BTCWhat Is the Great Firewall?
China's internet censorship system — the Great Firewall (GFW) — is not a single piece of software or a list of blocked websites. It is a sprawling, multi-layered infrastructure embedded deep into the country's national internet backbone, operated across carrier networks like ChinaNet and China Unicom. Every packet crossing China's international internet border passes through it.
What makes it uniquely formidable is that it has evolved from a passive blocklist into an adaptive, actively interrogating adversary. It no longer simply blocks known addresses — it watches for behavioural patterns, probes suspicious servers, decrypts protocol handshakes, and updates its detection rules in near real time. Understanding how it works at the protocol level is the foundation for choosing tools that actually survive it.
Layer 1: DNS Poisoning — The Oldest Weapon
The GFW's most veteran tactic is DNS injection. When a user inside China resolves a blocked domain, censorship middleboxes race to inject a forged DNS response — returning false IP addresses — before any legitimate answer can arrive. The attacker only needs to win a timing race, not intercept the full connection.
Researchers discovered a buffer over-read vulnerability in the GFW's DNS injection subsystem. Certain nation-wide censorship middleboxes were leaking up to 125 bytes of their own internal memory — including network protocol headers, stack frames, and fragments of other users' traffic — inside crafted DNS responses. The bug existed for at least two years before being fully patched in March 2024.
Named Wallbleed (after Heartbleed), it revealed internal GFW architecture, memory management patterns, and load-balancing logic — a rare window into a system that operates entirely in secret. It also proved that censorship infrastructure creates privacy risks beyond censorship itself: traffic from users outside China, routed through Chinese network borders, may also have been exposed.
Across approximately seven million fully qualified domain names, the GFW's DNS censorship blocked 106,973 domains — the largest count of any single censorship layer studied. The blocklist is dynamic and exhibits diurnal patterns tied to computational load, becoming more aggressive in off-peak hours.
Use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to encrypted DNS queries so they cannot be intercepted and forged by in-path GFW devices. Ensure your VPN tunnels DNS as well as web traffic.
Layer 2: Deep Packet Inspection — Reading Your Destination
For web traffic, the GFW performs stateful deep packet inspection (DPI) of both plain HTTP and encrypted HTTPS. For HTTP, it reads the Host header. For HTTPS (TLS), it reads the Server Name Indication (SNI) field — a plaintext extension in the TLS handshake that names the destination server — and compares it against a blocklist. When a blocked domain is detected, the GFW injects forged TCP RST packets to tear down the connection.
This is followed by residual blocking: a "cooling-off" period of roughly 90 seconds to 3 minutes during which all traffic between the affected IP pair is dropped — regardless of content. This makes even innocent retries look like network errors, obscuring the censorship event.
The GFW also exhibits asymmetric interference: it may block traffic from client to server while allowing the server's response to pass, creating ambiguous connection failures that are harder to diagnose and attribute to censorship.
Use TLS 1.3 with Encrypted Client Hello (ECH). ECH encrypts the SNI using asymmetric cryptography — unlike QUIC's initial encryption, it cannot be decrypted by any network observer, including the GFW. As of early 2025, the GFW does not block QUIC connections containing ECH extensions.
Layer 3: Active Probing — The Digital Interrogator
One of the GFW's most powerful and least understood capabilities is active probing. Rather than blocking suspicious traffic immediately, the GFW's systems dispatch their own network packets to test a suspected proxy server — impersonating a legitimate client — and observe how it responds.
Step 1 — Passive monitoring: The GFW detects traffic that exhibits characteristics of a circumvention proxy (unusual entropy, known protocol fingerprints, etc.) but does not block it immediately.
Step 2 — Interrogation: GFW-controlled machines send "replay" packets to the remote server, masquerading as a legitimate client handshake, to test how the server responds.
Step 3 — Verdict: If the server responds in a way that confirms it is a proxy — for example, by completing a Shadowsocks handshake — the IP address and port are blacklisted within seconds. The block is persistent and affects all users of that server.
Active probing is why simply running a private server is not sufficient protection: the GFW can discover and neutralise it without any user having to trigger a block by visiting a censored site. Protocols must be designed to be probe-resistant — responding to unrecognised connections with behaviour indistinguishable from a normal HTTPS server.
