Trojan-Go vs. VLESS: Set Up Trojan-Go on VPS with HTTPS Masking

To set up Trojan-Go on a VPS, masking traffic as standard HTTPS to a website and providing a reliable connection even when methods like VLESS Reality draw unwanted attention, you'll need a VPS with at least 2 vCPU, 4 GB RAM, and an NVMe disk.

Why Trojan-Go Remains Relevant for VPS in 2026

In an environment of continuously tightening internet traffic control, where even advanced circumvention protocols face new detection methods like DPI (Deep Packet Inspection), the Trojan-Go protocol demonstrates remarkable resilience. Its key advantage is the ability to fully mimic regular HTTPS traffic, making it virtually indistinguishable from browsing any legitimate website. Unlike some other solutions that might expose themselves under detailed analysis, Trojan-Go is designed to appear as "normal" as possible.

By 2026, as blocking methods become more sophisticated and the signatures of popular circumvention protocols are well-known to DPI systems, the need for tools capable of effectively bypassing DPI without a VPN only increases. Trojan-Go offers a unique combination of ease of use and a high degree of obfuscation. This makes it an attractive choice for users who require a stable and inconspicuous connection. It's particularly relevant for those who have experienced issues with VLESS Reality or Shadowsocks-2022, as Trojan-Go provides a different approach to traffic concealment.

The Evolution of Circumvention Protocols and Trojan-Go's Role

The history of internet censorship circumvention is cyclical: new protocols emerge, they are detected, and new obfuscation methods are developed. Trojan-Go emerged as a response to the need for a protocol that not only encrypts traffic but also makes it indistinguishable from regular web browsing. Its approach to masking as HTTPS, using a valid TLS certificate and a fallback mechanism to a real cover website, significantly increases the chances of successful circumvention even against the strictest systems. This is particularly crucial for long-term use and maintaining stable access to information.

How Trojan-Go Works: HTTPS Obfuscation and Circumvention Principles

The essence of Trojan-Go's operation lies in its ability to fully mimic standard HTTPS traffic. When a client connects to a Trojan-Go server, it effectively establishes a regular TLS connection. However, unlike standard HTTPS, after a successful TLS session establishment, the client and server begin exchanging data using the Trojan protocol, which is encapsulated within this TLS tunnel. This means that to an external observer, such as a DPI system, the traffic appears to be a normal, secure connection to a website.

A key element ensuring this obfuscation is the use of a valid domain name and a corresponding TLS certificate (e.g., from Let's Encrypt). Without these components, the masquerade will be incomplete or ineffective. The Trojan-Go server " listens" on the standard HTTPS port (443) and, depending on the password provided, either establishes a proxy connection or redirects the request to a real web server (e.g., Nginx) that hosts a regular cover website. This creates an additional layer of plausibility.

Distinctions from Regular HTTPS Traffic

At first glance, Trojan-Go traffic and regular HTTPS are indistinguishable. Both use TCP port 443, both establish a TLS connection, and both exchange encrypted data. However, subtle differences exist at the protocol level within the TLS tunnel. DPI systems might attempt to analyze traffic patterns or specific headers, but Trojan-Go is designed with these risks in mind. It does not use any unique headers or patterns that could expose it as a proxy protocol. Instead, it expects a specific sequence of bytes (a password) immediately after the TLS connection is established. If the password is correct, the connection proceeds as a proxy session. If not, the request is handled as a regular web request.

The Fallback Mechanism to a Real Website

The fallback mechanism is a critically important part of Trojan-Go's obfuscation strategy. If a client attempts to connect to the Trojan-Go server but uses an incorrect password (or if it's a regular web browser trying to access the site), the server doesn't simply drop the connection. Instead, it redirects this request to a local web server (e.g., Nginx) that hosts a real website. This could be a simple static site, a blog, or even a placeholder. Thus, for anyone attempting to access the server's IP address or domain without using a Trojan-Go client, it will appear as a normal, functioning website. This significantly reduces suspicion and makes the server less noticeable to detection systems.

This approach ensures a high degree of plausibility, as the server always responds to requests, whether it's a proxy connection or a regular HTTP request. This allows the server to remain "under the radar" without attracting attention through anomalous behavior.

