Clash Proxy Protocol Guide: VLESS vs Hysteria2 vs Tuic vs ShadowTLS Compared

Introduction to Modern Proxy Protocols

When configuring Clash Meta, selecting the right proxy protocol is crucial for balancing speed, stability, and stealth. Unlike the older generation of protocols, modern alternatives like VLESS, Hysteria2, Tuic, and ShadowTLS are designed to overcome specific network challenges such as deep packet inspection (DPI) and high packet loss. If you are still using legacy setups, understanding the shift to Clash Meta is essential. You can read more about the core differences in our Clash Meta vs Original Clash guide.

This guide provides a deep technical comparison of these four protocols, helping you make an informed clash protocol selection based on your specific network environment.

VLESS: The TCP/WS Standard Bearer

VLESS is a stateless protocol designed to be lightweight and highly extensible. It operates primarily over TCP, WebSocket, or gRPC, making it look identical to standard HTTPS traffic when combined with TLS and a fallback web server.

Technical Characteristics

• Stateless Design: No handshake overhead for session resumption, reducing latency.
• Encryption: Relies on TLS for security, meaning the protocol itself does not add extra encryption layers, reducing CPU usage on the server.
• Fragmentation: Supports TLS fragment and XUDP, which are critical for bypassing strict SNI inspection.

The Reality of VLESS

Reality is a TLS camouflage mechanism that does not require a domain name or certificate. It mimics the TLS handshake of a target website (like www.microsoft.com) while encrypting the payload. The client uses a client-fingerprint (like chrome or safari) to perfectly mimic browser TLS fingerprints, defeating passive DPI.

Hysteria2: QUIC-based Speed Demon

Hysteria2 is built on top of the QUIC protocol (UDP). It is specifically engineered to thrive in high packet loss and jitter environments, which are common in congested international submarine cables.

Brutal Congestion Control

Unlike standard TCP congestion control algorithms (like BBR) that back off when packet loss occurs, Hysteria2 uses a custom congestion control mechanism called "Brutal". It forces a specific throughput regardless of packet loss, ensuring your video streams do not buffer even when the underlying network drops 10% of packets.

# Hysteria2 Server Config Snippet
server:
  listen: :443
  tls:
    cert: /path/to/cert.crt
    key: /path/to/key.key
auth:
  type: password
  password: your_secure_password
bandwidth:
  up: 100 mbps
  down: 100 mbps
masquerade:
  type: proxy
  proxy:
    url: https://www.example.com
    rewrite-host: true

Tuic: Lightweight QUIC Alternative

Tuic is another QUIC-based protocol, but it focuses on extreme lightweight design and low latency rather than raw throughput under packet loss. It uses a simplified handshake process.

Protocol Design

Tuic v5 implements a 0-RTT handshake, meaning the first packet of your data can be sent along with the connection request. This makes it exceptionally fast for short-lived connections like DNS queries or web browsing. Furthermore, Tuic uses a single UDP connection to multiplex multiple TCP streams, avoiding the overhead of establishing multiple QUIC connections.

ShadowTLS: Camouflage and Anti-Detection

ShadowTLS is not a proxy protocol itself, but a proxy chain component. It wraps a standard proxy protocol (like Shadowsocks 2022) inside a fake TLS handshake. It acts as a proxy that intercepts the TLS Client Hello and forwards it to a real website if the password is incorrect.

How the Chain Works

This makes the traffic completely indistinguishable from a normal HTTPS visit to a major website, providing the highest level of stealth against DPI.

Protocol Comparison Matrix

To make the right clash protocol selection, we must evaluate these protocols across three dimensions: Latency, Throughput, and Anti-Detection.

How to Choose the Right Protocol for Your Scenario

Your choice should be dictated by your network environment and usage patterns. If you are configuring the YAML configuration, understanding these nuances is critical.

Configuring Protocols in Clash Meta

Clash Meta supports all these protocols natively. When setting up your proxies, ensure you are using the correct syntax. For advanced routing, you can combine these proxies into different groups. Refer to our guide on Clash Proxy Group Strategies to implement fallback and load balancing.

proxies:
  - name: "VLESS Reality"
    type: vless
    server: 1.2.3.4
    port: 443
    uuid: your-uuid
    network: tcp
    udp: true
    tls: true
    flow: xtls-rprx-vision
    servername: www.microsoft.com
    reality-opts:
      public-key: your-public-key
      short-id: your-short-id
    client-fingerprint: chrome

  - name: "Hysteria2"
    type: hysteria2
    server: 1.2.3.4
    port: 443
    password: your-password
    sni: www.example.com
    skip-cert-verify: false
    alpn:
      - h3
    tls: true

  - name: "Tuic v5"
    type: tuic
    server: 1.2.3.4
    port: 443
    uuid: your-uuid
    password: your-password
    sni: www.example.com
    alpn:
      - h3
    skip-cert-verify: false

proxy-groups:
  - name: "Auto Select"
    type: url-test
    proxies:
      - VLESS Reality
      - Hysteria2
      - Tuic v5
    url: https://www.gstatic.com/generate_204
    interval: 300
    tolerance: 50

By mixing these protocols in your proxy groups, you can achieve a resilient setup that automatically switches to the best available protocol based on your real-time network conditions.