Use probe-resistant protocols such as Trojan or VLESS with TLS — these are designed to present as normal HTTPS servers to any connection that doesn't carry a valid authentication token, making active probing inconclusive. Avoid running unmodified Shadowsocks on well-known ports.
Layer 4: The Death of "Looking Like Nothing" — Encrypted Traffic Detection
Circumvention tools like Shadowsocks, VMess, and Obfs4 were built on a simple idea: encrypt every byte so the traffic looks like random noise — "looking like nothing." For years, this made them resistant to passive DPI. The GFW had to rely on active probing to find them one server at a time.
That changed on November 6, 2021 — coinciding with a Communist Party central committee session — when users across China reported sudden mass blocking of their Shadowsocks and VMess servers. Research published at USENIX Security 2023 revealed that the GFW had deployed a new, purely passive detection system for fully encrypted traffic.
The GFW flipped the detection problem. Instead of identifying what encrypted traffic is, it uses entropy-based heuristics to identify what it isn't. It applies at least five sets of exemption rules — based on common protocol fingerprints, the fraction of set bits (a crude entropy test), and the count, fraction, and position of printable ASCII characters. Traffic that matches no exemption is treated as a potential circumvention proxy and blocked.
The GFW accepts roughly 0.6% collateral damage — legitimate encrypted traffic blocked as false positives — in order to ensure no circumvention tool slips through. That is a deliberate, calculated trade-off.
Mimicry over pure encryption. Wrap your traffic inside a standard TLS 1.3 tunnel (as used by Trojan or V2Ray with TLS) so it is statistically and structurally indistinguishable from a visit to an ordinary HTTPS website. Additionally, use uTLS fingerprint mimicry — the GFW can identify the unique TLS library fingerprint of VPN clients. Configuring your client to mimic Chrome or Firefox's exact TLS fingerprint removes this detection vector.
Layer 5: QUIC Censorship — China's Newest Frontier (2024)
QUIC is the transport protocol underpinning HTTP/3 — the modern web's encrypted, high-performance layer. By 2024, over 30% of global web requests used QUIC. Unlike TLS over TCP, QUIC encrypts everything from the very first packet. This posed a fundamental challenge for censors: how do you block connections based on destination when the destination name is encrypted?
On April 7, 2024, China solved it. Research published at USENIX Security 2025 documented the GFW's new capability: decrypting QUIC Initial packets at national scale to reveal and inspect the SNI field — making China the first and only country in the world to implement targeted, SNI-based QUIC censorship.
Why QUIC Decryption Is Possible
Although QUIC handshake packets are encrypted, the key for the first packet (the QUIC Client Initial) is derivable by any network observer — it is computed from fields that appear in plaintext in the same packet. This was an intentional design choice to resist tampering, not to achieve confidentiality. The GFW exploits this by decrypting every QUIC Client Initial, extracting the SNI, and checking it against a QUIC-specific blocklist that is maintained separately from its DNS, HTTP, and TLS blocklists.
Protocol-Specific Blocklists
A counterintuitive finding: the GFW maintains different blocklists for different protocols. A domain blocked via DNS may not be blocked over QUIC, and vice versa. Of the 58,207 domains blocked over QUIC, 11,854 were blocked exclusively over QUIC. This means users may temporarily access some blocked content by switching protocols — though such gaps close over time as the GFW updates its lists.
A Critical Flaw: The GFW Can Be Overwhelmed
Decrypting QUIC packets at national scale is computationally expensive. Researchers found that the GFW's QUIC censorship effectiveness degrades significantly under traffic load. During peak hours in China, blocking rates drop. Experiments showed that sending a moderate stream of QUIC Initial packets toward GFW inspection devices could overwhelm their decryption capacity and cause them to miss targeted connections. The GFW's own blocking mechanism can also be weaponised as an availability attack against arbitrary hosts.
The GFW skips QUIC inspection entirely when the source port ≤ destination port — a heuristic to filter out server-to-client traffic. Running QUIC proxy servers on destination ports higher than typical client ephemeral ports (e.g., above 49152) causes the GFW to ignore those connections by design.
