Protocols

Choosing the right protocol

Most users should leave the protocol on auto. This page is for the cases where you want to override.

The short answer

Fexyn Bolt (WireGuard) — your default. Fastest, lowest CPU. Use unless your network actively blocks VPNs.
Fexyn Stealth (VLESS Reality / XRay) — when your network filters VPNs. Looks like an ordinary HTTPS visit to a real public site.
Fexyn Secure (OpenVPN) — last resort when WireGuard and Stealth both fail. TCP/443 fallback for the most locked-down networks.

Auto-rotation tries them in order and switches if one fails. You don't need to think about it unless you're troubleshooting.

When to use Fexyn Bolt

Default. Use it on:

Home Wi-Fi (most ISPs)
Office networks that don't actively filter VPNs
Most café and hotel Wi-Fi
Mobile data on most carriers

Bolt is also the right pick for streaming and gaming where latency matters. Lowest overhead of the three.

Why WireGuard is fast

When to use Fexyn Stealth

Pin Stealth as the default if you're on a network that filters VPNs by signature:

Connecting from inside Turkey, Russia, Iran, China, or the UAE
Restrictive corporate or campus Wi-Fi that blocks outbound UDP or recognises VPN protocol patterns
Some hotel networks that throttle anything identified as a VPN
Mobile carriers that throttle VPN traffic during peak hours

Stealth establishes a real TLS 1.3 handshake to a real public website. To DPI watching the wire, your traffic looks indistinguishable from normal HTTPS to that site. The cost is some throughput overhead — typically 10–20% — and slightly higher CPU on connect.

When to use Fexyn Secure

Last resort. Use it when:

Both Bolt and Stealth fail to connect
The network only allows TCP/443 outbound (some hotel and conference networks)
You're on legacy infrastructure that needs wider compatibility

Secure runs OpenVPN over TCP/443, which connects on the most restrictive networks. The trade-off is the slowest of the three: TCP fallback adds head-of-line blocking when packets are lost, and OpenVPN's control channel is heavier than WireGuard's. Throughput cost can reach 30%+ on a high-loss connection.

How auto-rotation works

The Fexyn app tries protocols in this default order when set to auto:

Bolt — first attempt
Stealth — if Bolt fails to connect within the timeout
Secure — if Stealth also fails

The order is configurable in settings. If you're somewhere VPN-hostile, set Stealth first; if you're on legacy infrastructure where OpenVPN is the only protocol that consistently works, set Secure first.

Auto-rotation rechecks periodically. If Bolt becomes available again after a Stealth fallback, the next connect cycle will try Bolt first.

How to change the protocol in the app

Open the Fexyn app.
Open Settings.
Find Protocol.
Choose Auto, Bolt, Stealth, or Secure. Auto is recommended unless you have a specific reason.
Reconnect.