Search IconIcon to open search

Cross the GFW

Last updated Aug 27, 2023

The GFW here refer to the censorship on the Internet between China and outside. It’s relatively advanced for quite some years. In terms of website block, it’s mainly working in these aspects:

  1. Pollution or block of DNS resolution.
  2. Block network access to IP addresses outside China.

Although this article here are mainly based on situations in China, many can be applied to other places as well.

# Guideline

# Aspects to think about

# Choose a provider

# Solution

# Deployment

# Protocol


Some examples: OpenVPN, tinc, AnyConnect, IPSec, WireGuard


# Proxy

Some example: naiveproxy, V2Ray, Shadowsocks (also ShadowsocksR), Trojan

# Tech Introduction

# Transparent Gateway


# Situation in China

DNS resolve to blocked websites such as Google are polluted in public DNS servers (such as; normal request (plain text UDP to port 53) send to public DNS servers outside China (such as will be hijacked by the GFW and return wrong IP addresses.

# Approach

A common approach is to set up a private DNS server, for example a network instance in one’s own home.

# Connection

A local DNS server request DNS resolve results from public DNS servers within and outside China, connections to servers outside being protected:

# Modes

There are different modes depending on how the DNS server acquire DNS resolution from which upper DNS server:

The reason behind different modes is that a lot of websites use CDN to provide faster access or redirect to regional site based on access location. Request from CDN servers nearby can usually improve speed a lot.

# Network connection

# General Situation

Connection from client to abroad will go through government controlled machine which can:

# Approach

Setup up VPN or proxy server in foreign country and route/redirect traffic out.

Might need to use servers in between to help route traffic in order to improve connectivity.

# Connection

There are different parts to consider:

# Modes

There are different modes depending on how do we route traffic out: