Last updated: July 2026
VPN glossary: the key terms worth knowing
Short answer
This VPN glossary defines the terms you meet most often when using a VPN — VLESS, Reality, WireGuard, AmneziaWG, Hysteria2, DPI, GFW, DNS leak, kill switch, no-logs, obfuscation, and jurisdiction — each explained briefly and precisely.
TL;DR
- 12 key terms in 3 groups: protocols, censorship & circumvention, privacy & security
- Covers every TukTukVPN protocol: VLESS, Reality, WireGuard, AmneziaWG, Hysteria2
- Explains DPI and the GFW used to block VPNs, and the obfuscation used to get past them
- Privacy terms: DNS leak, kill switch, no-logs, jurisdiction
Protocols & transport
- VLESS
- A transport protocol from the Xray/V2Ray family, designed to be lightweight and stateless with no encryption layer of its own — so it leaves no easy signature to detect. Usually paired with Reality or TLS to disguise traffic as ordinary HTTPS browsing. One of the protocols TukTukVPN runs (VLESS+Reality).
- Reality
- An Xray connection-camouflage technique that makes VPN traffic look like a genuine TLS connection to a real, well-known website — without needing its own certificate. It defeats DPI detection and SNI-based blocking, so connections survive on heavily filtered networks.
- WireGuard
- A modern VPN protocol with a lean codebase and up-to-date cryptography, delivering high speed and low battery drain — today's most popular standard. Its limitation: the packet format is quite distinctive, so DPI can identify and block it on strictly filtered networks.
- AmneziaWG
- A modified WireGuard fork that adds obfuscation so packets carry none of WireGuard's usual signatures — getting through in countries that block plain WireGuard while keeping WireGuard's speed. TukTukVPN runs WireGuard/AmneziaWG as one of its protocols.
- Hysteria2
- A protocol built on QUIC/UDP, designed to withstand lossy or high-latency networks using aggressive congestion control — so it often delivers better throughput on poor connections or long international routes, and it can masquerade as HTTP/3 traffic.
- Shadowsocks
- An open-source encrypted proxy created in China to slip past the Great Firewall — for years the go-to circumvention tool. Modern DPI systems increasingly fingerprint its traffic, so plain Shadowsocks gets detected and blocked far more often than it once did. That arms race is why TukTukVPN runs VLESS+Reality, which hides inside genuine-looking TLS, instead. It matters as the honest lesson that obfuscation must keep evolving faster than the censors.
- OpenVPN
- A long-established open-source VPN protocol — secure, thoroughly battle-tested, and supported on almost every device and router. Its trade-offs come with age: a heavier codebase, noticeably lower throughput than WireGuard, and a traffic pattern DPI can fingerprint fairly easily. TukTukVPN runs WireGuard/AmneziaWG, VLESS+Reality, and Hysteria2 instead. Worth knowing because many older VPN services still default to it.
Web & encryption fundamentals
- TLSTransport Layer Security
- The encryption protocol behind HTTPS and the padlock in your browser, protecting most traffic between you and the sites you visit. Because TLS is everywhere, it makes perfect camouflage: Reality imitates a genuine TLS handshake to a real website, so VPN traffic looks like ordinary browsing to DPI. For VPN users TLS matters twice over — it secures normal web traffic, and it's the disguise modern obfuscation wears.
- SNIServer Name Indication
- The field in a TLS handshake that tells a server which website you want — sent in plain text, so anyone on the network path can read the destination even though everything else is encrypted. Censors exploit exactly this: drop any handshake whose SNI names a forbidden site. Reality neutralises SNI-based blocking by presenting the SNI of a real, unblocked website. On filtered networks, SNI is often the precise reason a connection dies.
- QUIC
- A modern transport protocol that runs over UDP instead of TCP — designed at Google, standardised by the IETF, and the foundation of HTTP/3. It sets up connections faster, recovers from packet loss more gracefully, and avoids TCP's head-of-line blocking. Hysteria2, one of TukTukVPN's protocols, builds on QUIC — which is why it connects quickly, holds up on lossy hotel or mobile networks, and blends in with everyday web traffic. For VPN users, QUIC is the reason speed survives bad connections.
