Why VPN stops working: diagnosing blocking and DPI

Signals available to DPI

DPI can inspect open headers, packet lengths, direction, intervals, duration, and destination addresses. Some systems add reputation lists or active probes. Encryption hides payload content but leaves metadata. Carrier rules and thresholds differ, so the same flow can pass on one network and fail on another.

WireGuard does not target obfuscation. AmneziaWG adds H1 - H4 ranges, S1 - S4 prefixes, I1 - I5 signatures, and junk packets. VLESS Reality creates a different external pattern through Xray and uTLS. Both change selected features while server addresses and session behavior remain visible.

Do not assign a failure to DPI before checking earlier stages. A DNS failure prevents the client from reaching transport filtering. A closed server firewall creates the same timeout as a blocked port.

Split the connection into stages

Start with endpoint resolution through the system DNS and an independent resolver. Next check the route and transport reachability. The third stage is protocol handshake. The fourth covers tunnel address, routes, NAT, and DNS inside the tunnel. The fifth tests user applications.

An AmneziaWG server should record a valid handshake from a known peer key. An Xray server should accept the VLESS and REALITY parameters. No server observation points toward the network, endpoint, port, or local firewall. An authentication error points toward profile data, time, or software compatibility.

After a handshake, request an IP literal and then a domain. That order separates routing from name resolution. Test a larger response because MTU faults and loss may spare short requests.

Run a controlled two-network test

Use one device, one profile, and one server. Test Wi-Fi and then mobile data without updating software or editing parameters. Record time, access-network address, client version, handshake status, connection time, and first successful request.

A profile that works on one network makes a server fault less likely, but it does not prove DPI. DNS, IPv6, NAT, MTU, and routes can differ. Repeat with an IP literal and, where the product supports it, a documented IPv4-only check. Record each change.

Changing a UDP port can test port policy, but server and client must change together. AWG 3.1 fields must remain coherent. Removing new fields destroys the experiment and may create an invalid profile.

Interpret common symptoms

An immediate parser error often points to profile format or client compatibility. AmneziaVPN releases before 5.0.1.5 do not support AWG 3.1. A handshake timeout covers a closed port, wrong endpoint, firewall, filtering, or a stopped server.

A completed handshake with no browsing calls for AllowedIPs, forwarding, NAT, and DNS checks. Small requests that work while transfers stall suggest MTU, loss, or path MTU discovery. Periodic drops can align with mobile handover, NAT expiry, or address changes.

For a vless blocked report, name the full stack. REALITY target, serverName, shortId, keys, clock, and Xray version all affect authentication. Server logs should show whether the request arrived before anyone labels it censorship.

Publish reproducible evidence

A useful report gives date, broad region, carrier, access type, device, OS, client version, and complete protocol stack. It defines success as a handshake, DNS answer, HTTP request, and sustained transfer. A failure record names the stage and sanitised error.

Never publish UUID, PrivateKey, import links, QR codes, or private panel addresses. Redact screenshots. Report a series rather than the best attempt. A later network-policy change limits the report’s time range; it does not rewrite the observation.

“Five of five handshakes completed on carrier X on [test date]” has a repeatable boundary. “Cannot be blocked” does not. This distinction improves trust and helps engineers compare reports.

Safe response order and sources

Update from an official source. For AWG 3.1, issue a new profile and use AmneziaVPN 5.0.1.5 or newer. Check device time, endpoint, subscription, a unique device configuration, and server health. Then run the staged test.

If one network fails, send support a sanitised timeline and ticket identifier. Avoid aggressive port scans, which can violate network rules and contaminate evidence. Keep a fallback transport available for recovery.

Authoritative references include and These sources explain component behavior, not the current policy of a specific carrier.