Mechanisms & choices

Cover, Vision, transport.

Three mechanisms, one self-hosted pair. Umbra is a client and server you administer; no domain, no CA certificate, no managed service.

TLS 1.3 / QUIC01 — 03

umbra

Your device

Open internet

Private transport

Unauthenticated → real site

Your traffic uses the authenticated path; other requests go to the real site.

Route through a real destination

Unauthenticated requests are forwarded to a reachable real TLS 1.3 site. No domain or CA certificate for your node; identity keys and a temporary binding are enough.

Splice with Vision after authentication

Once authenticated, Vision removes redundant outer encryption for eligible inner TLS 1.3 traffic, leaving application HTTPS as the only TLS layer the observer sees.

Carry TCP and QUIC behind one SOCKS5

A single local SOCKS5 carries TCP and QUIC. Adaptive mux and BBR share the path; transport selection is explicit, not automatic failover.

How to choose among mainstream options

Umbra and Xray are software platforms; VLESS, VMess, Trojan and Shadowsocks are protocols, while REALITY and Vision are mechanisms. Implementation and configuration determine behavior. Umbra is worth choosing when you want cover, both transport paths and SOCKS5 shipped as one configured pair you administer; the others win when you need their ecosystems.

Umbra

A self-written TLS 1.3 stack and from-scratch Rust implementation: real-site cover, Vision splice, TCP + QUIC behind one SOCKS5, post-quantum handshake, probe resistance.

Strengths

Self-written TLS 1.3 stack, byte-level Chrome fingerprint
Vision true splice eliminates TLS-in-TLS
TCP and QUIC behind one SOCKS5, adaptive mux + BBR
Post-quantum (X25519MLKEM768 + ML-DSA-65) built into handshake
Probe resistance by design, timing-aligned paths
Complete self-owned stack from cryptography to transport, no third-party TLS library

Trade-offs

Alpha software and CLI only today; purpose-built protocol not compatible with legacy node formats.
Protocol changes between releases mean upgrading both endpoints together.

Xray + VLESS + REALITY

The closest alternative: REALITY and Vision are available here too, so the choice is about packaging and workflow, not exclusive technology.

Strengths

Mature multiprotocol platform with rich routing, many ready-made clients and extensive community documentation.

Trade-offs

You assemble and maintain the stack yourself: core config, transports, routing rules and matching clients.
Shared mechanisms do not make it interoperable with Umbra.

VMess

An AEAD proxy protocol worth considering when your clients already support it. TLS and WebSocket are additional deployment choices, not prerequisites for encryption.

Strengths

Very wide client support across platforms, including older and low-power devices.

Trade-offs

The protocol encrypts but does not camouflage: cover depends entirely on the transport you add on top.
Legacy non-AEAD modes are deprecated; pin clients that implement AEAD.

Trojan

A TLS-based proxy protocol for those who prefer a conventional TLS deployment; fallback behavior depends on the implementation and configuration.

Strengths

Real TLS handshake with documented fallback behavior and a design that has been stable for years.

Trade-offs

Typical setups maintain a domain and renew a publicly trusted certificate.
UDP rides inside TLS over TCP, so UDP timing follows the TCP path.

Shadowsocks

A lightweight encrypted proxy for simpler deployments; browser impersonation and real-site cover are not built into the base AEAD or 2022 protocols.

Strengths

Minimal moving parts: keys and a matching client, no domain or certificate required.

Trade-offs

Base protocols provide encryption, not camouflage; assess plugins separately if you need cover.
A TCP-only SIP003 plugin must not be treated as UDP camouflage.

Hysteria 2

A QUIC-focused solution with its own congestion-control design; consider it where UDP is reliably reachable.

Strengths

Unreliable datagram UDP path designed for lossy networks, with congestion control tuned for harsh conditions.

Trade-offs

Blocked or restricted UDP removes its main advantage, and its design is not a guarantee of speed on your network.
TCP still travels as QUIC streams, so loss can stall streams like any reliable transport.

Documentation