What is Hysteria?

Hysteria 2 is an MIT-licensed proxy written in Go that comes as a single executable serving both server and client roles, so you can host your own egress on any VPS or, with Hysteria Realms, behind NAT using UDP hole punching with no port forwarding. Its transport is a customized QUIC stack that picks among the Brutal, BBR and Reno congestion controllers, and it disguises itself as ordinary HTTP/3 traffic, optionally serving real web content through file, reverse-proxy or string masquerade modes. On the client side it offers SOCKS5 and HTTP proxy listeners, TCP and UDP port forwarding, Linux TProxy and REDIRECT, plus a cross-platform TUN mode. The server supports password, username/password, external HTTP or command authentication, ACL rule files with GeoIP/GeoSite matching, and direct, SOCKS5 or HTTP upstream outbounds; operators can watch per-client traffic or disconnect users through an HTTP traffic-stats API, and TLS certificates can be issued automatically via ACME. To run it you either download a binary, use the get.hy2.sh systemd deployment script for Linux, install the Arch AUR package or the published Docker image. Version 2 is not wire-compatible with the legacy Hysteria 1.x, client-side ACL and FakeTCP are still missing, and the project is donation-funded: it sells no proxies or VPN service.

Should you self-host Hysteria?

Hysteria scores 74/100 on selfhost.directory (how scoring works) and ranks #2 of 25 in Proxy. It has 22 764 GitHub stars.

It shipped 3 stable releases in the past year. The latest, app/v2.13.0, came out on 5 October 2026. New versions land roughly every 3 weeks.

Setup is easy: most people get it running in one sitting. An official Docker image is available. It is MIT-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is frp (85/100, 110 238 stars). It scores higher overall, so compare the two before you pick. See Hysteria vs frp side by side.

Features

Access control listsClient-side ACL is not implemented yet.
Automatic TLS certificates via ACME
Built-in speed test
Censorship-resistant HTTP/3 masquerade
Client authentication
Encrypted Client Hello (ECH)
High-performance QUIC transport with bandwidth-based congestion control
Multiple proxy modes (SOCKS5, HTTP, forwarding, TProxy, TUN)TProxy/REDIRECT are Linux only; FreeBSD is not supported for TUN.
Obfuscation and fake-TCP disguisemimic requires a separate kernel module on Linux.
P2P NAT traversal (Hysteria Realms)
Port hopping
Traffic statistics and client-kick API
Upstream and direct outbounds