Preparing Your VPS for Trojan-Go: Domain, Certificate, and System Requirements

For successful Trojan-Go setup on a VPS, several preparatory steps are required. These include registering a domain name, obtaining a TLS certificate, and selecting an appropriate VPS configuration.

Choosing and Registering a Domain

Having your own domain name is a mandatory prerequisite for Trojan-Go to operate with HTTPS obfuscation. The domain must be real, not just an IP address. When choosing a domain, it's recommended to avoid overtly "suspicious" names or those frequently associated with VPN services. It's best to use a domain that appears to be a regular website, such as a personal blog, portfolio, or business card site.

After registering the domain, you need to configure an A-record in your DNS to point to your VPS's IP address. Ensure that the DNS records have propagated and the domain correctly resolves to your server's IP.

Obtaining a Let's Encrypt TLS Certificate

To create plausible HTTPS obfuscation, a valid TLS certificate is essential. The simplest and free way to obtain such a certificate is to use Let's Encrypt. This is an automated certificate authority that provides free SSL/TLS certificates. The Certbot utility is typically used to obtain it.

sudo apt update
sudo apt install certbot python3-certbot-nginx -y
sudo certbot certonly --nginx -d ваш_домен.com -d www.ваш_домен.com

This command automatically requests and installs a certificate for the specified domain, using Nginx for domain verification. If Nginx is not yet installed, Certbot will offer to install it or use another verification method, such as a DNS challenge.

Optimal VPS Specifications for Trojan-Go

The choice of VPS for Trojan-Go depends on the anticipated load and number of users. The Trojan-Go protocol is relatively lightweight, but the presence of Nginx and a potentially large number of concurrent connections requires a certain reserve of resources.

For 10-20 concurrent users, 2 vCPU, 4 GB RAM, and a 40 GB NVMe disk are sufficient.

Users	vCPU	RAM	Disk	Port	Price (approximate, Valebyte.com, 2026)
1-10	1	2 GB	20 GB NVMe	1 Gbps	from $5/month
10-20	2	4 GB	40 GB NVMe	1 Gbps	from $10/month
20-50	4	8 GB	80 GB NVMe	1 Gbps	from $20/month
50+	6+	16+ GB	160+ GB NVMe	1 Gbps	from $40/month

For Valebyte.com, we recommend choosing plans with NVMe disks, as they provide significantly higher read/write speeds, which positively impacts overall system performance and responsiveness. A 1 Gbps network port is standard for most VPS and will be sufficient for most Trojan-Go use cases.

Step-by-Step Guide: How to Set Up Trojan-Go on a VPS

After preparing your domain and certificate, you can proceed with setting up VLESS via Cloudflare CDN. Installing Trojan-Go requires several steps, including downloading the binary, creating a configuration file, and integrating with Nginx.

Installing Necessary Components

First, let's install basic utilities and Nginx, if it's not already installed.

sudo apt update
sudo apt upgrade -y
sudo apt install nginx curl wget -y

Next, let's download the latest version of Trojan-Go. Current versions can always be found on the project's GitHub page.

# Check for the latest version on GitHub
LATEST_VERSION=$(curl -s "https://api.github.com/repos/p4gefau1t/trojan-go/releases/latest" | grep -Po '"tag_name": "\K.*?(?=")')
echo "Latest Trojan-Go Version: $LATEST_VERSION"

# Download the archive for Linux AMD64
wget "https://github.com/p4gefau1t/trojan-go/releases/download/$LATEST_VERSION/trojan-go-linux-amd64.zip"

# Unpack
sudo unzip trojan-go-linux-amd64.zip -d /usr/local/etc/trojan-go/
sudo rm trojan-go-linux-amd64.zip

# Move the executable and set permissions
sudo mv /usr/local/etc/trojan-go/trojan-go /usr/local/bin/trojan-go
sudo chmod +x /usr/local/bin/trojan-go

Let's create directories for configuration and logs:

sudo mkdir -p /etc/trojan-go
sudo mkdir -p /var/log/trojan-go

Configuring Trojan-Go with Fallback to a Real Website

Let's create the Trojan-Go configuration file at `/etc/trojan-go/config.json`.

sudo nano /etc/trojan-go/config.json

Example `config.json` content:

