Hysteria2 Protocol: QUIC Transport, Brutal Speed and an HTTP/3 Disguise

Hysteria2 is an open-source proxy protocol (MIT licence, one binary that works as server or client) that carries TCP and UDP traffic over QUIC, the HTTP/3 transport running on UDP. It hides behind the appearance of an ordinary web server, authenticates clients with a password, and gets its speed from a congestion control called Brutal. It is a protocol and a piece of software, not a VPN company: a provider, a client app or a self-hosted panel can support it, and you can also run it on your own VPS.

What happens when a client connects

The connection opens as a standard QUIC session per RFC 9000, so the server must hold a TLS certificate and, by default, listens on UDP 443, the port where HTTP/3 normally lives. After the handshake, the client sends an HTTP/3 POST request to /auth with the credential in a header. Success gets a reply with status code 233; a wrong or missing password produces ordinary web-server behaviour, so a prober sees a website rather than a proxy. Past authentication, each TCP connection maps to its own QUIC stream, while UDP packets travel as unreliable datagrams. Oversized UDP packets get split into fragments, and losing one fragment kills the whole packet.

Brutal and the bandwidth number you type in

Most congestion controls read packet loss as congestion and slow down. Brutal does the opposite: it holds the rate you declare and even sends slightly faster to compensate for measured loss. The catch is that Brutal only runs on a direction where you actually set a bandwidth value; without one, Hysteria2 falls back to BBR (or Reno), and a server option can refuse client bandwidth hints entirely. When both sides state a value, the lower one wins. The documented trap: never set the bandwidth above what the line can really carry, or you get a slow, unstable connection and wasted data. Understating it simply acts as a speed cap.

Three ways the server hides itself

Masquerade defeats active probing; Salamander targets networks that block QUIC or HTTP/3 itself but still pass UDP.

Port hopping when one UDP port gets throttled

When an ISP throttles a single long-lived UDP port, the client can jump across a list or range of ports at intervals of at least five seconds (randomised between a minimum and maximum if you want). On Linux the server claims the whole port range and sets up the firewall redirect automatically. Against a network-wide UDP block this does nothing. There is also a Mimic fake-TCP mode, but it is a niche fix: Linux-only, needs root and a kernel module, and cannot be combined with port hopping.

Where Hysteria2 wins and where it stalls

Lossy, congested or long-distance links (mobile data, crowded Wi-Fi, intercontinental routes) are its home turf, exactly where TCP-style backoff kills throughput. Office and campus networks that drop or throttle UDP are where it dies silently. The sing-box documentation also warns that UDP-based proxies have more obvious traffic characteristics than TCP ones, and a steady high-rate Brutal stream does not look like browser traffic. Keep VLESS with Reality over TCP as your fallback; the Hysteria2 vs VLESS Reality comparison explains which protocol to lead with on which network. TUIC is the other QUIC-based option worth a look.

Hysteria2 in VPN services and apps

Out of 543 consumer VPNs in the VPNRadarLab database, 23 services say they offer Hysteria2, 126 list it as unsupported, and the remaining 394 publish nothing on the subject, which is not the same as a no. The ranking of Hysteria2 providers, clients and panels lists 37 entries, 10 of them in the main ranking, spanning providers with their own servers, free client apps and self-hosted panels. The official client exposes SOCKS5 and HTTP proxy ports, TCP/UDP forwarding, a transparent proxy on Linux and TUN mode on Windows, Linux and macOS; TUN carries only TCP and UDP, so ICMP ping is answered locally.

Hysteria2 FAQ

Is Hysteria2 a VPN?

Hysteria2 itself is a proxy protocol, not a VPN service. If you want it to cover the whole device, the client's TUN mode creates a virtual network adapter and routes all traffic through it.

Does Hysteria2 need a domain and a certificate?

A certificate, yes. A domain with an ACME cert makes the masquerade more convincing, but a self-signed cert with a pinned SHA-256 fingerprint (pinSHA256) works too and is safer than the insecure flag.

What is SNI in Hysteria2?

The server name the client uses for certificate verification; it defaults to the server address if not set.

Will a Hysteria 1 config work?

No. Version 2 is a rewrite with no interoperability with 1.x; both ends must run the same major version.

Hysteria2 in short

A password-protected QUIC tunnel disguised as an HTTP/3 website, fast on bad networks that still allow UDP, useless where UDP itself is blocked. Set the bandwidth honestly, remember to open UDP 443 on the firewall (a classic mistake: only TCP 443 open, and the client times out with no error), carry a TCP fallback. The official protocol specification covers the wire-level detail.