- HTTP/3
- The newest version of HTTP, running over QUIC (UDP) instead of TCP, and already served by major platforms such as Google and Cloudflare. Because so much legitimate browsing now travels as HTTP/3, obfuscated protocols like Hysteria2 can disguise their traffic as ordinary HTTP/3 and pass filters unremarked. The practical upshot for VPN users: the more the web adopts HTTP/3, the better QUIC-based VPN traffic blends in.
Censorship & circumvention
- DPIDeep Packet Inspection
- Deep inspection of packet contents by an ISP or state to identify and block VPN traffic even when the data itself is encrypted. Large censorship systems like China's Great Firewall use DPI as a primary tool — obfuscation (Reality/AmneziaWG) exists specifically to beat it.
- GFWGreat Firewall
- China's internet censorship system, combining DPI, DNS poisoning, connection resets, and active probing of suspected servers to block both websites and VPNs. Widely considered one of the most sophisticated internet filtering systems in the world.
- Obfuscation
- Techniques that make VPN traffic “not look like a VPN” — masquerading as ordinary HTTPS or QUIC, or stripping a protocol's signatures — so it passes DPI and blocking on heavily filtered networks. The heart of staying connected in countries that censor the internet.
- Active probing
- A censorship technique — used most notably by China's Great Firewall — where the censor doesn't just watch traffic but connects back to a suspected VPN or proxy server, posing as a client, to confirm what it really is before blocking it. Older protocols such as Shadowsocks have been unmasked this way. Reality is built to resist probing: a probe reaching the server receives a genuine response from the real website being imitated. It matters because a protocol that survives passive DPI can still fall to an active probe.
Privacy & security
- DNS leak
- When DNS requests (translating a site name to an IP address) escape to the ISP's servers instead of travelling through the VPN tunnel — letting the ISP see which sites you visit even while connected. A well-designed VPN must prevent DNS leaks.
- Kill switch
- A function that cuts internet access the instant the VPN drops, so real traffic and your real IP never leak outside the tunnel during the gap. An essential safeguard for anyone who needs continuous privacy.
- No-logs
- A policy where the VPN provider keeps no records of usage activity (sites visited, source IP, connection times) in any form traceable back to the user. TukTukVPN holds a strict no-logs policy — it is our stance, and it has not yet been audited by a third party, which we state plainly.
- Jurisdiction
- The country where a VPN company is registered and whose laws it answers to — determining how far a state can compel it to hand over or retain user data. A privacy factor to weigh alongside the no-logs policy itself.
Access & performance
- Geo-blocking
- Restricting content by the viewer's IP-derived location — why a video plays in one country and shows “not available in your region” in another, usually because of regional licensing deals. A VPN routes your traffic through a server in another country, so services see that country's IP instead; whether that is permitted depends on each service's terms of use. For most people it's the everyday reason to switch exit country.
- ISP throttling
- When an internet provider deliberately slows specific kinds of traffic — video streaming, gaming, torrents — rather than your whole connection. Throttling depends on identifying the traffic type first; VPN encryption hides what kind of traffic it is, so the ISP can't single it out to slow down. If speed tests look fine but one app crawls, throttling is a prime suspect — and one a VPN often defeats.
- VoIPVoice over IP
- Making voice and video calls over the internet instead of the phone network, as WhatsApp, FaceTime, and Zoom do. Some countries restrict it: the UAE, notably, blocks many calling apps to protect licensed telecom services. An obfuscated VPN protocol may get calls through on such networks, but no provider can guarantee it and local rules still apply. It matters most to travellers and expats who rely on free calls home.
Frequently asked questions
Why do these terms matter?
Understanding words like DPI, obfuscation, no-logs, and kill switch lets you judge which VPN actually fits your needs — especially on heavily filtered networks or when privacy is the priority.
What's the difference between Reality and AmneziaWG?
Both aim to disguise traffic from DPI, but from different bases: Reality is an Xray technique that makes VLESS look like a genuine TLS connection to a real website, while AmneziaWG is a modified WireGuard with WireGuard's signatures removed. TukTukVPN uses both and switches automatically.
Has TukTukVPN's no-logs policy been audited?
Not yet — it has not been verified by a third party. We hold a strict no-logs policy as a stance and say so plainly; we make no audit claims until a real audit happens.
Ready to try it yourself?
Free 7-day trial, no card — 50GB / 2 devices, every protocol included.