VPN protocols

TunnelHQ supports 11 VPN protocols. Each one connects the way a real client would, so a healthy check means the tunnel actually came up. Below is every protocol, grouped the way the protocol picker groups them, with the exact fields each needs.

On this page

Ask AI about this page

Open in Claude Open in ChatGPT Run with TunnelHQ MCP

Two ways to fill these in

You can paste a config or share link and let TunnelHQ detect the protocol and fields for you, or expand Or enter manually and fill them in. Fields marked required must be present before you can save.

Standard

WireGuard

A modern, fast tunnel. TunnelHQ brings the interface up from your config and confirms the handshake completes.

IP Address (required) — the interface address from the config, e.g. 10.0.0.1.
Config (required) — paste the full [Interface] / [Peer] config, or upload a .conf / .wg file.

wg0.conf

[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0

OpenVPN

The long-standing standard. TunnelHQ authenticates and establishes the tunnel using your config plus credentials.

Host (required) — server address, e.g. vpn.example.com.
Port (required) — e.g. 1194.
Transport (required) — UDP or TCP.
Username and Password (required) — the auth the server expects.
Config — paste the .ovpn contents, or upload the file.

IKEv2

Authenticates with EAP-MSCHAPv2 by default.

Host (required) — server address.
Remote ID (optional) — defaults to the host if you leave it blank.
Username and Password (required).

Heads up

Automated testing can be limited for IKEv2 depending on the server's configuration. Advanced options for Remote ID and certificates are available if you need them.

V2ray / Xray

These six are proxy protocols from the V2ray/Xray ecosystem. They all take a single connection URL — paste the full share link and TunnelHQ tests it using the Xray or sing-box engine under the hood. (When you bulk-import from a subscription, you can choose which engine runs, or let it auto-select.)

VLESS

Lightweight, stateless transport — often paired with Reality or XTLS.

connection url

vless://<uuid>@vpn.example.com:443?type=tcp&security=reality&...#My-VLESS

VMess

The original V2ray protocol. Share links are base64-encoded JSON, which TunnelHQ decodes for you.

connection url

vmess://eyJhZGQiOiJ2cG4uZXhhbXBsZS5jb20iLCJwb3J0IjoiNDQzIiwicHMiOiJNeS1WTWVzcyIsLi4ufQ==

Trojan

Disguises traffic as ordinary HTTPS.

connection url

trojan://<password>@vpn.example.com:443?sni=example.com#My-Trojan

Shadowsocks

A widely-used encrypted SOCKS5 proxy. Paste the ss:// link.

connection url

ss://<base64(method:password)>@vpn.example.com:8388#My-Shadowsocks

Hysteria2

A QUIC-based protocol tuned for lossy networks.

connection url

hysteria2://<password>@vpn.example.com:443?sni=example.com#My-Hysteria2

TUIC

Another QUIC-based protocol with low handshake latency.

connection url

tuic://<uuid>:<password>@vpn.example.com:443?congestion_control=bbr#My-TUIC

Obfuscated

AmneziaWG

WireGuard with traffic obfuscation to get past deep-packet inspection. It takes the same fields as WireGuard:

IP Address (required) — the interface address.
Config (required) — paste the AmneziaWG config, or upload a .conf / .wg file. The extra obfuscation parameters (Jc, Jmin, S1, …) are read straight from it.

OpenConnect

An open client for AnyConnect-compatible (ocserv) servers. No port — just the host.

Name (required for OpenConnect).
Host (required) — e.g. 209.50.57.143.
Username and Password (required).

Don't see your exact setup?

Most servers fit one of these. If you have a config file or share link, paste it into Add Monitor or Import and let detection do the work — it's the most reliable way to get every field right.