Layer 6: A Wall Behind the Wall — Regional Censorship (2023–Present)
Since August 2023, China's Henan Province has operated its own provincial censorship layer — a firewall within the firewall — inspecting traffic leaving the province before it reaches the national GFW. Research published at IEEE Security & Privacy 2025 documented this for the first time.
The Henan Firewall uses TLS SNI-based and HTTP Host-based blocking at the provincial border. While less technically sophisticated than the national GFW, its wildcard blocking rules are more aggressive: at certain points, the Henan Firewall blocked ten times more websites than the national GFW. Its parsing rules also differ from the national system, meaning circumvention strategies must account for both layers independently.
Users in Henan face a double filter: traffic must pass both provincial and national censorship. A technique that bypasses the national GFW may still be blocked by Henan's system. The emergence of provincial-level censorship is described by researchers as an "alarming sign" of decentralisation — suggesting other provinces may follow.
GFW Censorship Methods: Technical Comparison
The following table compares each major GFW censorship method, how it works, and the primary countermeasure researchers have validated:
| Method | How It Targets You | Primary Countermeasure |
|---|---|---|
| DNS Poisoning | Intercepts DNS queries for blocked domains and returns fake IP addresses before a legitimate response can arrive. | Use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) tunnelled through your VPN |
| DPI / SNI Inspection | Reads the plaintext SNI field in TLS handshakes and the Host header in HTTP requests; injects TCP RST on match. | TLS 1.3 with Encrypted Client Hello (ECH) |
| Active Probing | Sends "replay" packets masquerading as a legitimate client to test whether a remote server is a proxy; blacklists on confirmation. | Probe-resistant protocols: Trojan, VLESS with TLS |
| Entropy / Heuristic Analysis | Identifies traffic that looks "too random" (fully encrypted) by exempting known protocols and blocking the rest. | Mimic standard TLS 1.3 traffic; use uTLS to clone browser fingerprints |
| QUIC SNI Decryption | Derives the QUIC Initial packet decryption key (derivable by any observer), decrypts it, reads SNI, and applies UDP residual blocking. | QUIC SNI slicing; ECH; high-port proxy servers; dummy pre-handshake packet |
| IP Address Blocking | Blackholes entire IP ranges of known VPN providers, data centres, and services at the routing level. | Rotate server IPs frequently; use residential IPs or domain-fronting |
| Regional (Henan) Filtering | Provincial-level TLS SNI and HTTP Host inspection at provincial border — separate rules from the national GFW. | Circumvention must work against both provincial and national layers independently |
How the GFW Has Evolved: A Timeline
China begins combining traffic fingerprinting with active probing to identify and block Shadowsocks proxy servers at scale.
The GFW blocks Encrypted Server Name Indication — an early TLS extension designed to hide SNI from observers.
DNS injection devices begin leaking up to 125 bytes of internal memory. The bug remains undetected for over two years.
Shadowsocks, VMess, and Obfs4 users see mass, simultaneous blocking as the GFW rolls out entropy-based heuristic detection.
Large-scale blocks target V2Ray, Trojan variants, and other TLS-based circumvention tools. GFW blocks google.com and all subdomains.
Cloudflare's public DNS resolver is blocked. Popular circumvention tool GitHub repositories are deleted or archived. Henan Province deploys its own regional firewall.
China becomes the first country to implement targeted, SNI-based QUIC blocking — decrypting QUIC Initial packets at national scale beginning April 7, 2024.
After a failed partial patch in November 2023, the GFW's DNS injection devices are finally fully patched against the Wallbleed memory-leak vulnerability.
quic-go v0.52.0 integrates SNI slicing; V2Ray, Xray, Hysteria, and sing-box update their dependencies, bypassing GFW's QUIC SNI censorship for millions of users.
The largest known leak of GFW internal documents, confirming that the GFW maintains massive databases of known data-centre IP ranges used to identify and block VPN infrastructure.
