# How do I host a VPN that works in censored countries?

> How to host a VPN that works in censored countries: obfuscated protocols and Tor bridges, from official docs. No KYC, crypto, from $72.62.

- URL: https://ravenquay.com/self-hosted-vpn-censored-countries/
- Last updated: 2026-11-02
- Publisher: Ravenquay (https://ravenquay.com)

Why plain WireGuard gets blocked, which obfuscation and bridge tools the official projects document, and the legal line users themselves must weigh.

**Quick answer — How do I host a VPN that works in censored countries?**

To host a VPN that works in censored countries, run an obfuscated protocol so the traffic does not look like a VPN, or run a Tor bridge. Plain WireGuard and OpenVPN are easy to fingerprint and block. Tools like AmneziaWG, Xray with REALITY and obfs4 hide the pattern. **Ravenquay** rents whole servers in four countries, from $72.62 per 30 days, in crypto with no KYC. No tool is guaranteed to work.

## What a circumvention VPN needs from the server

| Attribute | Value |
| --- | --- |
| Machine | Offshore dedicated servers with unmetered bandwidth: one physical machine per customer, rented whole, with root access and a port that carries traffic without a monthly quota |
| Root access | Root over SSH, your way: give a public key at checkout and password login is switched off, or leave the field blank and a temporary root password arrives with the server, to change the first time you log in |
| Systems | Choose Debian, Ubuntu, AlmaLinux or Rocky Linux, or Proxmox VE to host your own virtual machines. Windows is not available |
| Bandwidth | Unmetered means no monthly traffic quota and no overage bill: the port speed of your plan, 1 or 10 Gbit/s, is the only limit. Each server has one dedicated IPv4 address and an IPv6 /64 |
| Ports of call | Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price |
| Logs on our side | We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers |
| Banned uses | Forbidden: spam or bulk email, phishing, malware or botnet command, DDoS or other attacks, scanning or brute-forcing other people’s systems, booter or stresser services, carding or fraud, child sexual abuse material, cryptocurrency mining, and any service to sanctioned people or companies |
| Identity | No KYC: no ID, no selfie, no documents, no card and no phone number, ever |
| Price per 30 days | Harbor 8 $72.62, Harbor 16 $205.27, Harbor 10G $356.25 |

> **This is a technical guide, not legal advice** Running the tools is one question; using them where you are is another. Some countries restrict or penalise VPN or circumvention use. The notes below are sourced and dated, and they are not legal advice. Anyone connecting from a censored network should weigh their own risk first.

## Why do plain VPNs get blocked on censored networks?

A plain VPN is easy to recognise, so a censor can block it by pattern rather than by address. WireGuard's own documentation says it does not focus on obfuscation, and that obfuscation should sit in a layer above it.

Amnezia's documentation makes the point from the other side. It says WireGuard's fixed packet headers and predictable packet sizes create an easily recognisable signature. Deep-packet-inspection systems, it adds, can spot such packets and cut the connection.

**A censor does not need your server's address to block a VPN; the shape of the traffic is enough.** The fix is to change that shape, or to hide the tunnel inside traffic the network allows. Neither is certain to work, and a method that works today may be blocked tomorrow.

## Which obfuscation tools do the official projects document?

Several open projects document a way to disguise a tunnel. Each runs on the whole-machine Linux servers we rent. The entries below come from each project's own repository or docs.

