Hysteria2 with Port Hopping: Bypass UDP Shaping on Your VPS

How to Bypass UDP Shaping with Hysteria2 Port Hopping and Salamander Obfuscation on Your VPS

To effectively bypass UDP shaping on your Hysteria2 server and prevent speed drops after a few minutes, configure port hopping with a port range like 10000-20000 and activate Hysteria2 Salamander obfuscation. This dynamically changes connection ports, making traffic less noticeable to Deep Packet Inspection (DPI) systems that often throttle or slow down UDP traffic on a single port.

What is Hysteria2 Port Hopping and Why Do You Need It?

Hysteria2 is a high-performance, censorship-resistant protocol based on QUIC (UDP) that has gained popularity due to its speed and ability to bypass blocks. However, despite its advantages, many users encounter a problem where, after a few minutes of using Hysteria2, the connection speed sharply drops, and ping increases. This is a clear sign that the provider is likely applying traffic shaping or actively throttling UDP traffic on a specific port. It is in such scenarios that `hysteria2 port hopping` becomes an indispensable tool. Port hopping is a mechanism where the Hysteria2 server and client dynamically change UDP ports for each new connection or session, selecting them from a predefined range. Instead of consistently using the same port (e.g., standard 443 or 8443), the connection might use ports 10001, then 10002, then 10005, and so on. To the provider, this appears as multiple short-lived UDP sessions on different ports, which significantly complicates their identification and blocking based on patterns. If a provider attempts to shape traffic on a specific port, switching to another port within the range allows bypassing this restriction. The issue of `hysteria2 udp throttling` arises when DPI systems detect long-duration UDP connections on specific ports, characteristic of VPN traffic, and begin to forcibly limit them. Standard obfuscation methods, such as TLS masquerading, can be effective for hiding traffic content but not for altering its network characteristics. Port hopping, however, changes these very characteristics, making the connection more "noisy" and less predictable for DPI systems.

How UDP Traffic Shaping Works and Why Hysteria2 Can Be Slow

Traffic shaping is the process of regulating data transfer speeds for specific types of traffic or users. Providers use it to manage network load, prevent abuse, and, unfortunately, to restrict access to certain services, including VPNs. UDP traffic, on which Hysteria2 is based, often becomes a target for shaping for several reasons: 1. **Connectionless Nature:** Unlike TCP, UDP does not have a connection establishment and termination phase, making it more challenging for DPI to control and analyze. This, in turn, provokes providers to use more aggressive methods, including blocking or slowing down all UDP traffic on certain ports if it appears suspicious. 2. **High Throughput:** UDP is frequently used for streaming, online gaming, and other applications requiring low latency. Hysteria2, utilizing QUIC, aims for maximum speed, which DPI systems might perceive as a potential threat or undesirable traffic. 3. **Use of Non-Standard Ports:** While Hysteria2 can operate on port 443 (commonly associated with HTTPS/TLS and less frequently shaped), using other, less common ports (e.g., 8443, 50000+) can attract DPI attention, especially if a high volume of UDP traffic is observed on these ports. 4. **Long-Lived Sessions:** If Hysteria2 continuously uses the same port for a long session, it creates a clear pattern for DPI. Systems may start to slow down or block that port after a certain volume of data transfer or elapsed time. This is why `hysteria2 slow` becomes a problem after a few minutes. When `hysteria2 udp throttling` occurs, it manifests not only as a speed drop but also as increased latency (ping), packet loss, and connection instability. Port hopping, combined with obfuscation like `hysteria2 salamander`, makes traffic less recognizable and more dynamic, significantly complicating its identification and subsequent shaping by the provider. To understand the differences between protocols and choose the most suitable one for your needs, check out our comparison: Reality vs Shadowsocks-2022 vs Hysteria2: Which Protocol to Choose in 2026.

Server Preparation: Choosing a VPS for Hysteria2 and Kernel Tuning

Before proceeding with `hysteria2 port hopping` setup, you need to ensure that your VPS meets the requirements for stable and fast operation.

