Last updated: July 2026
VPN glossary: the key terms worth knowing
Short answer
This VPN glossary defines the terms you meet most often when using a VPN — VLESS, Reality, WireGuard, AmneziaWG, Hysteria2, DPI, GFW, DNS leak, kill switch, no-logs, obfuscation, and jurisdiction — each explained briefly and precisely.
TL;DR
- 12 key terms in 3 groups: protocols, censorship & circumvention, privacy & security
- Covers every TukTukVPN protocol: VLESS, Reality, WireGuard, AmneziaWG, Hysteria2
- Explains DPI and the GFW used to block VPNs, and the obfuscation used to get past them
- Privacy terms: DNS leak, kill switch, no-logs, jurisdiction
Protocols & transport
- VLESS
- A transport protocol from the Xray/V2Ray family, designed to be lightweight and stateless with no encryption layer of its own — so it leaves no easy signature to detect. Usually paired with Reality or TLS to disguise traffic as ordinary HTTPS browsing. One of the protocols TukTukVPN runs (VLESS+Reality).
- Reality
- An Xray connection-camouflage technique that makes VPN traffic look like a genuine TLS connection to a real, well-known website — without needing its own certificate. It defeats DPI detection and SNI-based blocking, so connections survive on heavily filtered networks.
- WireGuard
- A modern VPN protocol with a lean codebase and up-to-date cryptography, delivering high speed and low battery drain — today's most popular standard. Its limitation: the packet format is quite distinctive, so DPI can identify and block it on strictly filtered networks.
- AmneziaWG
- A modified WireGuard fork that adds obfuscation so packets carry none of WireGuard's usual signatures — getting through in countries that block plain WireGuard while keeping WireGuard's speed. TukTukVPN runs WireGuard/AmneziaWG as one of its protocols.
- Hysteria2
- A protocol built on QUIC/UDP, designed to withstand lossy or high-latency networks using aggressive congestion control — so it often delivers better throughput on poor connections or long international routes, and it can masquerade as HTTP/3 traffic.
Censorship & circumvention
- DPIDeep Packet Inspection
- Deep inspection of packet contents by an ISP or state to identify and block VPN traffic even when the data itself is encrypted. Large censorship systems like China's Great Firewall use DPI as a primary tool — obfuscation (Reality/AmneziaWG) exists specifically to beat it.
- GFWGreat Firewall
- China's internet censorship system, combining DPI, DNS poisoning, connection resets, and active probing of suspected servers to block both websites and VPNs. Widely considered one of the most sophisticated internet filtering systems in the world.
- Obfuscation
- Techniques that make VPN traffic “not look like a VPN” — masquerading as ordinary HTTPS or QUIC, or stripping a protocol's signatures — so it passes DPI and blocking on heavily filtered networks. The heart of staying connected in countries that censor the internet.
Privacy & security
- DNS leak
- When DNS requests (translating a site name to an IP address) escape to the ISP's servers instead of travelling through the VPN tunnel — letting the ISP see which sites you visit even while connected. A well-designed VPN must prevent DNS leaks.
- Kill switch
- A function that cuts internet access the instant the VPN drops, so real traffic and your real IP never leak outside the tunnel during the gap. An essential safeguard for anyone who needs continuous privacy.
- No-logs
- A policy where the VPN provider keeps no records of usage activity (sites visited, source IP, connection times) in any form traceable back to the user. TukTukVPN holds a strict no-logs policy — it is our stance, and it has not yet been audited by a third party, which we state plainly.
- Jurisdiction
- The country where a VPN company is registered and whose laws it answers to — determining how far a state can compel it to hand over or retain user data. A privacy factor to weigh alongside the no-logs policy itself.
Frequently asked questions
Why do these terms matter?
Understanding words like DPI, obfuscation, no-logs, and kill switch lets you judge which VPN actually fits your needs — especially on heavily filtered networks or when privacy is the priority.
What's the difference between Reality and AmneziaWG?
Both aim to disguise traffic from DPI, but from different bases: Reality is an Xray technique that makes VLESS look like a genuine TLS connection to a real website, while AmneziaWG is a modified WireGuard with WireGuard's signatures removed. TukTukVPN uses both and switches automatically.
Has TukTukVPN's no-logs policy been audited?
Not yet — it has not been verified by a third party. We hold a strict no-logs policy as a stance and say so plainly; we make no audit claims until a real audit happens.
Ready to try it yourself?
Free 7-day trial, no card — 50GB / 2 devices, every protocol included.