### Obfuscation and bridge tools, from their own documentation

| Tool | What it does | What the traffic looks like | Licence |
| --- | --- | --- | --- |
| AmneziaWG (amneziawg-go) | A WireGuard fork that adds junk packets, padding and changed headers against DPI | Not a fixed WireGuard signature; can be set to resemble common UDP | MIT |
| Xray-core with REALITY | VLESS and other protocols; REALITY borrows a real external site's TLS | A TLS connection to a genuine third-party HTTPS site | MPL-2.0 |
| obfs4 (Tor bridge) | A Tor pluggable transport run as a bridge | Random-looking traffic; resists scanning for bridges | Open source (Tor Project) |
| WebTunnel (Tor bridge) | A Tor bridge that imitates HTTPS web browsing, behind your own TLS site | An HTTPS website on your own domain | Open source (Tor Project) |
| OpenVPN with --tls-crypt | Encrypts the control channel so the handshake is hidden | Harder to identify as OpenVPN; runs over TCP or UDP | Open source (OpenVPN) |

Facts from each project's docs or repository, read on 1 November 2026. Ravenquay does not supply or configure these tools; you install them.

## How does an obfuscated WireGuard setup work?

AmneziaWG keeps WireGuard's cryptography and changes what the packets look like. Its documentation says it uses the same single-pass ChaCha20-Poly1305 as WireGuard, and that the cryptographic core is unchanged, which preserves performance and security.

The disguise comes from parameters. The repository describes junk packets before each handshake, sized between a minimum and a maximum, plus padding and changed header type fields. It recommends setting the junk and signature parameters on the client side.

Amnezia's installer reaches your server over SSH as root or a sudo user, and installs on a Linux server you own or lease. It recommends moving the port off the high range, because some ISPs block UDP on high ports. **An obfuscated fork trades a recognisable fingerprint for one that blends in; it does not make the tunnel invisible.**

## How does Xray with REALITY hide a server?

REALITY makes your proxy answer like a real HTTPS site. The project's repository says it removes the server-side TLS fingerprint and borrows the certificate of a genuine external site, set as the target.

The setup needs a target site that supports TLS 1.3 and HTTP/2 and is not used for redirects. You also generate a short ID and an X25519 key pair with Xray's own tool. The repository notes this lets you borrow a third-party site without buying a domain or running your own TLS server.

Xray-core is Mozilla-licensed and installs from an official script, a Docker image or Go source. It supports VLESS, VMess, Trojan, Shadowsocks, XTLS Vision and REALITY. Pick a target you are allowed to imitate, and read the project's own warnings before you deploy.

## Can I run Tor bridges instead of a VPN?

Yes. The Tor Project documents bridges as alternative entry points that help reach Tor when direct connections are blocked. A bridge on your server lets others connect to Tor; it is not the same as a personal VPN.

- **obfs4 bridge.** The Tor Project's guide needs only 24/7 connectivity and the ability to expose TCP ports, with NAT out of the way. It makes Tor traffic look random and resists scanning for bridges.
- **WebTunnel bridge.** It imitates HTTPS web browsing. The guide asks for a domain you control, a valid TLS certificate, a web server such as NGINX or Apache as a reverse proxy, a static IPv4 address and at least 1 GB of RAM, 4 GB recommended.

The Tor Project's guidance by country, read today, names WebTunnel, Snowflake, meek and obfs4 for different places, and hedges throughout with words like "may" and "generally". The setup of a relay or bridge on a rented server is on [what you need to run a Tor relay](https://ravenquay.com/tor-relay-requirements/ "Hardware, ports and abuse handling for a Tor relay").

## Is it legal for users to use these tools where they are?

That depends on each user's country, and some do penalise VPN or circumvention use. These reports are sourced and dated, and this is not legal advice.

- **Iran.** Freedom House's 2024 report says the Supreme Council of Cyberspace prohibited the use of "unauthorised" VPNs in February 2024, after criminalising their sale and distribution earlier.
- **China.** The same 2024 report says providers may not set up VPNs without approval, and records a 200-yuan fine in August 2023 for a programmer who used an "unauthorised" VPN.
- **Russia.** A law signed on 31 July 2025, effective 1 September 2025, fines deliberately searching for "extremist" material, reported at 3,000 to 5,000 roubles, and separately fines advertising VPNs. News reports say VPN use itself was not banned.

