Using Logrus in China and Iran

In short

1. On first launch, in the Setup Wizard, answer "Where are you using the VPN from?" with "Russia, Iran, China or another restrictive region".
2. In Routes → Locations, leave Auto selected.
3. Give the first connection 10–30 seconds.

The client handles the rest. There is no separate "China mode" to switch on — and that is deliberate: transport selection happens on every connection, because the network you are sitting in changes more often than a setting would.

What picking a restrictive region does

The wizard turns on the system kill switch and disables IPv6. The second matters more than it looks: on an IPv6 network some requests leave outside the tunnel through Happy Eyeballs and WebRTC, carrying your real address, and nothing tells you it happened.

You can re-run the wizard at any time: Settings → Diagnostics → "Replay the tour".

Why the first connection is slower

The client works through transports until it finds one that gets past your ISP's filter. Plain TLS, an obfuscated channel, WebSocket, HTTP/2, QUIC, domain fronting — the order and the parameters follow from what exactly failed.

The connection screen shows which transport is in use and marks it "adaptive". It can change mid-session if the channel starts being throttled; that is the system working, not a fault.

About UDP: hostile networks often throttle it wholesale. If QUIC doesn't get through, the client falls back to TCP-based transports on its own. There is nothing to configure.

Hardened obfuscation

In hard-filtering networks, DPI can recognise a VPN from packet sizes alone, without opening anything. The countermeasure is a mode that encrypts frame lengths too, so the traffic is indistinguishable from random bytes to an analyser.

There is deliberately no toggle for it in the app: the server declares the mode in its strategy configuration and the client applies it. If you are adding a server by hand, pick the "Obfuscated (anti-DPI)" transport in the server editor.

Traffic rules follow the country

Open Routes → Policies and you'll see the enabled categories. In China that's Chinese services, in Iran Iranian services: domestic banks, state portals and services that reset connections from foreign addresses go direct, outside the tunnel. Ad and malware blocking are on top of that.

Categories can be turned off or extended with your own rules — see Sending traffic around the VPN.

TLS fingerprint

By default Logrus imitates an ordinary browser's TLS handshake, with the fingerprint drawn from the server's pool (Settings → Advanced → TLS fingerprint → Auto). Change it only if you have real grounds to suspect a particular ISP has learned to recognise our specific handshake shape. Changing it at random makes things worse.

When to contact support

If you can't connect within 3–5 minutes, don't start turning knobs. Open Support → Contact support, tick "Attach recent logs" and state your country and ISP. The logs show exactly which step the connection dies on, and we keep a list of known hostile ISPs and the configurations that work on them.