Zapret2 + hysteria2 keenetic

[neur0ner25]

Доброго времени суток. У меня vps. Его ip и домен в исключениях.
На vps крутится mtproto vless и hysteria2. Первые двое работают, а у hysteria2 тайм-аут. Протокол очень чувствителен к "повреждению" трафика. Все три сервиса работают через 443 сокет, hysteria2 через udp. На что обратить внимание? Мой конфиг:
ISP_INTERFACE="eth3 nwg1"
ISP_INTERFACE="ppp0"

Startup arguments

NFQWS_BASE_ARGS="--lua-init=@/opt/etc/nfqws2/lua/zapret-lib.lua
--lua-init=@/opt/etc/nfqws2/lua/zapret-antidpi.lua
--lua-init=@/opt/etc/nfqws2/lua/zapret-auto.lua
--blob=quic_initial:@/opt/etc/nfqws2/blobs/quic_initial.bin
--blob=tls_clienthello:@/opt/etc/nfqws2/blobs/tls_clienthello.bin
--blob=http_fake:@/opt/etc/nfqws2/blobs/http_fake.bin
--blob=wireguard_initiation:@/opt/etc/nfqws2/blobs/wireguard_initiation.bin"
NFQWS_ARGS="--filter-tcp=443,80 --filter-l7=http,tls
#HTTPS
--payload=tls_client_hello
--lua-desync=circular:fails=2:time=300:retrans=3:nld=2
--lua-desync=fake:blob=tls_clienthello:ttl=10:tls_mod=rnd,dupsid,sni=fonts.google.com:tcp_seq=10000:repeats=1:strategy=1
--lua-desync=multisplit:pos=1,midsld:ttl=10:seqovl=1:seqovl_pattern=tls_clienthello:tcp_ts_up:strategy=1
--lua-desync=multidisorder:pos=1,midsld,maxorder=5:ttl=10:seqovl=16000:seqovl_pattern=tls_clienthello:repeats=3:strategy=2
# HTTP
--payload=http_req
--lua-desync=http_methodeol:badsum:fake:blob=http_fake:ttl=10:repeats=1:tcp_ts_up"

QUIC strategy

NFQWS_ARGS_QUIC="--filter-udp=443 --filter-l7=quic
--payload=quic_initial
--lua-desync=circular:fails=2:time=300:retrans=3:nld=2
--lua-desync=fake:blob=quic_initial:ttl=10:repeats=2:strategy=1"

UDP strategy

NFQWS_ARGS_UDP="--filter-udp=590-600,1400,3478-3481,4515,5349,19294-19344,49152-65535
--filter-l7=wireguard,stun,discord,mtproto,unknown
--out-range=<n2
--payload=wireguard_initiation,wireguard_response,wireguard_cookie,stun,discord_ip_discovery,mtproto_initial,unknown
--lua-desync=circular:fails=2:time=300:retrans=3:nld=2
--lua-desync=fake:ttl=10:repeats=3:strategy=1"

Working modes, don't change

MODE_LIST="--hostlist=/opt/etc/nfqws2/lists/user.list"
MODE_ALL="--hostlist-exclude=/opt/etc/nfqws2/lists/exclude.list"
MODE_AUTO="$MODE_LIST --hostlist-auto=/opt/etc/nfqws2/lists/auto.list --hostlist-auto-debug=/opt/var/log/nfqws2.log $MODE_ALL"
NFQWS_EXTRA_ARGS="$MODE_AUTO"

IP-lists

NFQWS_ARGS_IPSET="--ipset=/opt/etc/nfqws2/lists/ipset.list --ipset-exclude=/opt/etc/nfqws2/lists/ipset_exclude.list"

Custom arguments

NFQWS_ARGS_CUSTOM="--filter-tcp=1080 --lua-desync=multisplit:pos=2:ttl=10"

IPv6 support

IPV6_ENABLED=0

TCP/UDP ports

TCP_PORTS=80,443,85,22,4350,4515,25565,2083,2087,2096,8443
UDP_PORTS=443,85,22,4515,25565,590:600,1400,3478:3481,5349,19294:19344,49152:65535

Keenetic policy name

POLICY_NAME="nfqws"
POLICY_EXCLUDE=0

Logging

LOG_LEVEL=0
LOG_DEBUG_PATH="@/opt/var/log/nfqws2-debug.log"
NFQUEUE_NUM=300
USER=nobody
CONFIG_VERSION=1