**Hosting a circumvention tool outside a censored country is a different act from using it inside one.** We host servers; we cannot advise on the law of a user's country, and no tool is guaranteed to work there.

## Where should the server sit, and what does it cost?

Put the server outside the censored network, in a country whose law you have checked. Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price. The operator's view of the four is on [the best country for hosting a VPN server](https://ravenquay.com/best-country-for-vpn-server/ "Data retention and EU status, compared for VPN operators").

**Ravenquay checked 18 crypto-paid, no-ID hosts with a comparable dedicated plan on 30 October 2026: 11 sold an unmetered server.** No KYC: no ID, no selfie, no documents, no card and no phone number, ever. Service is not available to residents or companies of Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, nor in the occupied regions of Ukraine.

### Berths for a circumvention server

| Berth | Server | Port | Price per 30 days |
| --- | --- | --- | --- |
| Harbor 8 | Intel Xeon E-2388G (8 cores / 16 threads), 64 GB DDR4 ECC, 2 × 960 GB NVMe in RAID 1, unmetered 1 Gbit/s port, 1 IPv4 and an IPv6 /64 | 1 Gbit/s | $72.62/30 days |
| Harbor 16 | AMD Ryzen 9 7950X (16 cores / 32 threads), 128 GB DDR5, 2 × 1.92 TB NVMe in RAID 1, unmetered 1 Gbit/s port, 1 IPv4 and an IPv6 /64 | 1 Gbit/s | $205.27/30 days |
| Harbor 10G | AMD EPYC 9254 (24 cores / 48 threads), 128 GB DDR5 ECC, 2 × 1.92 TB NVMe in RAID 1, unmetered 10 Gbit/s port, 1 IPv4 and an IPv6 /64 | 10 Gbit/s | $356.25/30 days |

*Prices checked on October 30, 2026.*

Each berth is priced at least 25% under a named unmetered server, read on 30 October 2026: Harbor 10G against KoDDoS at $475.00 a month. Every reference and the full rule are on the pricing page.

## Which berth fits a circumvention server?

Harbor 8 suits a single bridge or a small obfuscated tunnel. See the 6- and 12-month prices on [how much a Ravenquay unmetered server costs](https://ravenquay.com/pricing/ "Ravenquay berth prices for 30 days, 3 months, 6 months and 12 months").

| Plan | Quantity | 30 days | 3 months | 6 months | 1 year |
| --- | --- | --- | --- | --- | --- |
| Harbor 8 | 8 cores · unmetered 1 Gbit/s | $72.62 | $196.07 (−10%) | $348.57 (−20%) | $610 (−30%) |
| Harbor 16 | 16 cores · unmetered 1 Gbit/s | $205.27 | $554.22 (−10%) | $985.29 (−20%) | $1,724.26 (−30%) |
| Harbor 10G | 24 cores · unmetered 10 Gbit/s | $356.25 | $961.87 (−10%) | $1,710 (−20%) | $2,992.50 (−30%) |

In every plan: Unmetered port · Tor exits allowed · RAID 1 · Dedicated IPv4 · No logs · No KYC

**Before you pay**

- Minimum top-up $1. Top up once in crypto, then buy any plan from your balance.
- Credit on your balance does not expire and renews any of your servers. When a top-up is only made to reach the minimum, the unspent part comes back on request within 30 days of payment, in USDT or USDC. The rest of a balance is not paid out unless the law requires it.
- Credited once your payment is checked on the blockchain. Typical network confirmation time: BTC ≈ 20 min · USDT TRC-20 ≈ 1 min · USDT ERC-20 ≈ 5 min · USDC ERC-20 ≈ 5 min · ETH ≈ 5 min · SOL ≈ 1 min · LTC ≈ 15 min · XMR ≈ 20 min

## VPNs on censored networks: common questions

### Will any of these tools definitely get through?

No. No tool is guaranteed to work, and a method that connects today may be blocked tomorrow. The Tor Project's own guidance hedges with words like "may" and "generally" and lists several transports to try.

