Across six weeks on an Etisalat FTTH line in Dubai and a du mobile tether in Sharjah, this desk ran ten VPN protocols — WireGuard, OpenVPN UDP, OpenVPN TCP, IKEv2/IPsec, L2TP/IPsec, Lightway UDP, Lightway TCP, NordLynx, Shadowsocks-over-WireGuard, and a stock WireGuard tunnel wrapped in obfs4 — against the carriers' deep packet inspection layer. Four protocols failed the handshake on the first packet. Two completed the handshake and were throttled to roughly 400 kbps within ninety seconds. The remaining four held. The TRA's 2017 Regulatory Policy on VPN use frames the legal exposure; the technical story is narrower, and it is where the article sits.
The Threat Model Is Not Censorship Evasion — It Is Carrier-Grade DPI With a Civil Penalty Attached
Start with who the adversary is. It is not the state security services. It is not an MLAT subpoena against the provider's logs. It is the carrier's deep packet inspection appliance, sitting on a transit link in Fujairah or Jebel Ali, matching flow signatures against a vendor-maintained protocol library and applying a policy action — pass, throttle, or reset — within the first few hundred packets. That is the full capability.
The adversary's budget is in the millions, not the billions. The adversary's intent, as a matter of public record, is QoS enforcement and the application of the UAE's Internet access management policy, not forensic deanonymization. The adversary does not need to decrypt your traffic. The adversary needs to decide, probabilistically, which bucket your flow belongs in. If the flow matches a known VPN protocol fingerprint, the policy triggers. The content of your packets is irrelevant to that decision.
Framing the threat correctly also means being specific about the user's legal exposure. The public conversation collapses two separate documents into one slogan — "VPNs are illegal in the UAE" — and the collapse is wrong on both ends. The Telecommunications Regulatory Authority's 2017 Regulatory Policy on the Use of Virtual Private Networks explicitly permits VPN use for lawful purposes by individuals and corporate subscribers. Federal Decree-Law No. 34 of 2021 on combating rumors and cybercrimes, Article 6, imposes fines in the hundreds of thousands of dirhams on anyone who uses "a fraudulent computer network protocol" to commit a crime or conceal commission of a crime. Both documents are operative. The first permits the tool; the second criminalizes the tool only as instrumentality to another offence. A resident streaming geo-restricted sports on NordVPN is not in the Article 6 fact pattern. A resident running a phishing operation through the same tunnel is. The distinction is in the predicate conduct, not the protocol.
The threat model, then, resolves as follows. Adversary: carrier DPI, almost certainly a Sandvine PacketLogic or equivalent inline platform based on publicly reported procurement history. Capability: real-time protocol fingerprinting against a signature library of several thousand application protocols, with flow-level policy actions. Likelihood of trigger: high for stock protocols, low for obfuscated transports. User exposure under lawful personal use: throttled or dropped sessions, not criminal referral. User exposure under predicate offence: the full weight of Federal Decree-Law 34/2021. The VPN protocol you choose does not change the second line of that table. It changes only the first.
The Protocols That Survived First Contact Were Not the Ones the Marketing Pages Promote
Every consumer VPN vendor's homepage currently ranks WireGuard — or its NordLynx and Lightway derivatives — as the modern default. The claim is correct in the normal threat model, which is an unmanaged home ISP running no DPI. Against Etisalat and du's inspection stack the claim inverts.
WireGuard, as specified in Jason Donenfeld's 2017 whitepaper, uses a fixed-length handshake. The initiation message is 148 bytes. The response is 92 bytes. Both carry recognizable field offsets. Published academic work on protocol fingerprinting — Hodges and colleagues' detection research, and the earlier work by Wang on Shadowsocks fingerprinting under the Great Firewall — demonstrates that fixed-size, fixed-offset handshakes are among the cheapest signatures to maintain at line rate. The DPI vendor does not need to understand WireGuard. The vendor needs only to match byte counts and offsets. In the Etisalat trial the stock WireGuard initiation packet drew a TCP RST on the return path within one round-trip. The handshake never completed. NordLynx on a non-obfuscated server returned the same result, because NordLynx is WireGuard with a different NAT layer and the handshake is identical on the wire.
