Internet Censorship in China
Inside China's Great Firewall in 2026: DNS poisoning, SNI and QUIC filtering, VPN crackdowns, and what still gets through.
China’s censorship system is usually called the Great Firewall. The name suggests one wall at the border. In practice it is a set of filtering devices at international gateways, backed by carrier policy, legal requirements and pressure on app distribution.
Most domestic traffic stays inside the country and does not cross the national filter. Cross-border traffic does. That distinction explains why a site can load normally inside China and fail when the same request leaves the country, and why a working tunnel changes the path rather than the destination.
The system is also uneven. A provincial network can filter more aggressively than the national firewall. A mobile carrier can block a protocol that works on a fixed line. A service can survive a DNS block and still fail at the TLS handshake. The useful question is which layer is stopping the connection.
Current situation#
The national filtering apparatus is distributed across international gateways operated by the large state carriers. It combines DNS poisoning, IP address blocking, TLS server name filtering, QUIC inspection, active probing and traffic classification. These systems do not share one blocklist or one decision. Research has repeatedly found separate rules for different protocols and middleboxes.
The baseline has been stable for years. A blocked domain can resolve to a forged address, a blocked address can be dropped, and a blocked TLS hostname can trigger a connection reset. What changes is the mix. Since April 2024, the firewall has also inspected QUIC Initial packets and blocked specific domains carried over HTTP/3. In August 2025, a 74-minute incident injected resets into all TCP port 443 traffic, showing that port-level blocking is available even when it is not the normal policy.
Filtering is not only national. A 2025 measurement study documented a provincial firewall in Henan that inspected outbound TLS server names and HTTP Host headers. At times it blocked ten times more second-level domains than the national firewall. The authors found no comparable system in six other provinces they measured, but the case shows that local networks can add their own layer.
The legal environment sits around the network. The state permits approved VPNs, mainly for enterprises, and these are easier to monitor. Unapproved services are blocked, and their operators and distributors face enforcement. That is separate from whether a particular tunnel works at a given moment.
Known techniques#
| Technique | Status | What it does |
|---|---|---|
| DNS poisoning | Active | Returns forged answers for blocked names; rules differ from other filtering layers |
| IP and port blocking | Active | Drops traffic to known addresses; port-level resets have been observed during incidents |
| TLS SNI filtering | Active | Reads the server name in the TLS handshake and resets or drops matching connections |
| QUIC inspection | Active since 2024 | Decrypts QUIC Initial packets, applies a domain blocklist and can disrupt UDP traffic more broadly |
| Active probing | Active | Connects to suspected proxy servers to see whether they answer like circumvention endpoints |
| Proxy classification | Active | Uses packet sizes, timing and entropy to identify Shadowsocks and other encrypted tunnels |
| Carrier-level VPN sweeps | Active | Directs provincial carriers to inspect their own networks and block VPN traffic |
| Regional filtering | Documented in Henan | Adds provincial SNI and Host filtering that can be stricter than the national firewall |
DNS poisoning is the cheapest layer. The resolver returns an address that does not belong to the requested site, or returns nothing. Encrypted DNS can avoid a poisoned local resolver, but it does not hide the destination from the next layer. A tunnel that resolves names remotely also moves the lookup, yet the TLS handshake to the tunnel endpoint still exposes an address and often a hostname.
TLS filtering is the layer most users meet without seeing it. The ClientHello carries the server name in cleartext unless Encrypted Client Hello is in use, and ECH is not a reliable assumption on Chinese networks. A middlebox can read the name, compare it with a list and send a reset before any content arrives. The result looks like a server failure rather than a block.
QUIC adds a newer path. QUIC encrypts its payload, but the first packet is encrypted with a key that an on-path observer can derive. The firewall decrypts that packet at scale, reads the server name and applies a separate blocklist. The 2025 study found the decryption cost reduces effectiveness under load, but the capability is real and has been integrated into blocking since 2024.
