TUIC v5 vs Hysteria2: Setup & Tuning on VPS

To set up TUIC v5 on a VPS in 2026, begin by installing the server on Debian 12 or Ubuntu 22.04; for 50+ concurrent users, a VPS with 2 vCPU and 2 GB RAM is recommended to ensure stable protocol operation at speeds up to 1 Gbit/s.

The TUIC (TCP and UDP Internet Connection) v5 protocol, built on QUIC, is rapidly gaining traction as an effective solution for bypassing censorship and ensuring high-speed connections in unstable network conditions. Its ability to leverage UDP traffic and advanced congestion control algorithms makes it a strong contender against traditional VPN and proxy protocols. In this article, we'll delve into how to set up TUIC v5 on your VPS, optimize its performance, and compare it with Hysteria2.

What is TUIC v5 and why is QUIC/UDP faster than TCP with packet loss?

TUIC v5 is a modern proxy protocol that utilizes QUIC (Quick UDP Internet Connections) as its transport layer. Developed by Google, QUIC aims to address many issues inherent in TCP, especially in scenarios with high latency and packet loss. Unlike TCP, which suffers from "head-of-line blocking" (where the loss of a single packet blocks the processing of all subsequent packets in a stream), QUIC allows multiplexing multiple independent data streams over a single UDP connection. This means that a packet loss in one stream does not affect others, significantly boosting performance under lossy conditions.

How TUIC differs from other proxy protocols

A key distinction of TUIC is its ability to mimic regular HTTPS traffic by using TLS 1.3 over QUIC. This makes it less detectable by Deep Packet Inspection (DPI) systems compared to some other protocols. Furthermore, TUIC supports various congestion control algorithms, allowing administrators to fine-tune proxy behavior based on network conditions. This is particularly crucial for bypassing censorship in regions with aggressive DPI, where traditional VPNs are often ineffective.

Benefits of QUIC for bypassing censorship

QUIC, which underpins TUIC, was originally designed to minimize latency and enhance resilience to packet loss. This is achieved through several mechanisms:

• Faster Connection Establishment: QUIC can often establish a connection with 0-RTT (Zero Round-Trip Time) after the initial handshake, significantly reducing the time to begin data transfer.
• IP Address Change Resilience: QUIC connections can persist even when a client's IP address changes, making it ideal for mobile users switching between Wi-Fi and cellular networks.
• Effective QUIC Censorship Circumvention: Utilizing UDP port 443 (standard for HTTPS) and encrypting all traffic, including headers, makes it difficult for DPI systems to identify and block QUIC traffic, as they often rely on TCP connection signatures.

How to set up a TUIC v5 server on a VPS

To deploy a TUIC v5 server on a VPS, you'll need a server running Debian 11/12 or Ubuntu 20.04/22.04. A recent OS version is recommended for maximum compatibility and security. Valebyte.com offers reliable VPS servers optimized for such tasks, featuring NVMe drives and ports up to 1 Gbit/s, which is critical for high-speed proxies.

Preparing your VPS and installing dependencies

Before installing TUIC, ensure your server is updated and necessary utilities are installed. Log in to your VPS via SSH and execute the following commands:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget git certbot # certbot для выпуска TLS-сертификатов

Open the required ports in your firewall. TUIC defaults to UDP port 443, but you can choose any other. For example, let's open 443/UDP and 80/TCP (for certbot):

sudo ufw allow 443/udp
sudo ufw allow 80/tcp
sudo ufw enable

Generating TLS certificates for TUIC

TUIC requires a TLS certificate for traffic encryption. It's recommended to use a certificate issued by Let's Encrypt, as it's free and widely trusted. You'll need a domain name pointing to your VPS's IP address.

sudo certbot certonly --standalone -d your_domain.com --email [email protected] --agree-tos --non-interactive

Replace your_domain.com and [email protected] with your actual details. After successful execution, the certificates will be located in /etc/letsencrypt/live/your_domain.com/. You will need fullchain.pem and privkey.pem.