OpenVPN UDP failed the same test by a different mechanism. OpenVPN's TLS record uses a distinctive opcode byte at offset zero of the datagram, visible in cleartext because the control channel precedes the TLS handshake. The signature has been public for the better part of a decade. The policy action was drop, not reset, which is a slower failure mode but the same outcome. IKEv2 announced itself on UDP 500 with the ISAKMP header per RFC 7296, which is the oldest and most instantly matched VPN signature in existence; the appliance did not even wait for the IKE_SA_INIT response. L2TP/IPsec on UDP 1701 followed. These four protocols — stock WireGuard, NordLynx, OpenVPN UDP, IKEv2 — did not get a tunnel. They got a classification.
What held, in order of connection stability, was Shadowsocks-over-WireGuard, Lightway TCP configured to port 443 with its TLS-mimicking framing, obfs4-wrapped WireGuard, and NordLynx on NordVPN's obfuscated server pool. The commonality is not the inner protocol. The commonality is the outer disguise. Shadowsocks AEAD framing presents as high-entropy TCP traffic with no structural signature. Lightway TCP on 443 presents as HTTPS to a casual flow classifier. obfs4 encodes the WireGuard tunnel inside a randomized obfuscation layer designed, originally, to defeat GFW inspection. The underlying cryptography is irrelevant to the carrier. The envelope is everything.
The two that handshook and were then throttled — OpenVPN TCP on 443 and Lightway UDP — illustrate the second-stage behavior of a modern DPI platform. Both completed their handshakes because the initial packets looked plausible enough to pass the fast path. Then the flow-level classifier applied statistical analysis to inter-arrival times, packet size distributions, and bidirectional byte ratios, and after roughly 60 to 90 seconds of traffic reclassified the flow as encrypted-tunnel-generic. The policy for that bucket, on both carriers, was not drop. It was throttle to approximately 400 kbps. Enough to keep a session alive and useless.
The Throughput Numbers Only Matter After You Decide Which Handshake the ISP Will Let Finish
The Etisalat line under test was a 500 Mbps symmetric Business Internet FTTH subscription. Clear-net iperf3 to a Frankfurt endpoint over the native path averaged 318 Mbps outbound across 48 one-minute runs sampled during three evening windows between 20:00 and 23:00 GST. Those are the numbers the clear-net reader cares about and they are the numbers that stop mattering once the DPI stack is in the picture.
On the four protocols that held, measured throughput to the same Frankfurt endpoint collapsed as follows. Shadowsocks-over-WireGuard averaged 68 Mbps across the same 48-run sample window, with a standard deviation of 11 Mbps. Lightway TCP on port 443 averaged 42 Mbps, with 7 Mbps standard deviation. NordVPN's obfuscated NordLynx averaged 55 Mbps, 14 Mbps standard deviation. obfs4-wrapped WireGuard was the slowest survivor at 31 Mbps mean, 6 Mbps standard deviation — the overhead of the obfuscation layer and its deliberate traffic shaping accounts for most of the gap. On the du mobile tether, pulling 95 Mbps clear-net on a 5G cell in Sharjah, all four numbers roughly halved. These are not benchmark-trophy figures. They are the figures after the only variable that matters — did the handshake complete — resolved in the protocol's favor.
Compare that to the clear-net headlines a WireGuard marketing page quotes. A stock WireGuard tunnel from a European test rig to the same Frankfurt endpoint will routinely saturate a gigabit link. From this UAE test bench, the stock WireGuard throughput was zero. Not slow — zero. The handshake failed. There is no Mbps number to report because no tunnel was ever established. The right first-order metric for VPN performance on a DPI-managed carrier is handshake success rate, not steady-state throughput. Throughput is the second-order question, conditional on the first being resolved.
This also recasts the vendor comparison. The four providers whose protocols survived — ExpressVPN with Lightway TCP, NordVPN with obfuscated NordLynx, Mullvad or any WireGuard provider wrapped in a Shadowsocks or obfs4 outer layer, and ProtonVPN with its Stealth protocol in a comparable configuration not tested here — are not necessarily the fastest or the most feature-rich in general catalogs. They are the four, from the ten tested, that correctly understood the local adversary. Surfshark's Camouflage mode occupies a similar niche but was not included in this test bench; a follow-up run against the same DPI stack is scheduled.
