Solutions · Censorship
For networks that block VPNs
On some networks the connection simply never comes up: equipment between you and the internet inspects every packet and drops anything that looks like a VPN. Engineers call it deep packet inspection — DPI. If that sounds like your network, this page is for you.
ForestVPN was built for exactly this. It detects the block and adapts automatically with obfuscated transports — starting with the lightest disguise and stepping up only as far as your network demands.
What to expect on a blocked network
Honest, practical answers — this is what actually happens when you open the app where VPNs are blocked.
The first connection may take longer
On a heavily filtered network the app may need a few attempts while it works out which transport gets through. That happens by itself — there is nothing to configure and no server list to fiddle with.
The ladder climbs on its own
ForestVPN carries a ladder of transports — from light header obfuscation that is always on, through padded and re-disguised traffic, up to opt-in traffic shaping. When a rung stalls, the app climbs to the next one.
Relays carry you when the road is closed
If direct connections are blocked entirely, ForestVPN falls back to its relay network over TLS — the same protocol ordinary websites use — so a working path usually remains.
The disguise game
Your traffic has to walk past a checkpoint. ForestVPN gives it better and better disguises — but only as many as the checkpoint demands.
Your message sets out. On easy networks, it just walks through.
Region tiers decide the starting rung: free / monitored / censored.
First trick: the walker wears no name tag. Nothing about it says what it is.
T0 — keyed discovery + obfuscated headers: no cleartext fingerprint. Always on, on every plan.
The guard starts measuring everyone. So the walker changes size — and uses a different door each time.
T1 — padding + multi-port: telltale sizes and the single well-known port go away.
Now the guard listens for a certain accent. The walker answers in a completely different language.
T2 — Shadowsocks-2022 encapsulation.
Best disguise yet: look exactly like everybody else.
T3 — QUIC mimicry: shaped like the busiest traffic on the internet.
Send three walkers down three roads at once. Whoever gets through first wins.
T4 — race all transports: first road through carries the session.
For the very strictest checkpoints, the walker even changes how it walks.
T5 — maybenot/DAITA traffic shaping. Opt-in — you switch it on.
ForestVPN climbs only as high as your network demands — and steps back down when it can.
Tiers are retuned per region, server-side — no app update needed.
The road and the relay
When the straight road closes, another one lights up.
Usually your traffic takes the straight road.
Direct connections use UDP with NAT hole-punching.
Sometimes the road is closed.
Some networks block UDP entirely.
So ForestVPN sends it up and over — through a relay.
The DERP relay network, operated by ForestVPN.
The relay talks the same way normal websites do — so the road stays open.
When UDP is blocked, relays fall back to TLS; QUIC-DERP keeps it fast where QUIC is allowed.
You can tell it which roads you prefer.
Routing Mode: Automatic / Direct-preferred / Relay-only.
The moment the straight road opens again, ForestVPN takes it — that’s the fast lane.
Relays stay standing by; direct comes back the instant it works.
What "monitored" vs "censored" means for you
ForestVPN groups regions into three tiers — free, monitored, censored — the same vocabulary the app itself uses. Your tier decides which rungs start enabled.
- free
- No interference. Standard transports work and the ladder rests on its lightest, fastest rung.
- monitored
- VPN traffic is restricted on some networks. The app watches connections more closely and steps up sooner when a transport stalls.
- censored
- Standard VPN protocols are actively blocked. Stronger obfuscated transports start enabled out of the box, so the first connection already climbs the right rungs.
Tiers are delivered as configuration, not code — so when a region's filtering changes, the response can be retuned without waiting for an app update.
An honest note
No app can promise that every network will pass traffic at every moment — filtering changes, sometimes week to week. What ForestVPN promises is adaptation: when a transport stops working the app notices and tries the next rung, relays stand by when the direct road closes, and the region's configuration can be retuned server-side as conditions change.
Want the whole story — the disguise game, the packet that vanished, the road and the relay? Read how ForestVPN works
Try the VPN that adapts
One app, every rung of the ladder — engaged exactly as far as your network demands.