{
  "run_type": "server",
  "local_addr": "0.0.0.0",
  "local_port": 443,
  "remote_addr": "127.0.0.1",
  "remote_port": 80,
  "password": [
    "ваш_очень_сложный_пароль"
  ],
  "ssl": {
    "cert": "/etc/letsencrypt/live/ваш_домен.com/fullchain.pem",
    "key": "/etc/letsencrypt/live/ваш_домен.com/privkey.pem",
    "sni": "ваш_домен.com",
    "fallback": {
      "alpn": [
        "http/1.1"
      ],
      "addr": "127.0.0.1",
      "port": 80
    }
  },
  "log_level": 4,
  "log_file": "/var/log/trojan-go/trojan-go.log"
}

Replace `ваш_домен.com` with your actual domain and `ваш_очень_сложный_пароль` with a strong password. `remote_addr` and `remote_port` point to Nginx, which will run on port 80 (or 443 if you configure Nginx to listen for HTTPS directly, but for fallback, HTTP is better). In the `fallback` section, specify where to redirect regular HTTP traffic.

Let's create a systemd service for Trojan-Go so it starts automatically and can be managed as a service.

sudo nano /etc/systemd/system/trojan-go.service

Content of `trojan-go.service`:

[Unit]
Description=Trojan-Go Service
Documentation=https://github.com/p4gefau1t/trojan-go/
After=network.target nss-lookup.target

[Service]
Type=simple
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/local/bin/trojan-go -config /etc/trojan-go/config.json
Restart=on-failure
RestartSec=10
LimitNOFILE=infinity

[Install]
WantedBy=multi-user.target

Save the file, then reload systemd and start Trojan-Go:

sudo systemctl daemon-reload
sudo systemctl enable trojan-go
sudo systemctl start trojan-go
sudo systemctl status trojan-go

Ensure the service is running without errors. Check the logs: `sudo cat /var/log/trojan-go/trojan-go.log`.

Configuring Nginx with Trojan-Go

Nginx will act as the web server for your cover site, accepting requests that Trojan-Go redirects to it via the fallback mechanism. Let's create or edit the Nginx configuration for your domain.

sudo nano /etc/nginx/sites-available/ваш_домен.com

Example Nginx configuration:

server {
    listen 80;
    listen [::]:80;
    server_name ваш_домен.com www.ваш_домен.com;

    root /var/www/ваш_домен.com; # Path to your cover website files
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    # If you want Nginx to handle HTTPS itself, then Trojan-Go must listen on another port,
    # and Nginx would proxy to it, but for obfuscation, Trojan-Go should listen on 443.
    # In this case, Nginx listens on port 80, and Trojan-Go redirects to it.
    # Certbot should have already configured HTTP to HTTPS redirect if you used it.
}

Create a symbolic link to this file in `sites-enabled`:

sudo ln -s /etc/nginx/sites-available/ваш_домен.com /etc/nginx/sites-enabled/

Ensure that the directory `/var/www/ваш_домен.com` exists for your domain and contains an `index.html` file (or another file specified in `index`).

Test the Nginx configuration and restart it:

sudo nginx -t
sudo systemctl restart nginx

Now, when you try to access `https://ваш_домен.com` through a browser, you will see your cover website. If you use a Trojan-Go client with the correct password, it will establish a proxy connection.

Trojan-Go vs VLESS Reality: Which Protocol to Choose?

In 2026, choosing a protocol for bypassing censorship often comes down to a compromise between ease of setup, degree of obfuscation, and resistance to detection. Reality vs Shadowsocks-2022 vs Hysteria2 is an ongoing discussion, and Trojan-Go and VLESS Reality are two strong contenders in this field.

Both protocols aim to mask traffic as regular web browsing, but they do so differently. VLESS Reality, for instance, uses SNI (Server Name Indication) and TLS Fingerprinting technology to mimic requests to existing, large websites like Google or Cloudflare, making the traffic indistinguishable from a regular request to these resources. This is a very effective method that does not require its own domain and certificate.

Advantages of Trojan-Go: Simplicity and Obfuscation

Trojan-Go has several notable advantages:

1. Ease of Setup: Compared to some other protocols, setting up Trojan-Go on a server is relatively straightforward. You need a domain, a certificate, and a few lines of JSON configuration. Client applications are also intuitive.
2. High Degree of Obfuscation: Trojan-Go traffic is indistinguishable from regular HTTPS. The use of a valid TLS certificate and a fallback mechanism to a real cover website makes it highly resistant to detection.
3. Independence from Third-Party SNI: Unlike Reality, Trojan-Go uses your own domain and certificate. This means you are not dependent on the availability and "cleanliness" of other large sites' SNI. If a major domain starts being actively blocked due to Reality usage, it will not affect Trojan-Go.
4. Stability: Thanks to its simplicity and reliance on standard HTTPS mechanisms, Trojan-Go typically demonstrates high connection stability.

