Abstract streaks of purple and green light

Hysteria2 is a proxy tool based on the QUIC protocol (UDP) that significantly outperforms TCP in high-loss and high-latency networks. It complements VLESS+XTLS-Reality: use Hysteria2 when TCP is throttled, and VLESS+Reality when UDP is blocked—deploying both protocols together is currently the most stable approach.

Why Choose Hysteria2

Core advantages:

  • QUIC/UDP-based, maintains good speed even in high-loss networks
  • Built-in bandwidth obfuscation makes traffic patterns harder to identify precisely
  • Simple configuration, lighter weight than Xray
  • Native support in mihomo (Clash Meta)

Use cases:

ScenarioRecommended Protocol
TCP throttled by QoSHysteria2 ✓
UDP blockedVLESS+XTLS
Daily use (both available)mihomo auto-switch

Prerequisites

  • An overseas VPS; DMIT is recommended (supports Hysteria2 UDP traffic)
  • Ubuntu 22.04+
  • A domain (optional—self-signed certificates work fine)

Server Deployment

Install Hysteria2

bash <(curl -fsSL https://get.hy2.sh/)

After installation, the binary is at /usr/local/bin/hysteria and the systemd service is named hysteria-server.

Generate Self-Signed Certificate

If you don’t have a domain, use a self-signed certificate:

openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
  -keyout /etc/hysteria/server.key \
  -out /etc/hysteria/server.crt \
  -subj "/CN=bing.com" -days 3650
chown hysteria /etc/hysteria/server.key /etc/hysteria/server.crt

Server Configuration File

/etc/hysteria/config.yaml:

listen: :443

tls:
  cert: /etc/hysteria/server.crt
  key: /etc/hysteria/server.key

auth:
  type: password
  password: your_password_here (long random string)

masquerade:
  type: proxy
  proxy:
    url: https://bing.com
    rewriteHost: true

bandwidth:
  up: 1 gbps
  down: 1 gbps

Key parameters:

  • masquerade: disguises traffic as normal access to the target website
  • bandwidth: set to your server’s actual bandwidth; this affects congestion control and shouldn’t exceed actual capacity

Start the service:

systemctl enable hysteria-server --now
systemctl status hysteria-server

Open Firewall Port

ufw allow 443/udp

Note: Hysteria2 uses UDP, so you must open UDP ports—this is easy to miss.

Verify Server

# Check if the service is running normally
journalctl -u hysteria-server -f

# You should see output like:
# server up and running

Client Configuration (mihomo)

Add this to your mihomo proxy configuration:

proxies:
  - name: "DMIT-HK-Hysteria2"
    type: hysteria2
    server: your_VPS_IP
    port: 443
    password: your_password
    sni: bing.com
    skip-cert-verify: true   # required when using self-signed certificates

Dual Protocol Redundancy: Pairing with VLESS+Reality

A single protocol is a single point of failure. We recommend deploying both Hysteria2 and VLESS+XTLS-Reality together and configuring auto-switching in mihomo:

proxy-groups:
  - name: "Hong Kong"
    type: fallback
    url: http://www.gstatic.com/generate_204
    interval: 30
    proxies:
      - DMIT-HK-Reality     # primary (TCP, anti-detection)
      - DMIT-HK-Hysteria2   # fallback (UDP, high speed)

mihomo checks connectivity every 30 seconds and automatically switches to the backup if the primary is unreachable.

For a complete multi-gateway architecture design, see: Home Network Multi-Gateway Architecture

FAQ

UDP Blocked by ISP

Some regions’ ISPs throttle UDP traffic. You can change the Hysteria2 port to something else, or switch to VLESS+Reality (TCP) in this scenario.

Speed Slower Than Expected

  1. Check if bandwidth is set close to your actual bandwidth
  2. Confirm the client also has up/down configured (some mihomo versions auto-negotiate)
  3. Verify your VPS doesn’t have traffic throttling policies

Certificate Errors

skip-cert-verify: true is only for self-signed certificate scenarios. If you have a domain, it’s recommended to use ACME to automatically obtain a Let’s Encrypt certificate for better security.

VPS Recommendations

Hysteria2 relies on UDP, so be aware that some VPS providers impose additional restrictions on UDP traffic.

DMIT Hong Kong and US nodes are UDP-friendly—we’ve tested Hysteria2 fully utilizing available bandwidth. For specific purchasing comparisons, see: VPS Selection Guide

Questions about configuration? Feel free to reach out on Telegram.

Further reading:

📷 Cover image · Generated by Flux Schnell AI · panshi.io brand style