Hysteria. How the service works

The Hysteria module in the BeAdmin panel runs a VPN on the Hysteria2 protocol. It is built on QUIC — the transport behind HTTP/3, which runs over UDP. The protocol is designed for connections that lose packets, where TCP tunnels slow down, and to an outside observer the server looks like an ordinary HTTP/3 site.

The problem Hysteria solves

The first problem is an unstable connection. On mobile networks, congested Wi-Fi, and long international routes, some packets are lost along the way. TCP reads a lost packet as a sign of congestion and slows down, so VPNs built on TCP are noticeably sluggish on such links. Hysteria2 is built on a modified QUIC designed for unreliable links and keeps its speed where TCP-based protocols slow down. On a clean, stable connection the gain is less noticeable.

The second problem is blocking by traffic pattern. Some networks recognise and cut "familiar" VPN protocols. Hysteria2 disguises itself as HTTP/3 — the traffic that browsers and large sites generate today — so it doesn't look like a classic VPN.

How Hysteria masks the traffic

The masking has several parts.

The look of an HTTP/3 site. By default Hysteria listens on UDP port 443, the port HTTP/3 uses, and its traffic resembles a QUIC connection to an ordinary website. Only a client with a user's personal link can connect. If a stranger's HTTP/3 request reaches the server — a port check, say — it gets a static maintenance page instead of a VPN, as on a site where work is under way. This page is shown as long as obfuscation is off.

Obfuscation. For networks that block QUIC and HTTP/3 themselves, the module settings have an Obfuscation switch. It is off by default. Once it is on, Hysteria makes every packet look like random bytes (the Salamander algorithm), and no QUIC or HTTP/3 signature is left in the traffic. The price is that the server no longer looks like an HTTP/3 site, and the maintenance page is gone. So turn obfuscation on only if the connection won't go through without it. Turning it on or off changes users' links, and they have to be handed out again — more in Hysteria. Managing the module.

Certificate. The connection is protected by TLS, like an ordinary HTTPS site, so the server needs a certificate. The panel picks the certificate mode when the module is installed for the first time:

• Let's Encrypt on server IP — if the panel already has a Let's Encrypt certificate for the server's IP address, Hysteria uses it. Apps trust such a certificate right away, and when it is renewed, the panel updates it in Hysteria automatically.
• Self-signed — if there is no such certificate, the panel creates a self-signed one on the server. Apps can't check it against a chain of trust, so the user's link carries the certificate's fingerprint, which the app uses to verify the server.

The mode is fixed at the first install and shown in the module settings. A reinstall keeps it; the only way to change it is to uninstall the module and install it again — and then users and issued links are lost.

How the user link works

For each user the panel issues a hysteria2://… link and a QR code with the same link. The link holds the user's password, the server address and port, and, where they apply, the obfuscation parameters and the certificate fingerprint (in self-signed mode). The link doesn't change until you change the port or obfuscation: a given user always has the same one. So there is no need to reissue it: the Refresh button in the panel only requests the same link again and doesn't change the password. To revoke access, disable or delete the user.

The link contains the user's password, so treat it like a password: anyone who gets hold of it can connect.

What Hysteria cannot do

It is worth stating plainly what Hysteria does not promise — common expectations that this protocol doesn't meet.

• It doesn't work where UDP is blocked. Hysteria uses UDP only. If the network doesn't let UDP through at all, the connection won't be established, and obfuscation won't help. On such networks use Xray or Mimicry — they run over TCP, on port 443 by default.
• It doesn't work with ordinary VPN clients. You need an app that supports Hysteria2 — Hiddify, v2rayN, or Streisand. The built-in VPN client of iOS or Android and a familiar WireGuard client won't do. More in Hysteria. Setting up client apps.
• It doesn't promise invisibility. Masking as HTTP/3 and obfuscation make the traffic harder to recognise, but they don't make the tunnel undetectable: under persistent traffic analysis it can be found. If an operator blocks the server's IP address outright, no masking helps.
• It is not Tor or anonymity routing. The masking hides the VPN from the ISP, but the destination site still sees your server's IP address.
• There is no multi-hop mode. Hysteria runs on a single server. An entry → exit chain of two servers can be built on Xray or Amnezia.
• It doesn't make VPN legal. If VPN usage is restricted or prohibited in your jurisdiction, masking doesn't change that. This is a technical tool, not a legal workaround.

Hysteria in BeAdmin

The Hysteria module in BeAdmin installs with almost no setup: on install the panel picks a UDP port — 443 if it is free, otherwise 2053 — and creates the certificate and the service keys. You can also set the port by hand in the custom installation dialog. There is no need to edit configuration files or work in the command line. The port and obfuscation can be changed later, right in the module settings.

Once installed, you can add users straight away. For each user the panel builds a ready connection link and a QR code — an app with Hysteria2 support accepts them with no manual setup. Changes to the user list take effect right away, without a service restart. The module page shows how much traffic each user has used and how many of their devices are connected right now.

One Hysteria user is free; for more, you buy licence slots.

When to choose Hysteria

Choose Hysteria when:

• Your users connect over unstable links with packet loss — mobile internet, congested Wi-Fi, long routes — where TCP-based protocols are sluggish.
• The network lets UDP through, but plain WireGuard gets recognised and cut. Hysteria looks like an HTTP/3 site, and if the provider blocks QUIC as well, turning on obfuscation is enough.
• Your users are willing to install an app with Hysteria2 support — Hiddify, v2rayN, or Streisand.

Hysteria is not a good fit when:

• The network blocks UDP or only lets TCP through — a corporate proxy or hotel Wi-Fi, for example. Pick Xray or Mimicry: they run over TCP, on port 443 by default.
• You need multi-hop — a chain of two servers. Pick Xray or Amnezia.
• Your users are used to native WireGuard clients and will not install an extra app. Pick WireGuard or Amnezia.

If in doubt — install Hysteria in BeAdmin and try it for free.

If you don't have a server yet, you can get one from our partners — they offer virtual and dedicated servers with the BeAdmin panel pre‑installed.

Proven over 15 years in hosting. Your VPS with BeAdmin is ready to go out of the box.

• Germany
• Netherlands
• Sweden
• Switzerland
• Spain
• USA

Select server

European reliability made simple. Launch BeAdmin with your VPS in just one click.

• Germany
• Netherlands
• Sweden
• Estonia
• Romania
• Switzerland
• Spain
• United Kingdom
• USA

Sign up

What's next

• Hysteria quick start — installing the module and the first connection.
• Hysteria. Managing the module — managing the service, changing the port, obfuscation, updates.
• Hysteria. Managing users — issuing and revoking connections, temporarily disabling a user without changing the link.
• Hysteria. Setting up client apps — which app to install on each platform.