Guide · Circumvention tools
Why plain WireGuard gets blocked, which obfuscation and bridge tools the official projects document, and the legal line users themselves must weigh.
Quick answer
How do I host a VPN that works in censored countries?
To host a VPN that works in censored countries, run an obfuscated protocol so the traffic does not look like a VPN, or run a Tor bridge. Plain WireGuard and OpenVPN are easy to fingerprint and block. Tools like AmneziaWG, Xray with REALITY and obfs4 hide the pattern. Ravenquay rents whole servers in four countries, from $72.62 per 30 days, in crypto with no KYC. No tool is guaranteed to work.
| Machine | Offshore dedicated servers with unmetered bandwidth: one physical machine per customer, rented whole, with root access and a port that carries traffic without a monthly quota |
|---|---|
| Root access | Root over SSH, your way: give a public key at checkout and password login is switched off, or leave the field blank and a temporary root password arrives with the server, to change the first time you log in |
| Systems | Choose Debian, Ubuntu, AlmaLinux or Rocky Linux, or Proxmox VE to host your own virtual machines. Windows is not available |
| Bandwidth | Unmetered means no monthly traffic quota and no overage bill: the port speed of your plan, 1 or 10 Gbit/s, is the only limit. Each server has one dedicated IPv4 address and an IPv6 /64 |
| Ports of call | Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price |
| Logs on our side | We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers |
| Banned uses | Forbidden: spam or bulk email, phishing, malware or botnet command, DDoS or other attacks, scanning or brute-forcing other people’s systems, booter or stresser services, carding or fraud, child sexual abuse material, cryptocurrency mining, and any service to sanctioned people or companies |
| Identity | No KYC: no ID, no selfie, no documents, no card and no phone number, ever |
| Price per 30 days | Harbor 8 $72.62, Harbor 16 $205.27, Harbor 10G $356.25 |
A plain VPN is easy to recognise, so a censor can block it by pattern rather than by address. WireGuard's own documentation says it does not focus on obfuscation, and that obfuscation should sit in a layer above it.
Amnezia's documentation makes the point from the other side. It says WireGuard's fixed packet headers and predictable packet sizes create an easily recognisable signature. Deep-packet-inspection systems, it adds, can spot such packets and cut the connection.
A censor does not need your server's address to block a VPN; the shape of the traffic is enough. The fix is to change that shape, or to hide the tunnel inside traffic the network allows. Neither is certain to work, and a method that works today may be blocked tomorrow.
Several open projects document a way to disguise a tunnel. Each runs on the whole-machine Linux servers we rent. The entries below come from each project's own repository or docs.
| Tool | What it does | What the traffic looks like | Licence |
|---|---|---|---|
| AmneziaWG (amneziawg-go) | A WireGuard fork that adds junk packets, padding and changed headers against DPI | Not a fixed WireGuard signature; can be set to resemble common UDP | MIT |
| Xray-core with REALITY | VLESS and other protocols; REALITY borrows a real external site's TLS | A TLS connection to a genuine third-party HTTPS site | MPL-2.0 |
| obfs4 (Tor bridge) | A Tor pluggable transport run as a bridge | Random-looking traffic; resists scanning for bridges | Open source (Tor Project) |
| WebTunnel (Tor bridge) | A Tor bridge that imitates HTTPS web browsing, behind your own TLS site | An HTTPS website on your own domain | Open source (Tor Project) |
| OpenVPN with --tls-crypt | Encrypts the control channel so the handshake is hidden | Harder to identify as OpenVPN; runs over TCP or UDP | Open source (OpenVPN) |
Facts from each project's docs or repository, read on 1 November 2026. Ravenquay does not supply or configure these tools; you install them.
AmneziaWG keeps WireGuard's cryptography and changes what the packets look like. Its documentation says it uses the same single-pass ChaCha20-Poly1305 as WireGuard, and that the cryptographic core is unchanged, which preserves performance and security.
The disguise comes from parameters. The repository describes junk packets before each handshake, sized between a minimum and a maximum, plus padding and changed header type fields. It recommends setting the junk and signature parameters on the client side.
Amnezia's installer reaches your server over SSH as root or a sudo user, and installs on a Linux server you own or lease. It recommends moving the port off the high range, because some ISPs block UDP on high ports. An obfuscated fork trades a recognisable fingerprint for one that blends in; it does not make the tunnel invisible.
REALITY makes your proxy answer like a real HTTPS site. The project's repository says it removes the server-side TLS fingerprint and borrows the certificate of a genuine external site, set as the target.
