What is Hysteria2 and why it stays fast on bad networks

Hysteria2 is a proxy protocol that runs over QUIC, which means over UDP. It is developed by the open-source apernet project. Its main idea is to keep speeds high where ordinary TCP connections struggle: mobile networks, crowded Wi-Fi and long international routes that lose packets.

#How it works

QUIC is the transport HTTP/3 runs on. Encryption is built in: the handshake is TLS 1.3, and everything after it is encrypted. Hysteria2 uses this as follows:

1. The client opens a QUIC connection to the server and checks its TLS certificate, just like a browser.
2. Inside the connection the client sends an HTTP/3-style request with a password. Without the right password the server behaves like an ordinary web server.
3. Once authenticated, your TCP streams and UDP packets travel over the same connection.

To an outside observer it looks like HTTP/3 traffic to a website with a valid certificate.

#Why it is faster on lossy networks

TCP treats a lost packet as a sign of congestion and slows down sharply. On a mobile network, where packets are lost because of the radio link rather than congestion, this causes a saw-tooth speed pattern and slow recovery.

Hysteria2 has its own congestion control (Brutal): the client states the bandwidth it expects and the server keeps that pace, compensating for loss by retransmitting rather than slowing down. QUIC also avoids head-of-line blocking: one lost packet does not stall the other streams in the connection.

In practice you notice it on trains, in the underground, on rural 4G and on routes between continents.

#Limitations

• UDP may be restricted. Some corporate, hotel and mobile networks block or throttle UDP. Hysteria2 then fails to connect or runs slowly.
• Network fairness. Aggressive congestion control is good for you but can crowd out other devices on a very weak link.
• Not invisible to every filter. Some filtering systems inspect QUIC traffic to unknown addresses separately.

#How Colitu uses it

On every Colitu server Hysteria2 runs with an ACME-issued certificate on the same domain name as the other protocols. The app tries it first on unstable networks. If UDP is blocked or the connection fails, the app moves to the TCP protocols, VLESS Reality or Trojan, without any action from you.

You do not have to configure anything: choosing the protocol is the app's job. The servers page shows which protocols each server supports, and the security page has the technical details.

#In short