An article in South China Morning Post stated that V2Ray is a reliable way for many people in China to access the global internet; these users are either technically proficient or subscribe to paid services. V2Ray is also described as the spiritual successor to Shadowsocks, and support for (…) TLS is seen as an improvement over Shadowsocks; these features can disguise traffic as visits to unblocked websites.
Shadowsocks definitely is a censorship circumvention tool; it was designed to do so from the very beginning. But what about V2Ray? Well, it markets itself as “a set of network tools that help you to build your own computer network”, which “secures your network connections and thus protects your privacy.”
Encryption and Camouflage
Encryption (加密) and camouflage (伪装). The two words sum up the goal of V2Ray: to establish a secure tunnel between any two points in the world, while hiding the tunnel. This sounds simple, but it pushes VMess, the proxy protocol developed by the V2Ray community, to another level.
To my surprise, many fellow Chinese netizens are still mixing the two concepts up. So I think I should explain them here:
Encryption means securing the content of communication so no one in the middle knows what is being transmitted between you and the other side of the internet. Most of the time, you’re already benefitting from encryption when you’re doing normal web browsing because of TLS, but in most cases (to this day), the (domain) names of the websites you’re visiting, technically known as SNI (Server Name Indication), are generally transferred in cleartext during TLS negotiation (Client Hello). By using V2Ray, you’re also hiding that information by rerouting web traffic through a secure tunnel.
Camouflage (or cloaking) means you’re trying to hide the fact that what you’re using is a proxy server. By default, VMess doesn’t try to do this (proxy traffic simply looks like random data). However, if you opt into this set of features, you can make the traffic appear the same as common protocols on the internet, including:
HTTPS/WSS (secure WebSockets)
HTTP (wrapping encrypted tunnel traffic in plaintext HTTP requests)
or even WeChat/FaceTime video calls (using mKCP transport with advanced config)
So how does the V2Ray software handle two different things at the same time? The answer is “layering”. Simply put, a connection between a V2Ray client and server is made up of two things: “protocol” as the inner layer and “stream” (or “transport layer”) as the outer layer. Stream controls what the traffic looks like (camouflage), while protocol manages the rest, mainly just encryption (complexity is not welcome in the proxy world anyway). Because Stream and Protocol are two different things, you can actually create your own mix such as VMess+QUIC or Shadowsocks+WSS. Just don’t get too confused over your own configuration, as it may get too lengthy :)
Legality vs Human Rights
In some repressive countries, DPI (deep packet inspection) is implemented to monitor internet traffic, especially cross-border traffic. Censors can not only tell the protocol and server name used, but are also able to keep track of the amount of data transferred from a foreign server to a domestic IP address. This has significantly increased the difficulty of running a proxy server for censorship circumvention, because governments in these countries aren’t particularly happy with someone downloading gigabytes of data from a “small personal website”: no matter how well you disguise the connection with fine-tuned camouflage configuration, you can barely change the fact that your VPS is not part of a well-known service. Even if you really only use your VPS for perfectly legitimate purposes like hosting your own blog, what economic loss is there for the censors if they just go ahead and block your server anyway?
This seemed like an almost unsolvable problem on the surface, until we brought in a major player and a clever hack of the modern internet: CDNs and domain fronting. Yes, I know you privacy guys hate CDNs very much, but hear me out: it’s one of the few ways you actually get to “share” servers with major websites, which, with a very high probability, includes ones coming from the very country where you’re trying to bypass internet censorship!
Here’s how the hack works:
You set up WebSockets or HTTP as Stream for your proxy, so that CDNs can forward the traffic as if they’re dealing with a real website;
You put your “website” behind a popular CDN service (no going to name any of them!) that a popular (and not censored) website also happens to use;
On your client, you put the domain of the popular website (e.g. yayhoo.tld) into the “SNI” field and your own domain (e.g. seize.tld) into the “host” field;
When establishing a connection, your client and a CDN edge server perform a TLS handshake, with “yayhoo.tld” in the cleartext SNI field. An encrypted TLS tunnel is now on since the edge server has the right certificate;
Over the encrypted tunnel, your client sends HTTP/WebSocket requests with “seize.tld” in the host header. CDNs usually do internal routing using the host header anyway so the traffic is correctly routed to your server;
It appears to the censors that you’re visiting “yayhoo.tld” through the CDN, while you’re actually accessing your own proxy service hosted on “seize.tld”.
