Definition
Obfuscation is the deliberate masking of VPN traffic so that network operators cannot identify it as VPN traffic. This is achieved by reshaping the packets to remove the protocol's distinctive fingerprints, by wrapping the entire VPN session inside another protocol that looks innocuous (typically HTTPS), or by mimicking the traffic patterns of common applications like web browsing or video streaming.
Common Techniques
Stunnel wraps OpenVPN inside a real TLS connection on port 443, so the traffic is indistinguishable from any HTTPS site. XOR patches scramble OpenVPN handshakes. Obfsproxy and obfs4, from the Tor project, randomize the apparent contents of the handshake to defeat signature-based DPI. Shadowsocks behaves like a SOCKS5 proxy with all traffic encrypted. V2Ray, Trojan, and Hysteria are newer protocols designed from the start with obfuscation in mind.
When You Need It
Obfuscation is essential in environments that actively block VPNs: China, Iran, Russia, the UAE, Turkmenistan, and many corporate or campus networks. It is unnecessary on open networks and adds a small performance cost. Most reputable providers offer obfuscation as an opt-in setting, often labelled 'Stealth,' 'Camouflage,' 'NoBorders,' 'Obfuscated Servers,' or 'Scramble.' The arms race against censors means today's working obfuscation may be detected tomorrow.