### Does Ravenquay set up AmneziaWG or Xray for me?

No. We deliver a whole server with root access and a Linux system; you install and configure the tool. Our pages point to each project's official documentation.

### Can a censored network see my server's address?

It can see the address your users connect to. Obfuscation hides the pattern of the traffic, not the address. If an address is blocked, you move the service to another one.

### Is hosting a circumvention server against your rules?

No. A VPN, a proxy or a Tor bridge for lawful access to information is allowed. The banned uses still apply to everything on the server, and you answer for it.

### Can I pay without ID?

Yes. No KYC: no ID, no selfie, no documents, no card and no phone number. You top up a balance with crypto and pay each berth from it.

**Put a server outside the censored network** Harbor 8: Intel Xeon E-2388G (8 cores / 16 threads), 64 GB DDR4 ECC, 2 × 960 GB NVMe in RAID 1, unmetered 1 Gbit/s port, 1 IPv4 and an IPv6 /64, for $72.62/30 days. Four countries; crypto, no KYC. [Order Harbor 8 in Reykjavik](https://ravenquay.com/app/checkout/?plan=harbor-8&location=is-rkv&lang=en) · [Compare berths](https://ravenquay.com/pricing/ "How much does a Ravenquay unmetered server cost?")

## Sources

1. [Known Limitations (Deep Packet Inspection)](https://www.wireguard.com/known-limitations/) — WireGuard (read 2026-11-01)
2. [AmneziaWG (amneziawg-go) README](https://github.com/amnezia-vpn/amneziawg-go) — Amnezia VPN (read 2026-11-01)
3. [AmneziaWG documentation](https://docs.amnezia.org/documentation/amnezia-wg/) — Amnezia VPN (read 2026-11-01)
4. [Install a VPN on your own server](https://docs.amnezia.org/documentation/instructions/install-vpn-on-server/) — Amnezia VPN (read 2026-11-01)
5. [REALITY (server-side implementation)](https://github.com/XTLS/REALITY) — XTLS / Project X (read 2026-11-01)
6. [Xray-core (Project X)](https://github.com/XTLS/Xray-core) — XTLS / Project X (read 2026-11-01)
7. [WebTunnel bridge setup](https://community.torproject.org/relay/setup/webtunnel/) — The Tor Project (read 2026-11-01)
8. [obfs4 bridge setup](https://community.torproject.org/relay/setup/bridge/) — The Tor Project (read 2026-11-01)
9. [Circumvention and bridges (country guidance)](https://support.torproject.org/tor-browser/circumvention/) — The Tor Project (read 2026-11-01)
10. [OpenVPN 2.6 reference manual: --tls-crypt](https://openvpn.net/community-docs/community-articles/openvpn-2-6-manual.html) — OpenVPN (read 2026-11-01)
11. [Another Door Closes: Authoritarians Expand Restrictions on VPNs (21 November 2024)](https://freedomhouse.org/article/another-door-closes-authoritarians-expand-restrictions-virtual-private-networks) — Freedom House (read 2026-11-01)
12. [Putin signs a bill punishing online searches for information deemed 'extremist' (31 July 2025)](https://www.yahoo.com/news/articles/putin-signs-bill-punishing-online-174032620.html) — Associated Press (read 2026-11-01)

---

Ravenquay: Ravenquay rents offshore dedicated servers with unmetered 1 and 10 Gbit/s ports in Reykjavik, Zurich, Bucharest and Amsterdam: each one a whole physical machine with root access and no monthly traffic quota, paid in crypto with no KYC (no ID, no selfie, no documents). It is run by DomaineGoat LLC, a company registered in Panama, and each server also falls under the data-protection law of its datacenter's country. On the 30-day term, each berth is priced at least 25% under a named comparable unmetered server from 10 no-KYC crypto hosts, read on 30 October 2026.