Two Different Problems
There is a difference between a network that cannot read your traffic and a network that cannot tell you are using a VPN. Encryption solves the first problem completely: once a tunnel is established, the operator of the network sees ciphertext and learns nothing about the contents. That protection is strong, well understood, and not seriously disputed.
The second problem is separate. A network can be entirely unable to read your traffic while still recognising, from its shape and timing, that the traffic is a VPN — and then refusing to carry it. Corporate networks do this to enforce policy, some hotels and airlines do it to protect their own traffic shaping, and national censorship systems do it to keep people on inspectable connections.
How a Network Recognises VPN Traffic
The crudest method is blocking well-known ports and protocols outright. This catches basic setups and is trivial to work around, so networks serious about the task use Deep Packet Inspection instead. DPI examines the pattern of a connection rather than its contents: the size of the first few packets, the sequence of message types, and the byte values sitting in the unencrypted parts of the header.
Standard WireGuard is fast and simple, and that simplicity produces a consistent fingerprint. Its handshake messages have fixed, well-documented sizes, and its message-type headers take known values. A DPI system does not need to decrypt anything to compare an observed connection with that published fingerprint — the match is a matter of arithmetic, not cryptanalysis.
What Obfuscation Changes
An obfuscated protocol alters the characteristics a fingerprint depends on. AmneziaWG, the protocol VPN Dan uses, keeps WireGuard’s cryptographic core — the same Curve25519 key exchange and ChaCha20-Poly1305 encryption — and changes what the connection looks like from outside. It can send junk packets before the real handshake, pad handshake messages to non-standard lengths, and replace the standard message-type header values with different ones.
The important consequence is that not every obfuscated connection looks the same. Because the parameters are configurable, two deployments present different patterns, so a signature written for one does not automatically catch another. That is a meaningfully harder problem for a censor than matching one published fingerprint, and it is the entire reason obfuscated forks of WireGuard exist.
What Obfuscation Does Not Do
Obfuscation makes classification harder. It does not make a connection invisible, and any provider claiming otherwise is overselling. A determined operator with enough resources can look at properties that padding does not hide — the volume and timing of traffic, how long connections last, which addresses you keep returning to — and reach conclusions from those instead.
It also cannot help with a network that fails closed. If an operator permits only a short allowlist of destinations and drops everything else, there is no packet shape that gets you through, because nothing unrecognised is being carried in the first place. Obfuscation competes with blocklists, not with allowlists.
Where This Matters in Practice
For most people on most networks, none of this comes up: home broadband, mobile carriers, and ordinary public Wi‑Fi carry standard VPN traffic without complaint, and obfuscation is simply insurance you are not using. It becomes relevant on managed corporate networks, on some hotel and transport Wi‑Fi, in a few university networks, and in countries that operate national filtering systems.
If you are in one of those situations, the useful test is empirical rather than theoretical. Connect, see whether the tunnel establishes and stays up, and try a second location if the first fails — one server’s address may already be known to the operator while another is not.
A Note on Legality
VPNs are legal to use in most of the world, including throughout the European Union, the United Kingdom, and North America. A small number of countries restrict or license them, and a few treat unauthorised use as an offence. These rules change, and they are not always enforced in the way the text suggests.
We are not in a position to give you legal advice about where you live, and you should not take a marketing page as a substitute for it. What we can commit to is not pretending the question does not exist: check your local rules, and understand that a technical tool working is a separate question from that tool being permitted.
What VPN Dan Does
Every VPN Dan connection uses AmneziaWG with obfuscation parameters applied, on all plans including the free one. There is no separate “stealth mode” to enable and no premium tier that unlocks it — configuring obfuscation by hand is exactly the kind of work the app exists to remove, so it is simply how the tunnel is built.
We would rather describe this as what it is: a well-implemented obfuscated protocol that handles ordinary blocking well and improves your odds against sophisticated systems, without a guarantee we cannot keep. If it does not work on the network you are on, tell us which network and where — that information is how we tune the parameters.