Doing so, however, is seen by the vast majority of CDN providers as “misusing” or even “abusing” their services. Some governments also pressure CDN providers operating in their countries to block this kind of use. Despite this, it is still possible in 2026, although you might get banned from CDNs if they find out what you’re up to.
Whether someone should use such a method to avoid their server being blocked remains a heated debate. On the one hand, you’re essentially using a service in an illegitimate or even illegal way, as you might hurt the business interests of CDN providers in a country. On the other hand, however, you’re exercising and defending freedom, a basic human rights. A developer in the community (whose work will be covered in later posts in the series) said:
On a side note regarding the recent debate over whether using a CDN as a front is “abuse”: obviously, CDNs […] weren’t intended for building proxy services. However, in our fight against the GFW, it is both reasonable and necessary to constantly explore, develop, and exploit as many new methods [to bypass the GFW] as possible. It’s a last resort, and increasing the “collateral damage” for censors requires us to blend in with “normal” services—that’s just unavoidable. To give a simple example: if one day they switch to an IP whitelist and CDN IPs are on it, would you use them or not? The rules of the real world don’t apply to the field of anti-censorship; it’s a simple truth that some people just can’t seem to wrap their heads around.
Anyway, this is part of the broader concept of “collateral freedom,” which Wikipedia defines as an attempt to make internet censorship economically prohibitive. Feel free to have your own opinion on this matter!
“Shadowsocks + V2Ray Plugin”?
While V2Ray is a complete software suite on its own, the Shadowsocks team did develop a plugin to extend the functionality of Shadowsocks so that it can make use of the Stream layer from V2Ray to encapsulate Shadowsocks connections (e.g. “Shadowsocks over websocket” or “Shadowsocks over QUIC”).
I want to discuss its use cases first, but I can’t keep my opinions to myself any longer: JUST DON’T! It’s a terrible, terrible idea to use the V2Ray plugin with Shadowsocks instead of using V2Ray-Core or other software with full V2Ray support!
It seems like Shadowsocks has been so popular outside China that it makes people think V2Ray is somehow “just a plugin for Shadowsocks.” The entire time Mullvad provided “V2Ray” bridges alongside their Shadowsocks ones, they were only available as “Shadowsocks with v2ray”. And another provider, Xeovo, still offers this combination as part of its “stealth proxy” feature to this day. WHAT A PITY!!
Allow me to walk you through a few reasons why I think it’s such a horrible idea:
This Shadowsocks plugin was and is barely maintained. The latest release dates back to 2022. At the same time, V2Ray-Core has remained in development under V2Fly, an active open-source community. Over the past few months, many new Stream types have been added such as mekya and TLSMirror;
There’s no guarantee that it fully replicates V2Ray specifications. This can be a HUGE problem if you are in a repressive country with DPI;
It’s a hassle to use anyway. On Windows, you have to specify the path to the plugin in the Shadowsocks app, while on Android you have to install 2 seperate apps for this to work. Why not just use a V2Ray-based app instead? If you really like the idea of Shadowsocks+QUIC, you can do it on V2Ray anyway;
It’s the direct cause of confusion for someone new to the anti-censorship playing field.
I witnessed the birth of this plugin. I understood that V2Ray-Core was not mature enough at that time and the community was in desperate need of a workaround against the ever-increasing DPI scanning and active probing of proxy servers in 2019 when Shadowsocks was still the go-to protocol. I knew it could be troublesome. I’m still so annoyed by the plugin to this day.
Victoria Raymond
Victoria Raymond was the original developer of V2Ray. I bet you can see how the software got its name in the first place. She maintained it until late 2019 when she disappeared from the internet entirely without any explanation. Luckily, months before her disappearance, the project became so community-driven that other maintainers were able to form a new group called “V2Fly” and keep maintaining the project to this day.
Unlike clowwindy, the creator of Shadowsocks who we know lives a happily-ever-after life in the US, Victoria’s fate remains unknown after so many years. I hope she’s just ditched this identity and moved on to a completely anonymous life. She’s got every reason to do so; after all, if she kept maintaining a project like this, it would only be a matter of time before the Chinese police came knocking.
Not So Popular Anymore?
V2Fly’s V2Ray-core has not been considered the standard core for about 4 years. Another open-source project, which branched off due to licensing issues, has gradually replaced it in practice thanks to its pragmatic approach. I’ll be mentioning it very soon in a future blog post in this series. So, stay tuned for now (I have at least 4 more posts to go)!