Choosing the Best VPS for Hysteria2

For Hysteria2, the following are critical: * **High-Speed Network Channel:** A minimum of 1 Gbps, and preferably 10 Gbps, especially if you plan to serve multiple users or transfer large volumes of data. * **Server Location:** The closer the server is to your location, the lower the latency (ping) will be, which is crucial for Hysteria2. Choose a server in a region geographically close to you or your users, but outside jurisdictions that actively enforce censorship. * **Traffic Limits:** Ensure your VPS plan includes sufficient traffic volume. Hysteria2 can consume significant amounts of data, especially with active use. Some providers offer unlimited traffic, which is an ideal option. * **CPU and RAM:** For one or two users, 1 vCPU and 1 GB RAM are sufficient. For 10-20 active users, 2-4 vCPU and 2-4 GB RAM will be required. Hysteria2 is not overly resource-intensive, but obfuscation and handling multiple UDP connections can increase the load. * **NVMe Disk:** Although Hysteria2 does not actively use the disk subsystem, a fast NVMe disk is always preferable for overall system performance. For 50 concurrent Hysteria2 users, 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are sufficient.

Users	vCPU	RAM	Disk	Port Speed	Price (approx. Valebyte, 2024)
1-5	1	1 GB	20 GB NVMe	1 Gbps	от $5/мес
5-20	2	2-4 GB	40 GB NVMe	1 Gbps	от $10/мес
20-50	4	4-8 GB	80 GB NVMe	1 Gbps	от $20/мес
50-100+	6-8	8-16 GB	160+ GB NVMe	10 Gbps	от $40/мес

Linux Kernel Tuning for Hysteria2

For optimal Hysteria2 performance, especially with a large number of concurrent connections and port hopping, it is recommended to increase file descriptor limits and UDP buffers. 1. **Increase File Descriptor Limits:** Open the `/etc/sysctl.conf` file and add the following lines:

    fs.file-max = 1000000
    net.ipv4.tcp_max_syn_backlog = 65536
    net.ipv4.tcp_fin_timeout = 10
    net.ipv4.tcp_tw_reuse = 1
    net.ipv4.ip_local_port_range = 1024 65535
    

Then apply the changes:

sudo sysctl -p

2. **Increase UDP Buffers:** Also in `/etc/sysctl.conf`, add:

    net.core.rmem_max = 2500000
    net.core.wmem_max = 2500000
    net.core.rmem_default = 2500000
    net.core.wmem_default = 2500000
    net.core.netdev_max_backlog = 65536
    

Apply the changes:

sudo sysctl -p

These settings will help Hysteria2 process UDP traffic and numerous connections more efficiently, which is particularly important for `hysteria2 port hopping`. If you haven't set up Hysteria2 on your server yet, we recommend checking out our step-by-step guide for basic installation: Hysteria2 on VPS: Installation and Configuration for DPI Bypass in 2026.

Step-by-Step Hysteria2 Server Setup with Port Hopping

Configuring `hysteria2 port hopping` requires modifying the Hysteria2 server configuration and firewall rules.

Configuring Port Range in Hysteria2

It is assumed that Hysteria2 is already installed. If not, refer to the official documentation or our basic installation article. Open the Hysteria2 configuration file on the server, typically `/etc/hysteria/config.json` or `/etc/hysteria2/config.json`. To enable port hopping, you need to specify a port range in the `listen` parameter. Instead of a single port, use the format `IP:start_port-end_port`. Example server configuration with port hopping and `hysteria2 salamander` obfuscation:

