The OpenVPN protocol makes no attempt to hide its presence. The protocol itself is briefly described at the end of the [documentation](https://openvpn.net/index.php/open-source/documentation/security-overview.html). Note that, even if you manage to [obfuscate](https://community.openvpn.net/openvpn/wiki/TrafficObfuscation) the protocol itself, it is possible for your ISP to determine that you are using a VPN using [traffic fingerprinting](https://link.springer.com/chapter/10.1007/978-3-642-35795-4_56). Not to mention, the fact that you are using some sort of tunnel can be inferred from the behavior of only connecting with an encrypted protocol to a single IP address for all of your internet activity. ##Traffic obfuscation There are two primary ways to prevent the protocol from being immediately tagged as OpenVPN traffic, however both methods do not defeat advanced traffic fingerprinting. Additionally, both of these methods require support from both client _and_ server, so random commercial VPNs are unlikely to be compatible with this. The two main ways to limit traffic identification are: * **Static keys** - Normally, OpenVPN establishes a TLS connection with the remote server to exchange temporary session keys which are then used to encrypt the VPN protocol. This key exchange gives away that OpenVPN is being used. [Static keys](https://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html) are pre-shared keys that are stored on both the client and server. If they are delivered securely to both sides, then that key can be used directly to encrypt the VPN traffic without any key exchange. Unfortunately, static keys necessarily mean you will lose the cryptographic property of [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy). * **Obfsproxy** - Developed by the [Tor Project](https://www.torproject.org/), obfsproxy is a type of [pluggable transport](https://blog.torproject.org/obfsproxy-next-step-censorship-arms-race) that transparently obfuscates traffic using a variety of methods. It is designed specifically to make it difficult to identify the protocol being used in order to hamper automatic blocking. While originally designed specifically for Tor, obfsproxy [can be used with OpenVPN](https://dcamero.azurewebsites.net/openvpn-obfsproxy.html). No matter what you do, you will very likely not be able to prevent someone who is analyzing the traffic from discovering that you are connecting through an encrypted tunnel of some kind. You may be able to hide that it is specifically OpenVPN traffic, and you may be able to fool automated machine analysis, but not actual human analysis of the traffic itself. Keep that in mind. ##Threat modeling You should formulate a threat model. Ask yourself why you want to hide the existence of the VPN (avoiding so-called membership attribution). A few general threat models: * **Avoiding censorship** - In some regimes, VPNs are blocked either voluntarily by ISPs are due to extensive government censorship. You may want to obfuscate the protocol in order to bypass the filters and gain unrestricted access to the internet. For this threat model, you need only go far enough to prevent automated detection. If simply running the VPN on a different port is enough, then do just that. If you need to fully obfuscate the traffic to avoid DPI, then do that instead. There is no need to make it hard for human analysis to discover the traffic because no one is going to be monitoring it in real time and actively allowing or blocking a given resource. * **Looking inconspicuous** - You may opportunistically want to give away as little information as possible to your adversary. While giving away all your unencrypted traffic is even worse, why not reduce the information even further and hide the fact that the traffic is encrypted? If your adversary is using automated logging to detect VPN traffic, the solution is the same as the one for avoiding censorship. Simply change your traffic _just enough_ to get past the machines, and you are home free. If you want to protect against manual, human analyists, then you're out of luck, unfortunately. There is no practical way to hide that you are using an encrypted tunnel of some kind to a sapient and educated adversary with access to traffic logs. * **Avoiding legal issues** - In some jurisdictions, the mere use of an encrypted tunnel of any kind can be flat-out illegal. In cases where the penalties are high and the laws are actively enforced, you have a much bigger problem. You should avoid all government-run or sympathetic ISPs. This means using underground networks or wireless networks from nearby countries. You should also either hire a lawyer to get professional legal advice, or at the very least ask some questions on the [Law Stack Exchange](https://law.stackexchange.com/). While they do not provide legal advice, they can answer certain questions and cite relevant laws to help you improve your understanding.