TUIC server configuration

Download the latest version of the TUIC server from GitHub. The current version can be found on the project's releases page. For example:

wget https://github.com/EAimTY/tuic/releases/download/vX.Y.Z/tuic-server-vX.Y.Z-linux-x86_64 # Замените X.Y.Z на актуальную версию
sudo mv tuic-server-vX.Y.Z-linux-x86_64 /usr/local/bin/tuic-server
sudo chmod +x /usr/local/bin/tuic-server

Create a configuration file for TUIC (e.g., /etc/tuic/config.json):

sudo mkdir -p /etc/tuic
sudo nano /etc/tuic/config.json

Example config.json configuration:

{
  "port": 443,
  "users": {
    "your_user_uuid": "your_password"
  },
  "certificate": "/etc/letsencrypt/live/your_domain.com/fullchain.pem",
  "private_key": "/etc/letsencrypt/live/your_domain.com/privkey.pem",
  "congestion_controller": "bbr",
  "alpn": ["h3", "spdy/3.1"],
  "disable_udp": false,
  "zero_rtt_handshake": true,
  "log_level": "info"
}

Replace your_user_uuid with a unique UUID (you can generate one online), your_password with a strong password, and your_domain.com with your domain name. We will discuss congestion_controller further below. Create a systemd service for automatic TUIC startup:

sudo nano /etc/systemd/system/tuic.service

Contents of tuic.service:

[Unit]
Description=TUIC Proxy Service
After=network.target

[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
ExecStart=/usr/local/bin/tuic-server -c /etc/tuic/config.json
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target

Then, enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable tuic
sudo systemctl start tuic
sudo systemctl status tuic

Check the service status. If configured correctly, it should be active (running).

Choosing a TUIC Congestion Control Algorithm: BBR, CUBIC, or New Reno?

The congestion control (CC) algorithm plays a crucial role in TUIC's performance, especially in unstable networks with packet loss and high latency. TUIC supports several popular algorithms, each with its own characteristics.

Key congestion control algorithms

• BBR (Bottleneck Bandwidth and RTT): Developed by Google, BBR aims to identify the network's "bottleneck" bandwidth and minimum Round-Trip Time (RTT). It strives to keep the bottleneck full without overflowing it, leading to significant speed improvements and reduced latency, especially over long distances and with high packet loss. This is often the best choice for global proxy servers.
• CUBIC: The standard TCP algorithm for Linux, an evolution of BIC. CUBIC performs well in high-bandwidth, low-latency networks but can be less effective with significant packet loss, as it primarily reacts to losses rather than latency.
• New Reno: An older but still widely used algorithm. New Reno aggressively reduces the congestion window upon detecting losses, which can result in lower average throughput compared to CUBIC or BBR, especially at high speeds and in networks with frequent losses.

Optimizing performance in real-world scenarios

For most TUIC use cases, especially for bypassing censorship in regions with poor network quality, BBR is the preferred choice. It delivers superior performance by minimizing latency and maximizing throughput, even when the network is not ideal. To activate BBR on the server, in addition to configuring it in config.json, ensure it's enabled at the Linux kernel level:

sudo sysctl net.core.default_qdisc=fq
sudo sysctl net.ipv4.tcp_congestion_control=bbr
sudo sysctl -p

To make the changes persistent after a reboot, add the following lines to /etc/sysctl.conf:

net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr

Choosing the correct congestion control algorithm can significantly impact the TUIC user experience, particularly for video streaming or online gaming, where stable speed and low latency are critical.

Quick pick

Need a dedicated server?

Bare metal with NVMe in 70+ locations — configure and order in minutes.

Browse servers

Setting up TUIC clients: Sing-Box, v2rayN, and mobile apps

After successfully configuring the TUIC server, the next step is to set up the clients. TUIC is supported by various proxy clients across different platforms. We will cover configuration for Sing-Box, v2rayN, and mobile devices.

Configuring Sing-Box for TUIC v5

Sing-Box is a powerful and versatile client supporting numerous protocols, including TUIC v5. It is available for Linux, Windows, macOS, Android, and iOS.