{
  "listen": ":10000-20000",
  "acme": {
    "domains": [
      "your.domain.com"
    ],
    "email": "[email protected]"
  },
  "tls": {
    "cert": "/etc/hysteria/cert.pem",
    "key": "/etc/hysteria/key.pem",
    "acme": true
  },
  "auth": {
    "type": "password",
    "password": "your_strong_password"
  },
  "bandwidth": {
    "up": "100 Mbps",
    "down": "1 Gbps"
  },
  "obfs": "salamander",
  "obfsConf": "your_obfs_password",
  "quic": {
    "initStreamReceiveWindow": 8388608,
    "maxStreamReceiveWindow": 16777216,
    "initConnReceiveWindow": 16777216,
    "maxConnReceiveWindow": 33554432,
    "disablePathMTUDiscovery": false
  },
  "resolver": "https://1.1.1.1/dns-query"
}

In this example: * `"listen": ":10000-20000"`: Instructs Hysteria2 to listen on all available IP addresses on ports in the range from 10000 to 20000. * `"obfs": "salamander"`: Activates Salamander obfuscation. * `"obfsConf": "your_obfs_password"`: Sets the password for Salamander obfuscation. This password must match on the client. * `"acme"`: Configuration for automatic TLS certificate acquisition via Let's Encrypt. This is preferable to manual certificates. Ensure your domain is correctly configured and points to your VPS's IP. After making changes, restart the Hysteria2 service:

sudo systemctl restart hysteria2

iptables/nftables Rules for Port Range Redirection

For Hysteria2 to use the specified port range, these ports must be opened in the server's firewall. **For iptables:** If you are using `iptables`, execute the following commands. Replace `10000:20000` with your port range.

sudo iptables -A INPUT -p udp --dport 10000:20000 -j ACCEPT
sudo iptables -A OUTPUT -p udp --sport 10000:20000 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT # For ACME HTTP-01 challenge
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT # For ACME TLS-ALPN challenge
sudo netfilter-persistent save

Remember to save the rules so they persist after a reboot. For systems with `ufw`, this is done with the command `sudo ufw allow 10000:20000/udp`. **For nftables:** If you are using `nftables`, create or edit the rules file, for example, `/etc/nftables.conf`.

table ip filter {
    chain input {
        type filter hook input priority 0; policy drop;
        # allow established connections
        ct state {established, related} accept

        # allow SSH
        tcp dport 22 accept

        # allow Hysteria2 UDP port range
        udp dport 10000-20000 accept

        # allow ACME for TLS certs
        tcp dport { 80, 443 } accept

        # drop invalid packets
        ct state invalid drop
    }
}

Then apply the rules:

sudo systemctl enable nftables
sudo systemctl start nftables
sudo nft -f /etc/nftables.conf

Ensure your firewall is not blocking traffic, otherwise `hysteria2 slow` will be due to incorrect server configuration, not the provider.

Synchronizing Client Configuration and Enabling Obfuscation

For `hysteria2 port hopping` to work correctly, the Hysteria2 client application must also be configured to use the port range and the same `hysteria2 salamander` obfuscation as the server.

Configuring Hysteria2 Client for Port Hopping

On most Hysteria2 client applications (e.g., iOS, Android, Windows, macOS), port hopping is configured by specifying the port range in the "Port" or "Server Port" field. Example client configuration (for CLI client or text file):

{
  "server": "your.domain.com:10000-20000",
  "auth": {
    "type": "password",
    "password": "your_strong_password"
  },
  "tls": {
    "sni": "your.domain.com",
    "insecure": false,
    "pinSHA256": []
  },
  "obfs": "salamander",
  "obfsConf": "your_obfs_password",
  "bandwidth": {
    "up": "100 Mbps",
    "down": "1 Gbps"
  },
  "quic": {
    "initStreamReceiveWindow": 8388608,
    "maxStreamReceiveWindow": 16777216,
    "initConnReceiveWindow": 16777216,
    "maxConnReceiveWindow": 33554432,
    "disablePathMTUDiscovery": false
  },
  "resolver": "https://1.1.1.1/dns-query"
}

Key parameters: * `"server": "your.domain.com:10000-20000"`: Informs the client that the server is listening on this domain and will use ports from the 10000-20000 range. The client will randomly select a port from this range for each new connection. * `"obfs": "salamander"` and `"obfsConf": "your_obfs_password"`: These parameters must exactly match the server's for a successful connection.

