Getting Around Internet Censorship

There is no single best circumvention tool. Each one is a disguise, and a disguise works only until the censor learns to see through it. The useful question is not "which app is best?" but "how is my network being censored right now, and what does that rule out?"

How networks are censored

Censors combine several techniques, roughly in order of cost and sophistication:

Research from GFW Report and others has documented these techniques in detail, including how China's Great Firewall detected Shadowsocks servers through active probing and, from 2021, began blocking "fully encrypted" traffic that looks like random bytes. The same arms race plays out in Iran, Russia, Turkmenistan and elsewhere.

The main tool families

Tor with pluggable transports

Tor bridges provide entry points absent from the public relay directory. Pluggable transports change how the connection looks on the network; their effectiveness depends on local filtering. Compare obfs4, Snowflake, meek and WebTunnel in Pluggable transports and bridges, then follow Using Tor Safely.

Psiphon and Lantern

Psiphon tries different servers and transports to get through blocking. Its operator manages discovery and connection strategies; its own documentation says it is not an anonymity tool. The entry explains its open core and current metadata-retention policy. Lantern is another app to consider, with its own operator and trust model.

Your own server: Outline, Xray, AmneziaWG

Running your own proxy lets you choose a host and share access with a small group. A rented address is not guaranteed to be unknown to a censor. Follow Run a private circumvention server for people you know for deployment, routing checks and revocation.

• Outline, launched by Jigsaw and now owned by the Outline Foundation, pairs a Shadowsocks server with Manager and shareable access keys. You choose the host and remain responsible for its operation.
• Xray-core (https://github.com/XTLS/Xray-core) implements VLESS with REALITY, which makes the server impersonate the TLS handshake of a real, popular website, so that an active probe sees a normal site. This family of tools is widely used where other tunnels are blocked, notably in Iran, Russia and China.
• AmneziaWG is a WireGuard-Go fork that adds obfuscation to reduce recognisable packet signatures. Standard WireGuard has no built-in obfuscation; neither encryption nor a private server address guarantees resistance to blocking.
• Hysteria 2 (https://v2.hysteria.network/) is a QUIC-based proxy designed for lossy, throttled networks.

Your own server gives you access, not anonymity: the hosting company and anyone watching the server can see the traffic leaving it. If you need anonymity too, run Tor over the tunnel.

Commercial VPNs

A VPN moves trust from your ISP to the VPN company. Standard OpenVPN and WireGuard are easy to fingerprint, and well-known VPN providers' IP ranges are routinely blocked. Some providers offer obfuscation modes; test them before you depend on them. Choose a provider whose ownership, jurisdiction and logging claims you have checked, preferably one that accepts anonymous payment.

Choosing, in practice

1. Read existing measurements first. OONI explains how to investigate website, messaging and circumvention-tool reachability. An anomaly is not proof of censorship. Before running Probe yourself, review its visibility, publication settings and documented risks.
2. Keep more than one option installed. Censors change tactics during protests and elections. A second and third tool, set up in advance, are worth more than a perfect first one.
3. Get your bridges and keys before you need them. Distribution channels are the first thing to be blocked.
4. Match the tool to the need. For reading news, anything that works is fine. For organising or communicating with sources, use Tor or tunnel Tor through your proxy.
5. Mind the legal risk. In some countries using circumvention tools is itself an offence, and police check phones at checkpoints. Consider how visible the apps on your device are.

Publishing so that it cannot be blocked

Circumvention also works the other way: make your own content hard to censor. Publish an onion service, mirror on several hosts and jurisdictions, use content-addressed storage, and avoid depending on a single domain name. See Publishing an Uncensorable Website and Map: Censorship Resistance.

Primary sources

• Tor's current transport and bridge guide.
• Psiphon FAQ, trust model and data handling.
• Outline FAQ and current ownership.

• WireGuard's obfuscation limitations.

• GFW Report, How China Detects and Blocks Shadowsocks (ACM IMC 2020): https://gfw.report/publications/imc20/en/

• Wu et al., How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic (USENIX Security 2023): https://gfw.report/publications/usenixsecurity23/en/
• Tor Project, Circumvention (Tor Browser manual): https://tb-manual.torproject.org/circumvention/
• OONI, Open Observatory of Network Interference: https://ooni.org/
• Project REALITY documentation (Xray-core): https://github.com/XTLS/REALITY
• Amnezia, AmneziaWG: https://docs.amnezia.org/documentation/amnezia-wg/
• IETF TLS Working Group, TLS Encrypted Client Hello: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/

Continue with DNSCrypt and dnscrypt-proxy and Mullvad VPN.

Also in Anonymity Networks