Disadvantages of Trojan-Go: Domain Dependency

The main drawback of Trojan-Go is the requirement to have your own domain and a valid TLS certificate. This adds several steps to the initial setup and requires periodic certificate renewal (although Let's Encrypt automates this process). If your domain gets blocked, you'll need to register a new one and reconfigure the server. Furthermore, the act of domain registration can be traced, though for most users, this is not a critical concern.

Trojan-Go vs VLESS Reality Comparison

Let's compare Trojan-Go and VLESS Reality in a table to better understand when each protocol would be preferable.

Characteristic	Trojan-Go	VLESS Reality
Domain Requirement	Own domain is mandatory	Not required (uses SNI of third-party sites)
Certificate Requirement	Valid TLS certificate is mandatory (Let's Encrypt)	Not required
Traffic Obfuscation	As HTTPS to own website	As HTTPS to large, well-known sites (Google, Cloudflare)
Fallback Mechanism	To a real website on the VPS	Not applicable (traffic is always directed to a real site)
Setup Complexity	Medium (domain, certificate, Nginx)	Medium (more complex key generation and SNI selection)
DPI Resistance	High (HTTPS imitation)	Very High (imitation of traffic to large CDNs)
Dependency	On the availability of your own domain	On the "cleanliness" and availability of the chosen SNI
Recommendation	When full control over obfuscation is needed, and a domain is available; when Reality is already "compromised"	When you don't want to buy a domain; when maximum inconspicuousness is needed, mimicking traffic to large CDNs

Thus, Trojan-Go is better suited when you have your own domain and desire full control over obfuscation, or when VLESS Reality might already be compromised or its use raises suspicion. VLESS Reality, in turn, is an excellent choice for those seeking maximum inconspicuousness without the need for domain ownership.

Trojan-Go Client Applications: Windows, macOS, Linux, Android, iOS

After successfully setting up Trojan-Go on your VPS, the next step is to install and configure client applications on various platforms. Fortunately, there are many supported clients for Trojan-Go.

Installation and Configuration on Popular Platforms

Windows:

For Windows, the most popular clients are V2RayN or Qv2ray (though Qv2ray is no longer actively maintained, it is still functional). You can also use the official Trojan-Go client. Download the executable from GitHub, unpack it, and create a `config.json` configuration file.

{
  "run_type": "client",
  "local_addr": "127.0.0.1",
  "local_port": 1080,
  "remote_addr": "ваш_домен.com",
  "remote_port": 443,
  "password": [
    "ваш_очень_сложный_пароль"
  ],
  "ssl": {
    "sni": "ваш_домен.com",
    "verify_cert": true
  }
}

Run `trojan-go.exe` with this config. Then, configure your browser or system to use a SOCKS5 proxy at `127.0.0.1:1080`.

macOS:

On macOS, you can use Qv2ray, ClashX, or v2rayA. Many of these clients provide a graphical interface for configuration management. For Qv2ray or v2rayA, you can import a configuration similar to the server's, specifying the Trojan-Go protocol type, server address, port, password, and SNI.

Linux:

On Linux, you can use the official Trojan-Go binary, similar to Windows, by running it from the command line. GUI clients like Qv2ray or v2rayA are also available, simplifying management. After starting the client, configure your system's proxy settings or browser proxy to `SOCKS5 127.0.0.1:1080`.

Android:

For Android, several applications support Trojan-Go: V2RayNG, Clash for Android, ShadowSocks (with a plugin). V2RayNG is one of the most popular. Add a new configuration, select "Trojan" type, enter the server address (your domain), port 443, password, and SNI (your domain). Ensure that the "Allow insecure" (or "Disable certificate verification") option is disabled if you are using a valid certificate.

iOS:

On iOS, you can use applications such as Shadowrocket, Quantumult X, Surge, or Stash. All of them support the Trojan protocol. The setup process is similar to Android: add a new configuration, select Trojan, specify the domain, port, password, and SNI. Ensure that certificate verification is enabled for security.

