HyFabric Docs

HyFabric is an enterprise-grade proxy network designed from the ground up to defeat censorship, deep packet inspection, and network throttling. It delivers gigabit-class speeds on even the most restricted and lossy networks.

Sign up, choose a plan, and you'll be connected in under 2 minutes.

Every HyFabric connection is secured end-to-end using TLS 1.3 with modern cipher suites. The server presents a valid certificate from a trusted CA — there is no need to trust any custom root.

Authentication masquerade

An unauthenticated probe against a HyFabric node receives an HTTP 404 response — making the endpoint completely indistinguishable from an ordinary HTTPS web server. Passive observers and active scanners get no useful signal.

Probing Shield — 6-layer defence

Nodes are protected by a multi-layer active probe defence system:

Detected probes are tarpitted — drip-fed a fake response at 1 byte per 5 seconds — consuming the scanner's resources without revealing anything useful.

DDoS protection

All nodes enforce both a per-IP connection rate limit (new connections per 60-second window) and a global concurrent session cap. Connections refused at this layer never reach TLS negotiation — protecting node performance under volumetric attack.

HyFabric uses a QUIC-based transport designed for high throughput on degraded or throttled networks. Unlike TCP-based proxies, QUIC handles packet loss and reordering far more efficiently — giving you better speeds on mobile networks, international links, and congested ISP connections.

Adaptive bandwidth shaping

Each node continuously measures its available capacity and distributes it fairly across all active sessions. Your speed automatically scales up when the node is lightly loaded and adjusts gracefully during peak hours — no manual throttle settings needed.

Fair share = min(node_capacity ÷ active_sessions, your_plan_cap)

The capacity estimate uses an exponential moving average that converges to ~95% of true capacity within 7 calibration cycles (~7 minutes). This keeps shaping smooth and prevents sudden speed drops from transient measurements.

Traffic priority — WFQ

The network classifies your traffic in real time and applies weighted fair queuing:

Hardware fast-path

On supported nodes, a kernel-bypass packet processor handles UDP shaping directly at the network interface — reducing latency and CPU overhead compared to userspace processing. Your client apps benefit from this automatically.

HyFabric was built specifically for use in environments with aggressive internet censorship and deep packet inspection. Two complementary mechanisms work together to keep your connection alive even when ISPs actively block proxy traffic.

Traffic obfuscation (Salamander)

When enabled, every packet leaving your device is cryptographically disguised as random noise before it hits the network. DPI sensors that inspect UDP traffic cannot identify it as a proxy protocol — it looks like indistinguishable static.

The obfuscation uses a per-packet random salt so no two packets share the same keystream. This prevents both signature matching and statistical traffic analysis.

Port hopping

Censorship systems often block specific UDP ports once they identify proxy traffic. HyFabric defeats this by automatically cycling through a configured range of ports on a schedule. Your client follows the same rotation, keeping the connection alive without any interruption.

Primary port:   :443  (always active, never rotated)
Hop ports:      :20000–20050  (4 active at any time, rotated every 30 s)

HyFabric operates a strict zero-log policy. No connection logs, no traffic logs, no DNS query logs, no timestamps, and no bandwidth records per user are stored on any node or in any database.

SSRF & egress protection

The proxy enforces outbound filtering that blocks connections to private IP ranges, localhost, and DNS names that resolve to internal infrastructure. This protects both users and the network from server-side request forgery attacks.

Node identity

Each node is cryptographically bound to its identity at installation time. A compromised node cannot impersonate another node or claim false metrics — the control plane verifies every payload cryptographically and rejects anything that doesn't match the registered identity.

HyFabric uses a standard subscription link format compatible with all major proxy clients. You can also download ready-to-import config files from your dashboard.

Subscription link

The easiest method. Copy your subscription URL from the dashboard → Devices page and paste it into your client's subscription import. The client will automatically fetch and update your server list.

https://sub.hyfabric.net/<your-auth-secret>

Manual config (Hysteria 2 YAML)

For advanced users or headless setups:

server: hk1.hyfabric.net:443
auth: <your-device-secret>

tls:
  sni: hk1.hyfabric.net
  insecure: false

obfs:
  type: salamander
  salamander:
    password: "<from your config download>"

Port hopping (optional)

server: hk1.hyfabric.net:443
portHopping:
  portRange: "20000-20050"
  interval: 30s

HyFabric is compatible with all major Hysteria 2 and VLESS-compatible proxy clients: