NPV Tunnel Supported Protocols Explained in Plain English

Open NPV Tunnel's manual config menu and you will meet a small alphabet soup. This guide explains what each name means, what it is good at, and how to choose without becoming a networking expert.

First, the big picture

All of these protocols do the same basic job: they carry your traffic to a remote server in a way that is private, and in some cases hard to recognise. They differ in speed, how much they disguise themselves, and what the server needs. NPV Tunnel's store listing names these: VLESS, VMess, Trojan, Shadowsocks, Hysteria2, WireGuard, SSH, DNSTT, SOCKS and HTTP, plus custom Xray JSON.

The V2Ray / Xray family

VLESS

A lightweight protocol that identifies you with a UUID. On its own it does not encrypt anything, so it is used together with TLS or REALITY for security. It is very popular today for two reasons: low overhead and the "Vision" flow mode that removes a telltale pattern of TLS-inside-TLS. We go deeper in VLESS vs VMess vs Trojan.

VMess

The older V2Ray protocol with built-in encryption and replay protection. It is still everywhere, so you will often be handed a vmess:// link, and it works well on most networks.

Trojan

Designed to look like ordinary HTTPS traffic to a real website. It needs a proper certificate and domain on the server side, and is loved for its simplicity.

Shadowsocks

One of the earliest popular proxy protocols: simple, fast and widely supported. On heavily filtered networks it is easier to detect than newer options, but on normal networks it is perfectly fine.

SOCKS and HTTP

Plain proxy endpoints. Useful when a service gives you a proxy address and port and nothing else. They are not encrypted by themselves.

SSH

If you have a Linux server, you already have SSH. NPV Tunnel can use an SSH account as a tunnel, which makes it the easiest protocol to start with when you own a VPS. Read the walkthrough: SSH tunnel with NPV Tunnel.

DNSTT

A tunnel that hides data inside DNS queries. It is slow, but on networks where almost nothing else gets through, DNS often still does. See What is DNSTT?

WireGuard

A modern, fast, minimal VPN protocol. It is excellent on normal networks and uses little battery. Its traffic pattern is easy for filters to identify, so it shines where nobody is blocking VPNs.

Hysteria2

A QUIC-based protocol built for speed on lossy or long-distance links. See Hysteria2 explained.

Custom Xray JSON

For advanced users: paste a complete Xray configuration for total control over routing, transports and settings.

Quick comparison

So which should you pick?

• Got a provider config? Use whatever they gave you. They tested it.
• Own a VPS and want simple: SSH or WireGuard.
• Want modern and fast: VLESS with TLS/REALITY.
• Internet is mostly blocked: try VLESS+REALITY, Trojan, or as a last resort DNSTT.
• Bad Wi-Fi with packet loss: Hysteria2.

Transports and security layers

Inside the V2Ray and Xray family, the protocol (VLESS, VMess, Trojan) is only part of the story. A config also chooses a transport and a security layer:

• TCP: the simple default.
• WebSocket (WS) and gRPC: wrap traffic so it passes through web servers and CDNs.
• HTTP/2 or HTTPUpgrade: other web-style transports.
• TLS: normal HTTPS encryption with a certificate.
• REALITY: borrows a real website's TLS identity and needs no certificate of your own.

You rarely need to choose these yourself. When you import a link such as vless://…, they are already encoded in it. If you edit a config by hand and something stops working, these fields (network type, security, SNI, host header and path) are the first place to look.

What do the fields mean?

Which protocols does the iPhone version support?

The App Store lists VLESS, VMess, Trojan, Shadowsocks, Hysteria2, WireGuard, SSH, DNSTT, SOCKS and HTTP plus custom Xray JSON. Release notes for iOS 57.1 mention improvements to Trojan, advanced options and WireGuard IPv6 imports.

A practical approach to testing

1. Import two configs on different protocols.
2. Ping both.
3. Connect to each and load a few pages and a video.
4. Keep the one that is both fast and stable on your own network. Put the other in a Smart Route group as a backup.

Frequently asked questions

Keep reading