> ## Documentation Index
> Fetch the complete documentation index at: https://e-gurl.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Hysteria2 with Salamander

> QUIC-based proxy with Salamander obfuscation

<Info>
  **New in v6.2.0** - Hysteria2 is a high-performance proxy based on QUIC (HTTP/3) with the Salamander obfuscation layer. It appears as standard HTTP/3 traffic to DPI systems.
</Info>

# Hysteria2 with Salamander Obfuscation

Hysteria2 combines QUIC transport with "Brutal" congestion control for high performance over lossy networks. The Salamander obfuscation layer adds an extra layer of evasion.

## Key Features

1. **HTTP/3 Appearance** - Looks like standard QUIC/HTTP3 traffic
2. **Salamander Obfuscation** - BLAKE2b-based payload obfuscation
3. **Brutal Congestion Control** - Maintains bandwidth despite packet loss
4. **UDP Transport** - Harder to fingerprint than TCP protocols

## Deployment Notes for Iran

<Warning>
  **ISP-Specific Behavior:**

  * **Irancell (MTN)**: Best performance, QUIC generally allowed
  * **Hamrah Aval (MCI)**: Mixed results, QUIC sometimes blocked
  * **Rightel**: Moderate performance

  QUIC may be temporarily blocked during high-censorship periods.
</Warning>

## Configuration

### Server Requirements

You'll need your own Hysteria2 server. Example server configuration:

```yaml theme={null}
# Server config (hysteria2.yaml)
listen: :443

tls:
  cert: /path/to/cert.pem
  key: /path/to/key.pem

auth:
  type: password
  password: YOUR_STRONG_PASSWORD

masquerade:
  type: proxy
  proxy:
    url: https://www.bing.com
    rewriteHost: true
```

### Client Configuration

#### Interactive Mode

```bash theme={null}
dns-mns
# Select: [8] Advanced Evasion Suite
# Then: [5] Hysteria2 Proxy
```

#### CLI Mode

```bash theme={null}
# Basic Hysteria2 connection
dns-mns hysteria2 start \
  --server your-server.com:443 \
  --password YOUR_PASSWORD \
  --sni www.bing.com

# With Salamander obfuscation
dns-mns hysteria2 start \
  --server your-server.com:443 \
  --password YOUR_PASSWORD \
  --obfs-password SALAMANDER_KEY \
  --sni www.microsoft.com
```

### Configuration File

```yaml theme={null}
# ~/.config/dns-mns/hysteria2.yaml
server: your-server.com:443
password: YOUR_PASSWORD
sni: www.microsoft.com
obfs:
  type: salamander
  password: YOUR_OBFS_PASSWORD
bandwidth:
  up: 50m
  down: 100m
```

Load with:

```bash theme={null}
dns-mns hysteria2 start --config ~/.config/dns-mns/hysteria2.yaml
```

## Salamander Obfuscation

### How It Works

```
Original Payload: [DNS Query Data]
        ↓
   [8-byte Salt] + XOR(BLAKE2b(key+salt), payload)
        ↓
Obfuscated Payload: [Salt][Encrypted Data]
```

### Enable Salamander

```bash theme={null}
# With obfuscation password
dns-mns hysteria2 start \
  --server your-server.com:443 \
  --password AUTH_PASSWORD \
  --obfs-password SALAMANDER_SECRET

# URI format
hysteria2://auth@server:443/?obfs=salamander&obfs-password=secret&sni=target.com
```

### Generating Obfuscation Password

```bash theme={null}
# Generate strong obfuscation key
openssl rand -base64 32

# Or use dns-mns
dns-mns generate-password --length 32
```

## Usage Examples

### Basic DNS Proxy

```bash theme={null}
# Start Hysteria2 DNS proxy
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --listen 127.0.0.1:5358

# Use as DNS server
dig @127.0.0.1 -p 5358 google.com
```

### With Masquerade Target

```bash theme={null}
# Use Microsoft as masquerade target (commonly whitelisted)
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --sni www.microsoft.com \
  --masquerade https://www.microsoft.com
```

### Full Evasion Stack

```bash theme={null}
# Hysteria2 + uTLS fingerprint + custom SNI
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --obfs-password salamander123 \
  --sni www.microsoft.com \
  --fingerprint firefox \
  --bandwidth-up 50m \
  --bandwidth-down 100m
```

## Bandwidth Configuration

### Brutal Congestion Control

Hysteria2 uses "Brutal" congestion control that maintains your configured bandwidth regardless of packet loss:

```bash theme={null}
# Set bandwidth limits
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --bandwidth-up 20m \
  --bandwidth-down 100m

# Units: bps, kbps, mbps, gbps
```

### Auto-Discovery

```bash theme={null}
# Let Hysteria2 discover bandwidth
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --bandwidth-auto
```