How to configure Hysteria

aclServer-side access control list, given as a rule file or inline rules, with optional geoip/geosite databases.
Server-side access control list, given as a rule file or inline rules, with optional geoip/geosite databases.
acmeAutomatically obtain TLS certificates via ACME for the listed domains.
Automatically obtain TLS certificates via ACME for the listed domains.
ARCHITECTUREInstallation-script variable: architecture of the binary to install, mainly for the AVX build.
Installation-script variable: architecture of the binary to install, mainly for the AVX build.
authClient authentication settings.
Client authentication settings.
values: password | userpass | http | command
bandwidthBandwidth figures that enable Brutal congestion control for a direction.
Bandwidth figures that enable Brutal congestion control for a direction.
congestionbbrSelect the non-Brutal congestion controller and profile.
Select the non-Brutal congestion controller and profile.
values: bbr | reno
disableUDPfalseDisable UDP forwarding, only allowing TCP connections.
Disable UDP forwarding, only allowing TCP connections.
forceHTTPSfalseServer: redirect all HTTP requests to HTTPS.
Server: redirect all HTTP requests to HTTPS.
geoipPath to the GeoIP database; if omitted Hysteria downloads the latest one automatically.
Path to the GeoIP database; if omitted Hysteria downloads the latest one automatically.
geositePath to the GeoSite database; if omitted Hysteria downloads the latest one automatically.
Path to the GeoSite database; if omitted Hysteria downloads the latest one automatically.
geoUpdateInterval168hRefresh interval for automatically downloaded GeoIP/GeoSite databases.
Refresh interval for automatically downloaded GeoIP/GeoSite databases.
hopInterval30sClient: fixed port-hopping interval.
Client: fixed port-hopping interval.
httpClient: HTTP proxy listener with optional Basic-auth username, password and realm.
Client: HTTP proxy listener with optional Basic-auth username, password and realm.
HYSTERIA_ACME_DIRThe directory to store ACME certificates in. If specified in the config file, this value will be ignored.
The directory to store ACME certificates in. If specified in the config file, this value will be ignored.
values: TLS
HYSTERIA_BBR_DEBUGSet to 1 to print BBR debug information. Only applies when using BBR as the congestion control algorithm.
Set to 1 to print BBR debug information. Only applies when using BBR as the congestion control algorithm.
values: Logging
HYSTERIA_BRUTAL_DEBUGSet to 1 to print information such as current RTT, packet loss, MTU, etc. every 2 seconds. Only applies when using Brutal as the congestion control algorithm.
Set to 1 to print information such as current RTT, packet loss, MTU, etc. every 2 seconds. Only applies when using Brutal as the congestion control algorithm.
values: Logging
HYSTERIA_DISABLE_UPDATE_CHECKSet to 1 to disable version update checks.
Set to 1 to disable version update checks.
values: Update
HYSTERIA_FIREWALL_BACKENDForce the firewall backend for server port-range listening. nftables (or nft) to use nftables, iptables (or ipt) to use iptables. Unset for auto-detect.
Force the firewall backend for server port-range listening. nftables (or nft) to use nftables, iptables (or ipt) to use iptables. Unset for auto-detect.
values: Server
HYSTERIA_LOG_FORMATLog format (console [default], json)
Log format (console [default], json)
values: Logging
HYSTERIA_LOG_LEVELLog level (debug, info [default], warn, error)
Log level (debug, info [default], warn, error)
values: Logging
HYSTERIA_UDPHOP_DEBUGSet to 1 to print UDP port hopping debug information (hop events, local/remote address changes).
Set to 1 to print UDP port hopping debug information (hop events, local/remote address changes).
values: Logging
HYSTERIA_USERhysteriaInstallation-script variable: user the Hysteria systemd service runs as.
Installation-script variable: user the Hysteria systemd service runs as.
ignoreClientBandwidthfalseMake the server disregard bandwidth hints set by clients and use its configured non-Brutal controller instead.
Make the server disregard bandwidth hints set by clients and use its configured non-Brutal controller instead.
listen:443Server listen address; defaults to :443 on all interfaces, accepts port ranges for port hopping or a realm:// URI for Realms mode.
Server listen address; defaults to :443 on all interfaces, accepts port ranges for port hopping or a realm:// URI for Realms mode.
listenHTTPServer: extra TCP HTTP listen address for HTTP/HTTPS masquerading.
Server: extra TCP HTTP listen address for HTTP/HTTPS masquerading.
listenHTTPSServer: extra TCP HTTPS listen address for HTTP/HTTPS masquerading.
Server: extra TCP HTTPS listen address for HTTP/HTTPS masquerading.
masqueradeServe HTTP content so the server looks like a real web server.
Serve HTTP content so the server looks like a real web server.
values: file | proxy | string
obfsObfuscation layer for networks that block QUIC/HTTP-3.
Obfuscation layer for networks that block QUIC/HTTP-3.
values: salamander | gecko
outboundsNamed upstreams connections can be routed through (direct, socks5, http).
Named upstreams connections can be routed through (direct, socks5, http).
values: direct | socks5 | http
quicQUIC transport tuning parameters (receive windows, idle timeout, max streams, MTU discovery, stateless resets).
QUIC transport tuning parameters (receive windows, idle timeout, max streams, MTU discovery, stateless resets).
QUIC_GO_DISABLE_ECNSet to 1 to disable ECN (Explicit Congestion Notification) in quic-go. May solve compatibility issues on some systems.
Set to 1 to disable ECN (Explicit Congestion Notification) in quic-go. May solve compatibility issues on some systems.
values: QUIC
QUIC_GO_DISABLE_GSOSet to 1 to disable GSO (Generic Segmentation Offload) in quic-go. May solve compatibility issues on some systems.
Set to 1 to disable GSO (Generic Segmentation Offload) in quic-go. May solve compatibility issues on some systems.
values: QUIC
realmTuning for Hysteria Realms P2P mode (STUN servers, timeouts, heartbeat, ipMode, port mapping).
Tuning for Hysteria Realms P2P mode (STUN servers, timeouts, heartbeat, ipMode, port mapping).
serverClient: address of the Hysteria server (or a hysteria2:// URI).
Client: address of the Hysteria server (or a hysteria2:// URI).
sniffProtocol sniffing to recover destination domains from HTTP, TLS and QUIC traffic.
Protocol sniffing to recover destination domains from HTTP, TLS and QUIC traffic.
socks5Client: SOCKS5 proxy listener, with optional username/password and disableUDP.
Client: SOCKS5 proxy listener, with optional username/password and disableUDP.
speedTestfalseEnable the built-in speed test server.
Enable the built-in speed test server.
tcpForwardingClient: forward one or more TCP ports from the server to the client.
Client: forward one or more TCP ports from the server to the client.
tcpRedirectClient: legacy REDIRECT-based transparent TCP proxy listener (Linux only).
Client: legacy REDIRECT-based transparent TCP proxy listener (Linux only).
tcpTProxyClient: transparent TCP proxy listener (Linux only).
Client: transparent TCP proxy listener (Linux only).
tlsTLS certificate and key (server) or CA / insecure / pinSHA256 verification options (client).
TLS certificate and key (server) or CA / insecure / pinSHA256 verification options (client).
trafficStatsExpose the traffic statistics and kick HTTP API, optionally protected by a secret.
Expose the traffic statistics and kick HTTP API, optionally protected by a secret.
transportClient: transport choice and parameters, e.g. UDP port-hopping interval.
Client: transport choice and parameters, e.g. UDP port-hopping interval.
tunClient: create a virtual TUN interface and route traffic through it (Windows, Linux, macOS).
Client: create a virtual TUN interface and route traffic through it (Windows, Linux, macOS).
udpForwardingClient: forward one or more UDP ports from the server (or any remote host) to the client.
Client: forward one or more UDP ports from the server (or any remote host) to the client.
udpIdleTimeout60sHow long the server keeps a local UDP port open for an idle UDP session.
How long the server keeps a local UDP port open for an idle UDP session.
udpTProxyClient: transparent UDP proxy listener (Linux only).
Client: transparent UDP proxy listener (Linux only).