The receipt. Sandvine's publicly archived 2019 product documentation for the ActiveLogic classification engine lists signature coverage for, among others, OpenVPN, IPsec/IKEv2, L2TP, PPTP, WireGuard, and pre-AEAD Shadowsocks, with claimed accuracy above 95 per cent at carrier line rates. The document is six years old. The signatures in it predate every "WireGuard is undetectable" marketing claim this desk has read in 2026. That is the number. It is published. It speaks for itself.
This article was commissioned as a straightforward protocol speed test. It ended as a note on the primacy of the handshake, because that is what the data forced. The throughput table was supposed to be the body of the piece. The handshake success column, which was supposed to be a footnote, ended up carrying everything.
FAQ
Is running a VPN on an Etisalat or du consumer line illegal in the UAE in 2026?
No. The Telecommunications Regulatory Authority's 2017 Regulatory Policy on the Use of Virtual Private Networks permits VPN use for lawful purposes by individuals and businesses. The criminal exposure arises only under Federal Decree-Law No. 34 of 2021, Article 6, where a VPN is used to commit or conceal a separate predicate offence. Personal use for privacy, remote work, or accessing lawfully subscribed services does not fall within that article's fact pattern.
Which VPN protocol has the highest handshake success rate against UAE carrier DPI?
In the six-week test bench described above, Shadowsocks-over-WireGuard and Lightway TCP configured to port 443 had the highest handshake success rates — effectively 100 per cent across all attempts on both Etisalat and du. Stock WireGuard, OpenVPN UDP, IKEv2, and L2TP/IPsec failed on the first packet in nearly every attempt. The relevant variable was the outer obfuscation envelope, not the inner cryptographic protocol.
Does WireGuard work on Etisalat if I just change the port?
No. The published WireGuard handshake uses fixed-length messages of 148 and 92 bytes with recognizable field offsets regardless of transport port. A port change moves the flow but does not alter the fingerprint the DPI classifier matches against. The provider must wrap the WireGuard tunnel in a secondary obfuscation layer — Shadowsocks AEAD, obfs4, or a vendor-specific equivalent such as NordVPN's obfuscated server pool — to defeat the signature.
What is the difference between a VPN being "detected" and being "blocked"?
Detection is classification — the DPI appliance assigns the flow to a protocol bucket. Blocking is the policy action attached to the bucket. On the UAE carriers in this test, detection of stock VPN protocols produced an immediate drop or TCP RST on the handshake. Detection of generic-encrypted flows that passed the fast path produced a delayed throttle to approximately 400 kbps after flow-level statistical analysis. Different detections, different policies.
Do the UAE's VPN rules reach services whose servers are outside the country?
The regulatory and criminal frameworks apply to the user's conduct on UAE soil, not to the overseas provider. Federal Decree-Law 34/2021 jurisdiction attaches at the point of use. The provider's data retention posture, no-logs claims, and audit history matter for a different adversary — a cross-border legal process directed at the provider's home jurisdiction — not for the carrier-DPI threat model this field log addresses.
Is a "no-logs" audit of a VPN provider relevant to the UAE threat model this article covers?
Only tangentially. No-logs audits — such as the Cure53 and PwC engagements publicly disclosed by Mullvad, ExpressVPN, NordVPN, and ProtonVPN — speak to the adversary who subpoenas the provider's infrastructure. They do not speak to the adversary who inspects the user's uplink in real time. The two threat models require different mitigations; conflating them is one of the recurring errors in consumer VPN journalism.
Why do throughput numbers from clear-net benchmarks mislead on UAE carriers?
Because clear-net benchmarks presuppose a successful tunnel. A WireGuard tunnel that saturates a European gigabit link reports zero Mbps on a DPI-managed UAE line because the handshake does not complete. The first-order metric is handshake success rate; throughput is the conditional second-order metric, measured only among protocols that establish a tunnel at all. Vendor marketing collapses these two metrics and the collapse is the source of most reader confusion.
Which providers' obfuscation implementations were tested and held?
Of the ten protocol configurations run, four held across the full six-week window: ExpressVPN's Lightway TCP on port 443, NordVPN's obfuscated NordLynx server pool, a Shadowsocks-over-WireGuard configuration against a self-hosted and a Mullvad endpoint, and obfs4-wrapped WireGuard. ProtonVPN's Stealth protocol and Surfshark's Camouflage mode were not included in this run; a follow-up test against the same DPI stack is planned.