## Status and Monitoring

### Check Status

```bash theme={null}
# View connection status
dns-mns hysteria2 status

# JSON output
dns-mns hysteria2 status --json

# Output:
# {
#   "connected": true,
#   "server": "vpn.example.com:443",
#   "sni": "www.microsoft.com",
#   "obfuscated": true,
#   "queries": 1523,
#   "successes": 1520,
#   "errors": 3
# }
```

### View Statistics

```bash theme={null}
# Detailed statistics
dns-mns hysteria2 stats

# Reset statistics
dns-mns hysteria2 stats --reset
```

### Logs

```bash theme={null}
# View logs
dns-mns hysteria2 logs

# Follow logs
dns-mns hysteria2 logs --follow

# Debug level
dns-mns hysteria2 logs --level debug
```

## Troubleshooting

### QUIC Blocked

If you see "connection refused" or timeouts:

```bash theme={null}
# Check if QUIC is blocked
nc -v -u vpn.example.com 443

# Try TCP fallback (use ShadowTLS instead)
dns-mns evasion shadowtls start \
  --server vpn.example.com:443 \
  --target www.microsoft.com:443
```

### Authentication Failed

```bash theme={null}
# Verify password
dns-mns hysteria2 test-auth \
  --server vpn.example.com:443 \
  --password secret123

# Check server logs for auth errors
```

### Slow Performance

```bash theme={null}
# Check current bandwidth
dns-mns hysteria2 stats

# Adjust bandwidth settings
dns-mns hysteria2 config set bandwidth.up 50m
dns-mns hysteria2 config set bandwidth.down 100m

# Restart with new settings
dns-mns hysteria2 restart
```

### Frequent Disconnections

```bash theme={null}
# Enable keepalive
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --keepalive 10s

# Increase timeout
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --timeout 60s
```

## ISP-Specific Tips

### Irancell (MTN)

Best performance. Use default settings:

```bash theme={null}
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --obfs-password salamander
```

### Hamrah Aval (MCI)

QUIC may be blocked. Test first:

```bash theme={null}
# Test QUIC connectivity
dns-mns test-quic vpn.example.com:443

# If blocked, use ShadowTLS instead
dns-mns evasion shadowtls start ...
```

### Rightel

Moderate performance. Use masquerade:

```bash theme={null}
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --sni www.microsoft.com \
  --masquerade https://www.microsoft.com
```

## Comparison with Other Protocols

| Feature         | Hysteria2  | VLESS+REALITY | ShadowTLS            | AmneziaWG     |
| --------------- | ---------- | ------------- | -------------------- | ------------- |
| **Protocol**    | QUIC/HTTP3 | TCP/TLS       | TCP/TLS              | UDP/WireGuard |
| **Speed**       | ⭐⭐⭐⭐⭐      | ⭐⭐⭐⭐⭐         | ⭐⭐⭐⭐☆                | ⭐⭐⭐⭐☆         |
| **Stealth**     | ⭐⭐⭐⭐☆      | ⭐⭐⭐⭐☆         | ⭐⭐⭐⭐⭐                | ⭐⭐⭐⭐☆         |
| **UDP Support** | ✅ Native   | ✅ Yes         | ❌ No                 | ✅ Native      |
| **Obfuscation** | Salamander | XTLS Vision   | Certificate Stealing | Junk Packets  |
| **Best For**    | Speed      | Reliability   | Maximum Stealth      | UDP Apps      |

## Advanced Configuration

### Custom QUIC Settings

```yaml theme={null}
# Advanced config
quic:
  maxIdleTimeout: 60s
  handshakeTimeout: 10s
  maxIncomingStreams: 100

obfs:
  type: salamander
  password: SECRET_PASSWORD

bandwidth:
  up: 50m
  down: 100m
```

### Load Balancing

```bash theme={null}
# Multiple servers
dns-mns hysteria2 start \
  --servers server1:443,server2:443 \
  --password secret123 \
  --strategy round-robin
```

### Failover

```bash theme={null}
# Automatic failover
dns-mns hysteria2 start \
  --primary server1:443 \
  --backup server2:443 \
  --password secret123 \
  --failover-timeout 30s
```

## Security Considerations

### Password Strength

```bash theme={null}
# Generate strong password
openssl rand -base64 32

# Minimum recommended: 16 characters
# Ideal: 32+ random characters
```

### Certificate Verification

```bash theme={null}
# Pin certificate hash
dns-mns hysteria2 start \
  --server vpn.example.com:443 \
  --password secret123 \
  --pin-sha256 "SHA256_HASH"
```

## References

* [Hysteria2 Documentation](https://v2.hysteria.network/)
* [QUIC Protocol](https://datatracker.ietf.org/doc/html/rfc9000)
* [HTTP/3](https://datatracker.ietf.org/doc/html/rfc9114)
* [BLAKE2b](https://www.blake2.net/)

***

<Note>
  Hysteria2 works best on Irancell (MTN). If you're on Hamrah Aval (MCI) and QUIC is blocked, consider using ShadowTLS or VLESS+REALITY instead.
</Note>