Hysteria2 Salamander: Obfuscation Setup

`hysteria2 salamander` obfuscation is a built-in Hysteria2 mechanism that helps hide protocol signatures, making its traffic less distinguishable from regular web traffic (e.g., HTTPS). In combination with port hopping, `hysteria2 obfuscation setup` with Salamander significantly enhances resistance to DPI. To activate Salamander, simply add the following lines to both server and client configurations: * Server:

    "obfs": "salamander",
    "obfsConf": "your_obfs_password"
    

* Client:

    "obfs": "salamander",
    "obfsConf": "your_obfs_password"
    

It is important to use a sufficiently complex and unique `obfsConf` password. Do not use the same password as for `auth`. After configuring the client, launch it and check the connection. If `hysteria2 slow` persists, proceed to diagnostics.

Troubleshooting: Distinguishing Shaping from Packet Loss in Hysteria2

When `hysteria2 udp throttling` or `hysteria2 slow` occurs, it's important to correctly diagnose the cause. This could be ISP shaping, packet loss along the route, or issues with the VPS itself.

How to Distinguish Traffic Shaping from Packet Loss

1. **Observe Speed Behavior:** * **Shaping:** Speed is usually high for the first few minutes, then sharply or gradually drops to very low values. Ping may remain stable or increase slightly. This is characteristic when the provider detects and limits long-lived connections on specific ports. * **Packet Loss:** Speed may be unstable from the start, with frequent drops. Ping will be very high and unstable, with possible disconnections. This could be caused by network congestion, a poor connection between you and the VPS, or issues on the VPS itself. 2. **Use Diagnostic Utilities:** * **Ping and MTR (My Traceroute):** * `ping your.domain.com`: Check average ping and stability. High and unstable ping indicates routing issues or packet loss. * `mtr -T -P 443 your.domain.com` (for TCP) or `mtr -U -P 10000 your.domain.com` (for UDP): MTR will show each hop on the path to the server and the percentage of packet loss at each. If packet loss significantly increases at any node, it indicates a routing problem. * **iperf3:** This is the best tool for measuring actual throughput. * On the server (after installing `sudo apt install iperf3`):

iperf3 -s -p 5201

* On the client:

iperf3 -c your.domain.com -p 5201 -u -b 100M -t 30

(where `-u` is for UDP, `-b` for bandwidth, `-t` for duration). Run the test *first without Hysteria2*, then *through Hysteria2*. Compare the results. If the speed without Hysteria2 is stable, but drops after a few minutes with Hysteria2, it's almost certainly shaping. 3. **Monitor Server Resources:** Use `htop`, `nmon`, or `glances` on the VPS to ensure the problem is not related to CPU, RAM, or network interface overload on your server. If CPU usage reaches 100% or RAM runs out, this could be the cause of the slowdown.

Recommendations for Troubleshooting:

* **Check Firewall:** Ensure all necessary ports (the range for Hysteria2, 80 and 443 for ACME) are open. * **Change Port Range:** If the provider actively blocks certain ranges, try changing `10000-20000` to another, for example, `30000-40000`. * **Use a Different Domain:** In rare cases, providers may block domains associated with VPNs. * **Update Hysteria2:** Ensure you have the latest version of Hysteria2 installed on both the server and client. Developers constantly release updates with censorship bypass improvements. * **Try Another Protocol:** If `hysteria2 udp throttling` persists despite all efforts, it's possible that in your region, the provider is too aggressively blocking UDP. In this case, consider alternatives such as TUIC v5 or Reality. Our blog has a comparison TUIC v5 on VPS in 2026: Setup, Tuning, and Comparison with Hysteria2, which can help you choose. * **Check VPS Location:** Sometimes the problem is not shaping, but a poor route to a specific location. Try a VPS in a different city or country. * **Check TTL:** Ensure your VPS is correctly configured and does not have issues with packet Time-To-Live (TTL), which can affect routing. * **Check DNS Resolver:** Ensure the DNS resolver on the server and client is stable. Using public DNS servers (e.g., 1.1.1.1 or 8.8.8.8) in the Hysteria2 configuration can help.

