP, which restrictive networks often block. Use them at home, on mobile data, or anywhere they connect.

Still not connecting?

• Try a different server location — networks treat each address differently.
• Create a fresh account; expired accounts are refused.
• Switch between Wi-Fi and mobile data.

No VPN can promise to work on every network. Please also respect the laws that apply where you are.