Example Sing-Box configuration for TUIC (config.json file):

{
  "log": {
    "level": "info"
  },
  "inbounds": [
    {
      "type": "socks",
      "tag": "socks-in",
      "listen": "127.0.0.1",
      "listen_port": 1080
    }
  ],
  "outbounds": [
    {
      "type": "tuic",
      "tag": "tuic-out",
      "server": "your_domain.com",
      "server_port": 443,
      "uuid": "your_user_uuid",
      "password": "your_password",
      "congestion_controller": "bbr",
      "alpn": ["h3", "spdy/3.1"],
      "tls": {
        "enabled": true,
        "server_name": "your_domain.com",
        "insecure": false
      }
    },
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "rules": [
      {
        "port": 53,
        "outbound": "direct"
      },
      {
        "network": "udp",
        "port": 443,
        "outbound": "direct"
      },
      {
        "rule_set": "geosite-cn",
        "outbound": "direct"
      },
      {
        "outbound": "tuic-out"
      }
    ]
  }
}

Replace your_domain.com, your_user_uuid, and your_password with your server's details. After saving the file, run Sing-Box with the command sing-box run -c config.json. Then, configure your system proxy to SOCKS5 127.0.0.1:1080.

Configuring v2rayN for Windows

v2rayN is a popular graphical client for Windows, supporting VLESS, VMess, Shadowsocks, and other protocols, including TUIC. To configure TUIC:

1. Download and launch v2rayN.
2. In the "Servers" menu, select "Add TUIC Server".
3. In the window that appears, enter the following details:
   • Address: your_domain.com
   • Port: 443
   • UUID: your_user_uuid
   • Password: your_password
   • ALPN: h3,spdy/3.1
   • TLS: Check this box.
   • AllowInsecure: Do not check this if you are using a valid Let's Encrypt certificate.
   • Congestion Control: Select bbr.
4. Click "OK" and select the created server. Then, in the "System Proxy" menu, choose "Set System Proxy" or "Auto Configure System Proxy".

Clients for Android and iOS

The following clients with TUIC support are available for mobile devices:

• Android: Sing-Box (official client), Nekobox, SagerNet. All of them allow importing configurations via QR code or manually, using parameters similar to Sing-Box.
• iOS: Shadowrocket, Stash, Surge (paid but highly functional), or FoXray. In these applications, you can also manually add a TUIC server by specifying the domain, port, UUID, password, and ALPN.

It's crucial to ensure that the client settings specify correct TLS parameters (server_name and no insecure if the certificate is valid) and that the same congestion control algorithm is selected as on the server for optimal performance.

TUIC vs Hysteria2: A detailed comparison of censorship circumvention protocols

TUIC and Hysteria2 are two powerful protocols designed for bypassing censorship and operating in high-loss networks. Both utilize UDP and mask themselves as regular traffic, but they have significant differences. Detailed information about Hysteria2 can be found in our article Hysteria2 on VPS: Setup and Configuration for DPI Evasion in 2026.

Performance and behavior comparison

The key difference between TUIC and Hysteria2 lies in their approach to congestion control and traffic obfuscation. Hysteria2 uses a modified UDP protocol with custom congestion control (based on BBRv2), which is very aggressive and aims to quickly saturate available bandwidth. TUIC, on the other hand, is built on QUIC and offers a choice of standard algorithms (BBR, CUBIC).

For 50 concurrent users, 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are sufficient.

DPI detectability and evasion methods

Both protocols are designed to minimize DPI detectability. TUIC uses TLS 1.3 over QUIC, making it resemble regular HTTP/3 traffic. Hysteria2 also uses TLS 1.3, but over its custom UDP protocol, and can be configured to mimic WebRTC, which also effectively evades detection. In situations where DPI actively blocks QUIC traffic or UDP in general, Hysteria2 might have a slight advantage due to its aggressive nature and the possibility of more granular obfuscation settings.

The choice between TUIC and Hysteria2 often comes down to specific network conditions and preferences. If maximum speed and aggressive loss recovery are needed, Hysteria2 might be better. If the priority is stability, standard technologies, and good performance with moderate losses, TUIC v5 with BBR will be an excellent choice.

