Xray Reality vs WireGuard: why one works in China and the other doesn't

WireGuard has a reputation as the best VPN protocol available. It's modern, fast, lean, and uses excellent cryptography. If you read any serious comparison of VPN protocols, WireGuard usually comes out on top.

It also gets blocked in China within seconds of being detected. Often faster.

Xray Reality, by contrast, is barely known outside technical circles. It doesn't appear in mainstream VPN comparisons. There's no slick marketing around it. And it's the protocol that actually works reliably behind the Great Firewall — including in 2026, when almost everything else has been blocked.

Understanding why requires looking at what firewalls actually do — and what "blocked" really means at a technical level.

What a firewall actually looks at

When you send data across the internet, it travels in packets. Each packet has a header (metadata about where it's going and what kind of data it is) and a payload (the actual content). Encryption protects the payload — a firewall can't read your messages or see what websites you're visiting.

But the firewall doesn't need to read your content to identify what you're doing. It looks at the shape of your traffic — the pattern of packets, the timing, the handshake sequence, the protocol signature. Every type of internet traffic has a characteristic shape, and firewalls are trained to recognize them.

This is called Deep Packet Inspection (DPI), and it's the core technology behind the Great Firewall. The GFW doesn't block VPNs because it can read your data. It blocks them because VPN traffic looks different from normal web traffic — even when encrypted.

Why WireGuard is instantly identifiable

WireGuard was designed for performance and simplicity, not for hiding what it is. Its handshake is distinctive, its use of UDP on specific ports is predictable, and its packet structure has recognizable characteristics that modern DPI systems identify in milliseconds.

This is not a flaw in WireGuard's design — it was never designed to be undetectable. It was designed to be a fast, secure VPN protocol for use in environments where VPN traffic is allowed. In those environments, it's excellent. Behind a firewall that actively blocks VPN protocols, its detectability is fatal.

The GFW's WireGuard detection has been reliable since at least 2022. In 2026, there is no configuration of standard WireGuard that passes through the Great Firewall without obfuscation. Even with obfuscation wrappers, WireGuard-based connections in China tend to be unstable — the obfuscation layer adds its own detectable characteristics.

What makes Xray Reality different

Xray Reality doesn't try to hide VPN traffic. It replaces the VPN handshake with something else entirely.

Here's what happens when you connect using Reality:

Your client initiates a standard TLS 1.3 handshake — the same protocol used by every HTTPS website. But instead of connecting to your server directly, it performs this handshake with a real, legitimate domain — a large, trusted website whose TLS certificate is publicly verifiable. The Xray server sits between your client and this domain, completing the handshake authentically.

The result: the firewall sees a TLS 1.3 connection to a well-known legitimate domain. It inspects the handshake. The certificate checks out. The traffic pattern matches normal HTTPS. There is nothing to block — because from the firewall's perspective, you're browsing a legitimate website.

Your actual traffic then rides inside this established TLS session, invisible to any inspection that doesn't already know what it's looking for.

The comparison that matters

The tradeoff: setup complexity

Reality's weakness is that it requires server-side configuration. You can't download a Reality app from the App Store and connect to a shared server. The protocol requires your own VPS, and it requires that VPS to be configured correctly — choosing the right "cover" domain for the TLS handshake, configuring certificates, making sure the Reality parameters match between server and client.

When configured correctly, it's stable and fast. The client apps — Shadowrocket on iOS, v2rayNG or V2RayTun on Android, Hiddify on desktop — are straightforward once the server configuration is in place. The complexity is entirely on the server side.

WireGuard, by contrast, is easy to set up. Mullvad, ProtonVPN, and dozens of other providers offer WireGuard connections through polished apps. For use in countries without aggressive censorship, WireGuard is an excellent choice. For China or Russia in 2026, the ease of setup is irrelevant — it doesn't work.

A note on active probing resistance

The GFW uses a technique called active probing: when it detects a suspicious connection, it sends its own connection attempts to the suspected VPN server to confirm what it's dealing with. Many protocols that claim to be undetectable fail at this step — the server responds in a way that confirms it's a VPN endpoint.

Reality is specifically designed to resist active probing. When the GFW's probe connects to a Reality server, the server responds exactly as the legitimate cover domain would — because the Reality implementation handles unauthenticated connections by falling back to the cover domain's behavior. The probe gets back what it expects from a legitimate HTTPS server and moves on.

This is one of the reasons Reality has remained effective longer than previous generations of obfuscation protocols. It doesn't just hide — it actively passes inspection.

Is there anything better than Reality?

Not currently for civilian use behind the GFW. The Xray project continues to develop, and the Reality protocol has been updated several times since its initial release. The Xray Core GitHub repository is active and responsive to new blocking techniques.

The honest answer is that no circumvention technology is permanently unblockable. The GFW is well-funded, technically sophisticated, and continuously updated. What Reality provides is a significant structural advantage — because blocking it would require blocking all TLS traffic to legitimate domains, which would break the Chinese internet itself. That's a constraint the firewall has to respect.

WireGuard is a better VPN protocol than Reality by almost every measure that doesn't involve getting through the Great Firewall. It's simpler, more widely supported, and easier to understand. If you're in a country where VPNs work normally, use WireGuard.

If you're in China, Russia, Iran, or Turkey — where the firewall specifically targets VPN protocols — the ease of WireGuard is irrelevant. What matters is whether the traffic passes inspection. Reality passes inspection. WireGuard doesn't.