Connection modes: Auto, Fast, Disguise and Slow
The connection mode is how the Reach client talks to the gateway, not what it routes. Auto picks the best transport for where you are and falls back if it's blocked; you can force Fast, Disguise or Slow from the tray's Connection mode submenu.
The four modes
| Mode | What it does | When to use it |
|---|---|---|
| Auto (default) | Prefers Fast on an open network and Disguise in a restricted region; if the chosen transport isn't available it tries the next | Almost always |
| Fast | A WebSocket tunnel straight to the gateway — lowest overhead | Stable, unfiltered networks |
| Disguise | A tunnel that looks like ordinary HTTPS traffic to anything inspecting the connection | Networks where Fast is blocked or throttled — hotel and campus Wi-Fi, mainland China |
| Slow | Long-polling over plain HTTPS requests — the most compatible, and the slowest | A last resort when nothing else connects |
Whatever the mode, your browser's TLS session still runs end-to-end to the destination. The connection mode only wraps the already-encrypted bytes on their way to the gateway; Reach never decrypts HTTPS and installs no certificate. See Security.
How Auto decides
The client detects whether it's in a restricted region (mainland China and a few others) from the device's locale and time zone. In a restricted region Auto leads with Disguise; elsewhere it leads with Fast. If the gateway doesn't offer the preferred transport, or the handshake fails, the next option is tried automatically — you're never left with a mode that can't connect.
In a restricted region the client also stops bypassing Microsoft's sign-in endpoints (which are normally sent direct so Windows device sign-in works), because from inside those networks they're only reachable through the gateway.
When a gateway is unreachable
If the active gateway stops answering, the desktop client fails over to the best alternative region (lowest measured latency) and notifies you — see Gateway regions. If no other gateway is available, routed pages show a "gateway unavailable" error page rather than silently going out on your own IP.
Switching the proxy off is what returns traffic to your normal connection: the browser's proxy settings are reverted and everything goes direct.
Changing the mode
- Desktop: tray menu → Connection mode → Auto / Fast / Disguise / Slow. The choice is saved and applied live.
- Android and iOS: the apps choose the transport automatically; there is no manual switch.
Related
- Using Reach in mainland China
- Gateway regions
- Troubleshooting — "connected but nothing loads"
Common questions
Should I just leave it on Auto?
Yes. Change it only if Reach connects but pages stall — try Disguise first, then Slow.
Is Disguise slower than Fast?
A little, because of the extra wrapping, but on a network that throttles Fast it's much faster in practice. Slow is noticeably slower and only meant to get you online.
Does the mode change what the gateway can see?
No. In every mode the gateway sees only the destination host your browser asked for and the encrypted bytes — never page content.