Address blocking remains the simplest and most durable layer. A server on a known range can be dropped without inspecting anything. The August 2025 port 443 incident was a different form: resets were injected for all TCP traffic to that port, regardless of destination. It lasted about 74 minutes and did not match known firewall fingerprints, which suggests a new device or a misconfigured one. The episode is a reminder that a non-standard port is not a security boundary.
Active probing targets the server rather than the user. The firewall connects to a suspected proxy and watches how it responds. A server that accepts any TLS client, or that answers differently from the site it claims to be, is easier to identify. This is why probe resistance is a server-side property, not a client setting.
Traffic classification handles tunnels that do not look like TLS. The 2020 Shadowsocks study showed that a classifier can identify the protocol from packet length, timing and entropy even without reading the payload. The practical consequence is that a new obfuscation layer only helps until the classifier is retrained. Protocol diversity and operational churn matter as much as the cipher.
Recent events#
31 January 2026. The Ministry of Public Security published a 68-article draft Law on Cybercrime Prevention and Control. Human Rights Watch said it would consolidate telecom, internet and banking rules, add dynamic real-name verification and expand the grounds for suspending accounts and communication services. The text reviewed here is a draft, not an enacted law.
April 2026. Censorship analyst Eric Liu told ABC News that telecom carriers in parts of China were asked to comb through their networks and block VPN services. LetsVPN, a provider popular with expatriates, suspended service in mainland China and cited continuous internet blocking. It resumed in May but said it could not guarantee availability. Users described having to switch providers as stable services became harder to find.
27 May 2026. The Global Public Policy Institute published an analysis of documents leaked from Geedge Networks, a Chinese traffic-management contractor. The documents describe per-carrier reporting on foreign app use in Xinjiang, including weekly traffic summaries. GPPI found that foreign traffic averaged just over 4% of total traffic in the reports and cautioned that the region is not an ideal representative sample for all of China. The analysis is evidence of how filtering and surveillance share carrier data, not a measurement of nationwide VPN use.
6 August 2026. The Ministry of Public Security issued Order No. 176 on cyberspace security inspection. It took effect on 1 October and replaced the 2018 rules. Police at prefecture level and above can conduct remote technical testing, including vulnerability probing and penetration testing, against network facilities outside critical information infrastructure, with three working days’ notice. Inspections cover log retention, content controls, algorithm governance, data protection and cooperation with criminal investigations.
The order is not a new border filter. It is an inspection regime. Its relevance to circumvention is indirect: it expands police access to the networks, records and operators that host or carry tunnel infrastructure, and it makes compliance checks more frequent for some providers.
The public record for late 2026 does not show a new nationwide filtering architecture. The direction is tighter enforcement, more carrier-level scanning and more legal pressure around the existing system.
Effects on users#
The first effect is reliability. A tunnel that works on one carrier can fail on another, and a service that works in one province can fail in Henan. A blocked address can be replaced, but a carrier-level sweep can remove many endpoints at once. Users see reconnects, changed server locations and periods when no provider works consistently.
The second is protocol drift. DNS tricks handle poisoned names, but not an SNI reset. A TLS-camouflaged tunnel can pass an SNI filter, but a server that answers probes incorrectly is still discoverable. QUIC-based tools can avoid TCP resets and then run into QUIC inspection or UDP throttling. Each fix moves the problem to another layer.
The third is installation. Service suspensions, account checks and distribution pressure make it harder to obtain a client after a block is announced. A client installed before travel, with configurations saved offline, is more useful than a download link that depends on the same network being filtered.
The fourth is legal and organisational risk. Approved enterprise VPNs remain available, but unapproved services operate outside the licensing regime. The technical question of whether a tunnel works is separate from the legal question of whether a person or organisation may use it.
The fifth is visibility. Most traffic never leaves the country, and domestic platforms are often faster and more useful than blocked foreign ones. A user can have a working tunnel and still choose domestic services for most tasks. That is a design outcome, not a failure of the tunnel.
