A network can block a VPN once it recognizes the traffic. This page shows what gives a tunnel away, how Cloak Mode and Block QUIC change that, and what they cannot hide.
How a network detects a VPN
Encryption hides what is inside a tunnel, not the tunnel itself. A network filter using deep packet inspection (DPI) cannot read your users' traffic, but it can see its shape: packets going back and forth in one long connection look nothing like a browser's separate requests. That is enough to recognize the tunnel and drop it.
A network can also probe a server it suspects: it connects to it and sees how it answers.
Cloak Mode: your server looks like a web server
Apps connect to your server over TLS, as browsers connect to a website, and anything that is not a VpnHood app gets a web server's refusal. In Cloak Mode, each connection a device opens also gets a connection of its own to your server. So to a network that watches it, the traffic keeps the shape of what your users do every day:
Web browsing. A page opens a few connections at once. Each sends a small request, brings back a larger answer and ends, and then nothing moves while the user reads.
Downloads. A file comes in over one connection that stays busy until it is done, with far more data coming in than going out.
None of this is staged: it is your users' own browsing and downloads, carried one connection at a time. Without Cloak Mode, the same traffic runs through one long tunnel.
Block QUIC: how it makes VPN traffic harder to detect
Cloak Mode needs a TCP connection to end on the device. Many websites and video apps use QUIC instead, which runs over UDP, so in Cloak Mode their traffic still goes as packets, in one long tunnel that a network filter can recognize and drop.
With Block QUIC on, the app drops that traffic on the device, before it enters the tunnel. Most browsers and streaming apps then switch to TCP, which Cloak Mode can carry, but an app that works only over QUIC gets no connection. The setting is off by default, and the app shows it only in Cloak Mode. A server that does not carry QUIC turns it on for its users. This is the QUIC of your users' own apps, not the one in the app's protocol setting.
What Cloak Mode cannot hide
Cloak Mode is a likeness, not a guarantee. UDP still goes as packets, and so does QUIC unless Block QUIC is on, and a new server has a self-signed certificate, unlike a website. Keep your server's IP address from being blocked shows how to close these gaps. Cloak Mode also hides what the traffic is, not where it goes: a network can still see a device's traffic going to one address, and block that address.