VPS Requirements for Optimal Hysteria2 Performance

For `hysteria2 port hopping` and `hysteria2 salamander` obfuscation to work most effectively, your VPS must have certain characteristics. * **Powerful Network Channel:** As mentioned, 1 Gbps is the minimum, but 10 Gbps will significantly improve performance, especially when transferring large files or streaming 4K video. At Valebyte.com, we offer VPS with high-speed ports, which is critical for Hysteria2. * **Sufficient Traffic Limits:** Choose plans with generous traffic limits or, ideally, with unlimited traffic. Hysteria2 consumes as much traffic as you use on the internet, plus a small protocol overhead. If `hysteria2 slow` is due to exhausting the limit, it's not shaping, but a provider restriction. * **Close Location:** The physical distance to the server directly affects latency. Choose a server in a region that minimizes ping to you. For example, if you are in Eastern Europe, a server in Germany or Finland would be preferable to a server in the USA. Low ping (less than 50 ms) is key to comfortable Hysteria2 usage. * **Dedicated IP Address:** All VPS from Valebyte.com come with a dedicated IP address, eliminating issues related to blocking shared IP addresses. * **Modern Hardware:** High-clock-speed processors and NVMe disks ensure overall system performance; although Hysteria2 is not a disk-intensive application, it benefits from a fast CPU for encryption and obfuscation processing. Choosing a reliable hosting provider like Valebyte.com, with quality VPS servers and a wide selection of locations, is a key factor for successfully deploying Hysteria2 with `hysteria2 port hopping`.

Frequently Asked Questions

Why does Hysteria2 slow down after a few minutes, even if the speed is excellent initially?

This is a classic symptom of UDP traffic shaping by your Internet Service Provider (ISP). ISPs often use DPI to detect and limit long-lived UDP connections on specific ports, which are characteristic of VPN traffic. For the first 1-5 minutes, the connection might run at full speed until the DPI system identifies it and begins to apply restrictions.

Will port hopping help if my ISP blocks all UDP traffic?

If your ISP completely blocks all UDP traffic, port hopping will not help, as it relies on establishing an initial UDP connection. However, such complete blocks of all UDP traffic are rare. More often, UDP traffic is blocked or shaped on specific ports or based on certain patterns, which port hopping and Salamander obfuscation (with a unique password) effectively bypass by changing ports and masking the traffic.

Can I use port hopping with other protocols like Shadowsocks or Reality?

Port hopping is a specific feature implemented in Hysteria2 due to its QUIC (UDP) foundation. Other protocols, such as Shadowsocks or Reality (based on TCP), have their own mechanisms for bypassing blocks. Shadowsocks-2022, for instance, focuses on strong traffic obfuscation, while Reality masks traffic as legitimate TLS traffic from well-known websites. These protocols do not support port hopping in the same way Hysteria2 does, as their operating principles differ. You can read more about Shadowsocks in our article: Shadowsocks-2022 on VPS: Setup and Bypass Blocks in 2026.

What port range is best to choose for port hopping?

It is recommended to use a range of several thousand ports, for example, from 10000 to 20000 or from 30000 to 40000. Avoid well-known system ports (0-1023) and ports commonly used by other services (e.g., 22, 80, 443, 8080, 8443), unless you are specifically trying to masquerade as them. A larger range provides more variability and complicates DPI analysis, while Salamander obfuscation (with a password) further conceals the protocol.

Conclusion

Hysteria2 with `hysteria2 port hopping` and `hysteria2 salamander` obfuscation is a powerful solution for bypassing UDP shaping and maintaining high connection speeds. Configuring the port range on the server and client, as well as activating robust obfuscation, are critically important for counteracting DPI systems. Choosing a high-performance VPS with sufficient network bandwidth and a close location, as offered by Valebyte.com, will provide an optimal foundation for stable and fast Hysteria2 operation.