What Still Works: Circumvention Strategies Backed by Research
Despite the GFW's sophistication, academic research consistently finds exploitable gaps — and researchers have collaborated directly with open-source circumvention communities to translate findings into practical updates. Here's what the evidence shows still works in 2025:
QUIC SNI Slicing
Split the QUIC Client Initial across multiple UDP datagrams so the GFW can't reassemble the SNI. Now default in Firefox 137, V2Ray 5.33, Xray 25.6.8, Hysteria 2.6.2, and sing-box 1.12.
Pre-QUIC Dummy Packet
Sending any UDP datagram before the QUIC Client Initial breaks the GFW's first-packet assumption — the SNI inspection fails silently and the connection proceeds.
Encrypted Client Hello (ECH)
ECH encrypts the SNI using asymmetric cryptography that no passive observer can decrypt. As of January 2025, the GFW does not block QUIC payloads containing ECH extensions.
TLS Traffic Mimicry
Wrap proxy traffic inside a genuine TLS 1.3 tunnel (Trojan, VLESS+TLS) so it is indistinguishable from normal HTTPS traffic — defeating entropy-based detection entirely.
uTLS Browser Fingerprinting
The GFW identifies VPN clients by their unique TLS library fingerprint. Configure your client to clone Chrome or Firefox's exact fingerprint using uTLS to remove this detection signal.
High-Port QUIC Proxies
The GFW skips QUIC inspection when source port ≤ destination port. Run proxy servers on high destination ports to exploit this heuristic and avoid inspection entirely.
QUIC Connection Migration
If the QUIC handshake completes before blocking is enforced (possible given the GFW's variable blocking latency), migrate to a new source port to escape residual blocking.
Rotate IPs & Avoid Data Centres
The Geedge & MESA leak confirmed the GFW maintains large databases of known data-centre IP ranges. Rotating server IPs frequently or using residential IPs significantly reduces discoverability.
The GFW is an adaptive adversary. Pure encryption alone is a red flag, not a defence. The tools that survive longest are those that: (1) mimic legitimate traffic structurally and statistically, (2) are probe-resistant, (3) integrate academic research findings rapidly. The cat-and-mouse game consistently favours those who move faster.
The BTCVPN Strategy: How to Stay Connected
Based on everything peer-reviewed research reveals about the GFW's detection capabilities, a reliable setup in China must prioritise these principles:
Obfuscation over raw encryption. Use a VPN that wraps its traffic in TLS 1.3 so it resembles normal HTTPS — not a protocol that looks "random." BTCVPN's obfuscated tunnels are designed to pass entropy analysis.
uTLS browser fingerprint mimicry. Ensure your client impersonates a standard browser's TLS fingerprint (Chrome or Firefox) rather than advertising a VPN library. BTCVPN clients implement uTLS by default.
Probe-resistant server design. BTCVPN servers respond to unrecognised connections like ordinary HTTPS servers — making active probing by GFW machines inconclusive.
Rapid protocol updates. The GFW adapts. A provider that integrates findings like QUIC SNI slicing and ECH within weeks — not months — is dramatically more reliable during crackdowns.
Encrypted DNS through the tunnel. All DNS queries must be tunnelled to prevent the GFW's DNS injection from redirecting you before your VPN even connects.
Zero-logs policy with anonymous payment. The Geedge & MESA leak confirmed the GFW maintains databases of known VPN infrastructure IPs. Paying with Bitcoin (or a privacy coin) ensures your subscription doesn't create a linkable record — even if your provider's customer database were ever exposed.
Why This Matters Beyond Censorship
The GFW is usually framed as a censorship tool — but the Wallbleed vulnerability demonstrates a deeper truth: large-scale surveillance infrastructure is itself a security risk for everyone. A system that intercepts and inspects all international internet traffic at national scale is, by design, processing vast amounts of sensitive data. When that system has a bug — as it did for over two years — the data passing through it leaks.
The GFW's QUIC blocking also introduced a new attack class: a third party can use China's own censorship infrastructure as a denial-of-service weapon against arbitrary internet services — turning the firewall against the very users it nominally protects. These are not hypothetical risks; they were demonstrated in controlled experiments by academic researchers who disclosed them responsibly.
For journalists, businesses, activists, and everyday users who need reliable private internet access in or around China, understanding the GFW's actual mechanics — not just its reputation — is the only way to make informed choices about tools, providers, and operational security.