The setup needs a target site that supports TLS 1.3 and HTTP/2 and is not used for redirects. You also generate a short ID and an X25519 key pair with Xray's own tool. The repository notes this lets you borrow a third-party site without buying a domain or running your own TLS server.
Xray-core is Mozilla-licensed and installs from an official script, a Docker image or Go source. It supports VLESS, VMess, Trojan, Shadowsocks, XTLS Vision and REALITY. Pick a target you are allowed to imitate, and read the project's own warnings before you deploy.
Yes. The Tor Project documents bridges as alternative entry points that help reach Tor when direct connections are blocked. A bridge on your server lets others connect to Tor; it is not the same as a personal VPN.
The Tor Project's guidance by country, read today, names WebTunnel, Snowflake, meek and obfs4 for different places, and hedges throughout with words like "may" and "generally". The setup of a relay or bridge on a rented server is on what you need to run a Tor relay.
That depends on each user's country, and some do penalise VPN or circumvention use. These reports are sourced and dated, and this is not legal advice.
Hosting a circumvention tool outside a censored country is a different act from using it inside one. We host servers; we cannot advise on the law of a user's country, and no tool is guaranteed to work there.
Put the server outside the censored network, in a country whose law you have checked. Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price. The operator's view of the four is on the best country for hosting a VPN server.
Ravenquay checked 18 crypto-paid, no-ID hosts with a comparable dedicated plan on 30 October 2026: 11 sold an unmetered server. No KYC: no ID, no selfie, no documents, no card and no phone number, ever. Service is not available to residents or companies of Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, nor in the occupied regions of Ukraine.
| Berth | Server | Port | Price per 30 days |
|---|---|---|---|
| Harbor 8 | Intel Xeon E-2388G (8 cores / 16 threads), 64 GB DDR4 ECC, 2 × 960 GB NVMe in RAID 1, unmetered 1 Gbit/s port, 1 IPv4 and an IPv6 /64 | 1 Gbit/s | $72.62/30 days |
| Harbor 16 | AMD Ryzen 9 7950X (16 cores / 32 threads), 128 GB DDR5, 2 × 1.92 TB NVMe in RAID 1, unmetered 1 Gbit/s port, 1 IPv4 and an IPv6 /64 | 1 Gbit/s | $205.27/30 days |
| Harbor 10G | AMD EPYC 9254 (24 cores / 48 threads), 128 GB DDR5 ECC, 2 × 1.92 TB NVMe in RAID 1, unmetered 10 Gbit/s port, 1 IPv4 and an IPv6 /64 | 10 Gbit/s | $356.25/30 days |
Prices checked on
Each berth is priced at least 25% under a named unmetered server, read on 30 October 2026: Harbor 10G against KoDDoS at $475.00 a month. Every reference and the full rule are on the pricing page.
Harbor 8 suits a single bridge or a small obfuscated tunnel. See the 6- and 12-month prices on how much a Ravenquay unmetered server costs.
Best value
8 cores · unmetered 1 Gbit/s
$72.62
3 months $196.07 (−10%)6 months $348.57 (−20%)1 year $610 (−30%)
16 cores · unmetered 1 Gbit/s
$205.27
3 months $554.22 (−10%)6 months $985.29 (−20%)1 year $1,724.26 (−30%)
24 cores · unmetered 10 Gbit/s
$356.25
3 months $961.87 (−10%)6 months $1,710 (−20%)1 year $2,992.50 (−30%)
In every plan: Unmetered port · Tor exits allowed · RAID 1 · Dedicated IPv4 · No logs · No KYC
No. No tool is guaranteed to work, and a method that connects today may be blocked tomorrow. The Tor Project's own guidance hedges with words like "may" and "generally" and lists several transports to try.
No. We deliver a whole server with root access and a Linux system; you install and configure the tool. Our pages point to each project's official documentation.
It can see the address your users connect to. Obfuscation hides the pattern of the traffic, not the address. If an address is blocked, you move the service to another one.
No. A VPN, a proxy or a Tor bridge for lawful access to information is allowed. The banned uses still apply to everything on the server, and you answer for it.
Yes. No KYC: no ID, no selfie, no documents, no card and no phone number. You top up a balance with crypto and pay each berth from it.
Put a server outside the censored network
Harbor 8: Intel Xeon E-2388G (8 cores / 16 threads), 64 GB DDR4 ECC, 2 × 960 GB NVMe in RAID 1, unmetered 1 Gbit/s port, 1 IPv4 and an IPv6 /64, for $72.62/30 days. Four countries; crypto, no KYC.
Unmetered from $72.62/30 days · no KYC
Reserve a berth