Relevant protocols#
WireGuard and OpenVPN are poor defaults against this system. WireGuard has a fixed handshake and a recognisable packet format. OpenVPN has more configuration options, but common profiles are well known to classifiers. Obfuscation can change the signature, but it does not change the server address or the traffic pattern.
Shadowsocks improves on the old proxy protocols, but the 2020 measurement work showed that its traffic can be separated from ordinary TLS by statistical features. A newer variant or plugin may work for a period. It should not be treated as invisible.
VLESS inside REALITY addresses two specific layers. VLESS adds no inner TLS session for a filter to classify, and REALITY borrows the handshake of a real site so that a probe receives a genuine certificate. That helps with SNI filtering and with naive active probing. It does not hide the endpoint address, the volume of traffic or the behaviour of the destination.
Hysteria2 runs over QUIC and can perform well on lossy mobile links. It is also exposed to QUIC inspection and to networks that throttle or block UDP. A deployment that depends on one transport has one failure mode.
The practical lesson is that protocol choice is one variable. Address diversity, hosting provider, probe response, port choice and operational testing decide whether a configuration stays reachable. A strong protocol on a blocked address is still blocked.
Maronix keeps improving its server configuration and setup against these findings, testing deployments on restricted networks and changing the details that stop working instead of treating one reachable setup as permanent.
Practical considerations#
- Install the client and save configurations before you travel. App-store access and account recovery can fail on the network you are trying to cross.
- Test fixed and mobile connections separately. Carriers can apply different rules, and a tunnel that works on Wi-Fi may fail on mobile data.
- Keep more than one transport and more than one endpoint. A single address or a single port is a single blocklist entry.
- Test the services you actually use, not just the tunnel handshake. A connection can open and still fail against a platform that blocks the destination or rejects the tunnel.
- Do not assume a domestic Wi-Fi network is unfiltered. All major carriers connect to the same border system, and provincial networks can add rules.
- Treat legal risk as separate from technical risk. Approved business connectivity is a different product from an unapproved consumer tunnel. This page describes network behaviour, not legal advice.
- Expect variation by province, carrier and date. A configuration that works this week can fail after a carrier sweep or a rule change, and the reason may be an address, a handshake or a port rather than the protocol.
Atlas articles#
- What Is Internet Censorship? - the five layers behind the Great Firewall
- What Is Deep Packet Inspection? - how middleboxes classify encrypted traffic
- Why a VPN Can Work Today and Fail Tomorrow - the difference between an address block, a protocol block and a probe
- What Makes a VPN Resistant to Censorship? - protocol, address, provider, placement, probing and operations
- What Is VLESS? - the proxy core used inside REALITY
- What Is REALITY? - borrowed handshakes and probe resistance
- What Is Hysteria2? - QUIC transport and its trade-offs
Sources
- China: Cybercrime Bill Entrenches Censorship, Surveillance Human Rights Watch
- As Beijing cracks down on VPNs, internet users in China find ways around the Great Firewall ABC News
- Behind the Great Firewall: What Leaked Data Reveals About VPN Use in China Global Public Policy Institute
- State Council Gazette Issue No. 28, Serial No. 1927: Decree No. 176 of the Ministry of Public Security The State Council of the People's Republic of China
- China Issues New Rules on Cyberspace Security Inspection Hunton Andrews Kurth
- Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025 GFW Report
- A Wall Behind A Wall: Emerging Regional Censorship in China (IEEE S&P 2025) GFW Report
- Exposing and Circumventing SNI-based QUIC Censorship of the Great Firewall of China (USENIX Security 2025) USENIX
- How China Detects and Blocks Shadowsocks (ACM Internet Measurement Conference 2020) ACM
- Examining How the Great Firewall Discovers Hidden Circumvention Servers (IMC 2015) ACM SIGCOMM
Last reviewed October 30, 2026. Corrections and additions are welcome.