A personal VPN — one always-on server at home, an iPhone and a Linux laptop as clients — built for a network that filters DNS, firewalls outbound traffic, and blocks WireGuard outright.
WireGuard alone does not survive that, and the reason is worth stating precisely: every handshake initiation opens with the byte 0x01 followed by three zero bytes, in a packet that is always exactly 148 bytes long. One deep-packet-inspection rule catches that on any port, which is why moving it to 443 changes nothing — the giveaway is the content, not the port.
So three transports are installed, and it falls back between them. WireGuard itself is fastest and hides nothing. AmneziaWG keeps the same cryptography and the same speed while randomising those four fixed header bytes per deployment and padding the handshake with junk, so the size signature dies too. VLESS with REALITY proxies a genuine TLS handshake to a real public site, so a middlebox sees that site's real certificate with a valid chain and an active probe is handed the real site — at the cost of TCP's lower throughput and head-of-line blocking on lossy links.
Bringing it up tries them fastest-first and remembers what worked, and a doctor command probes all three and reports what the network is actually blocking rather than what it was assumed to block. DNS filtering is handled by construction instead of by rule: clients resolve through an address that exists only inside the tunnel, answered by dnsmasq at the house, so the local resolver never sees a query.