Always download client applications from official sources (App Store, Google Play, official GitHub repositories) to ensure security.

Trojan-Go Security and Performance: What to Consider

While Trojan-Go offers excellent obfuscation and performance, there are several aspects to consider for maximum security and efficiency.

Security Hardening Recommendations

1. Strong Password: Use the most complex and lengthy password possible for Trojan-Go. This is the first line of defense against unauthorized access.
2. Regular Certificate Renewal: Although Let's Encrypt automates renewal, ensure your Certbot is configured for automatic certificate updates to avoid downtime.
3. Firewall (UFW/Firewalld): Configure a firewall on your VPS to allow incoming connections only on port 443 (for Trojan-Go/HTTPS) and port 22 (for SSH). Close all other ports.

sudo ufw allow 22/tcp
sudo ufw allow 443/tcp
sudo ufw enable

4. IP Address Concealment: If possible, use a CDN like Cloudflare (in "Full (strict)" mode) to hide the real IP address of your VPS. This can also help in case of DDoS attacks. However, it's worth noting that Cloudflare itself might be blocked in some regions, and its use with Trojan-Go may require additional configuration, as Trojan-Go does not directly support WebSocket like VLESS.
5. Log Monitoring: Regularly check Trojan-Go and Nginx logs for suspicious activity.

Performance Optimization

1. Choose a VPS with NVMe: As mentioned, using a VPS with NVMe disks significantly boosts overall performance. Valebyte.com offers plans with fast NVMe disks.
2. Proximity to Users: Host your VPS in a data center geographically close to your users to minimize latency (ping).
3. Limit User Count: If you're sharing your Trojan-Go server with others, it's wise to limit the number of concurrent connections or use separate passwords for each user for better control and load distribution.
4. Fine-tune TCP: For high-load servers, consider fine-tuning TCP, for example, by modifying BBR (Bottleneck Bandwidth and RTT) parameters to optimize throughput.

sudo nano /etc/sysctl.conf

Add the following lines:

net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr

Apply the changes:

sudo sysctl -p

Frequently Asked Questions

Here we've gathered answers to the most common questions about Trojan-Go and its usage.

Can Trojan-Go be used without a domain?

No, using Trojan-Go without your own domain and a valid TLS certificate is not recommended, as it significantly reduces its obfuscation effectiveness. Without a domain, traffic will go via an IP address, which is easily detected by DPI systems. The purpose of Trojan-Go is to mimic regular HTTPS traffic to a website, and for this, a domain and certificate are necessary to confirm the resource's authenticity.

How often do Let's Encrypt certificates need to be renewed?

Let's Encrypt certificates are issued for 90 days. However, if you have configured Certbot with the automatic renewal option (which is standard behavior), it will attempt to renew the certificate every 60-70 days. It is recommended to check the status of automatic renewal with the command `sudo certbot renew --dry-run` at least once a month to ensure it is working correctly.

What is the difference between Trojan-Go and regular Trojan?

Trojan-Go is a fork of the original Trojan protocol and offers a number of improvements and additional features. Key differences include support for WebSocket, gRPC, as well as more flexible options for fallback and traffic routing. This makes Trojan-Go more versatile and resilient to various network conditions and blocking methods, while retaining the basic principle of HTTPS obfuscation.

What ports does Trojan-Go use?

By default, Trojan-Go uses the standard port 443 for incoming connections, as this is the port for HTTPS traffic, which is critical for obfuscation. However, if you already have a web server that needs to listen on port 443, you can configure Trojan-Go to use another port and use Nginx for proxying or reverse proxying, but this might complicate obfuscation. In our configuration, Nginx listens on port 80, and Trojan-Go listens on 443, redirecting to Nginx if an incorrect password is provided.

Conclusion

Trojan-Go remains a reliable and effective solution for bypassing censorship in 2026, offering deep obfuscation as regular HTTPS traffic using your own domain and a valid TLS certificate. If you are looking for a protocol that provides a high level of stealth and does not depend on third-party SNI, and you are prepared to configure your own domain and Nginx, Trojan-Go will be an excellent choice for your VPS. For optimal performance and stability, we recommend using a VPS from Valebyte.com with NVMe disks.