What to do if your ISP blocks UDP: Circumventing restrictions

Despite all the advantages of QUIC and TUIC, their main drawback emerges when internet service providers actively throttle or block UDP traffic. This can occur in some regions or networks where UDP is used for DDoS attacks or is simply considered less controllable. If your ISP blocks UDP entirely, TUIC, Hysteria2, and other QUIC/UDP-based protocols will cease to function.

Alternative solutions and strategies

In such a situation, it's necessary to consider alternative protocols that use TCP or can encapsulate UDP within TCP:

1. Shadowsocks-2022 with Reality/VLESS: This is a powerful TCP-based protocol that effectively disguises itself as regular TLS traffic and is highly resistant to DPI. Shadowsocks-2022 on VPS with the Reality plugin or VLESS+XTLS-Reality are among the most effective solutions against aggressive DPI, as they leverage existing TLS certificates of well-known websites to obfuscate traffic.
2. VMess/VLESS + WebSocket + TLS: These protocols operate over TCP, encapsulating traffic within WebSocket, which is then encrypted with TLS. This makes it resemble standard HTTPS traffic passing through a web server (e.g., Nginx).
3. Trojan: Trojan also uses TLS over TCP, masquerading as HTTPS. It is relatively simple to set up and effective.
4. Zapret: This isn't strictly a proxy, but a tool for bypassing DNS and SNI-level blocks, which can be used in combination with other methods or as a standalone solution for DPI evasion without a VPN for certain types of blocks.

If you encounter UDP blocking, it's advisable to have a backup plan with a TCP-based protocol. Valebyte.com offers flexible VPS solutions, allowing you to easily switch between different protocols and test their effectiveness in your network.

Quick pick

Need a dedicated server?

Bare metal with NVMe in 70+ locations — configure and order in minutes.

Browse servers

Frequently Asked Questions

How much RAM is needed for a TUIC v5 server?
For a small number of users (up to 20), 512 MB RAM is sufficient. However, for stable operation with 50-100+ concurrent connections and high speeds, a VPS with 2 GB RAM and 2 vCPU is recommended. This will provide enough buffer and computational power for processing QUIC traffic and encryption.

Can TUIC be used without a domain name?
Theoretically, you can use a self-signed certificate and an IP address, but this is highly discouraged. Modern clients and DPI systems easily detect such configurations, and browsers will issue warnings. For maximum stability and censorship circumvention, always use a domain name and a Let's Encrypt certificate.

TUIC v5 or Hysteria2: Which to choose for gaming?
For online gaming, where minimal latency and resilience to packet loss are critical, Hysteria2 often performs slightly better due to its aggressive congestion control algorithm, optimized for such scenarios. TUIC with BBR is also very good, but Hysteria2 might offer a small advantage in very poor networks with high packet loss.

Which port is best to use for TUIC if 443/UDP is blocked?
If port 443/UDP is blocked, you can try using other standard ports that are often allowed by DPI, such as 80/UDP or 8443/UDP. However, if the ISP aggressively blocks all UDP traffic, changing the port might not help, and you'll then need to switch to TCP-based protocols.

Conclusion

TUIC v5 stands as a powerful and modern protocol for bypassing censorship, leveraging the advantages of QUIC to deliver high-speed and stable connections even under significant packet loss. Proper configuration on a VPS, coupled with selecting an optimal congestion control algorithm like BBR, yields outstanding results. Despite potential issues with ISPs blocking UDP, TUIC remains one of the best solutions on the market, and for continuous access, having a backup TCP-based protocol is advisable. For optimal TUIC v5 performance on a VPS, Valebyte.com recommends plans with NVMe drives and ports starting from 1 Gbit/s, beginning at $8/month (approximate, current as of December 2025) for basic configurations.

SSD NVMe

Ready to launch your VPS?

NVMe VPS with 60-second activation: full root access, 20+ locations, pay with card or crypto.

Choose a plan