GFW Report
gfw.report · Group blog · on HN since 2019
GFW Report is a research group that analyzes how the Great Firewall of China detects, blocks and can be circumvented.
What HN saysHN commenters cite it as a reliable source on Chinese censorship, covering SNI and ESNI blocking, deep packet inspection, and the ongoing cat-and-mouse with circumvention tools.
30HN people shared it
9linked it in comments
21stories submitted
768story points
9 months agolast shared
2019people per year2026
Most-shared posts
- 1Wallbleed: A Memory Disclosure Vulnerability in the Great Firewall of China6 people · 43 points · first shared 2025 · 1 comments on HN
- 2How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic5 people · 1 points · first shared 2023 · discussion on HN
- 3Geedge and MESA leak: Analyzing the great firewall’s largest document leak2 people · 447 points · first shared 2025 · 137 comments on HN
- 4Analysis of the GFW's Unconditional Port 443 Block on August 20, 20252 people · 224 points · first shared 2025 · 180 comments on HN
- 5Expose and Circumvent SNI-Based QUIC Censorship of the Great Firewall of China2 people · 14 points · first shared 2025 · discussion on HN
- 6How China Detects and Blocks Shadowsocks2 people · 12 points · first shared 2019 · 2 comments on HN
- 7How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic [pdf]2 people · 5 points · first shared 2023 · discussion on HN
- 8Great Chinese Firewall Report2 people · 4 points · first shared 2024 · discussion on HN
- 9Great Firewall Report2 people · 3 points · first shared 2025 · discussion on HN
- 10En2 people · first shared 2020
- 11Wallbleed: A Memory Disclosure Vulnerability in the Great Firewall of China [pdf]1 people · 10 points · first shared 2025 · discussion on HN
- 12Reflections on Apple's iCloud Private Relay1 people · 3 points · first shared 2021 · 1 comments on HN
- 13Exposing and Circumventing SNI-Based QUIC Censorship of the Great Firewall [pdf]1 people · 2 points · first shared 2025 · discussion on HN
- 14En1 people · first shared 2021
- 15En1 people · first shared 2021
What HN people wrote when they linked it
RandyOrion · 2026-01-26
NO.
They can do unconditional blocking at any moment and suddenly you can experience Internet blackout. [1]
The censorship from GFW is ever evolving. See the endless cat-and-mouse games yourself. [2][3]
[1] https://github.com/net4people/bbs/issues/511
[2] https://github.com/net4people/bbs/issues?q=is%3Aissue+state%3Aopen+lab…
[3] https://gfw.report/en/
xyzzy123 · 2025-09-14
According to https://gfw.report/publications/usenixsecurity25/en/#3 they sniff the SNI out of the handshake like for TLS.
1vuio0pswjnm7 · 2025-08-31
China has blocked ESNI
https://gfw.report/blog/gfw_esni_blocking/en/
But SNI is not CH and ESNI is not ECH
Will China block ECH
ECH blocking has been detected in Russia
https://github.com/net4people/bbs/issues/417
According to Niere et al. (2025)
"Additionally, with the ECH extension not yet being widely used [17], [71] and focusing on privacy protection rather than censorship circumvention [60], it can be censored easily by blocking it entirely [14], [76]."
The paper describes various GFW bypass methods that currently work, including removing the SNI extension entirely
It does not mention anyone using ECH to bypass GFW
Perhaps it is too early to conclude "China blocks ECH" because ECH is not in widespread use
ykl · 2025-08-28
This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private servers) from inside of China anymore, and it's usually not even possible to _tunnel_ a VPN connection through some other protocol because the GFW now detects that too.
Stepping back and looking at it from a purely technical perspective, it's actually insanely impressive.
Here's a USENIX paper from a few years ago on how it is done: https://gfw.report/publications/usenixsecurity23/en/
codedokode · 2024-08-25
You can start with studying research work about Chinese firewall to get the idea how DPI usually works [1]. Then you can start up a Wireshark and try sending different packets and see which are blocked and which pass through, or experiment with modifying VPN packets to make them pass through.
To experiment with this you need to buy a VPS abroad.
If you don't want to do that then you can search for existing utilities like: GoodbyeDPI, XRay/reality, AmneziaVPN etc.
[1] https://gfw.report/publications/usenixsecurity23/en/
ytch · 2024-01-20
China uses statistics, entropy of packets and other DPI-like methods[1],
also HN discussions of it[2]:
[1] https://gfw.report/publications/usenixsecurity23/en/
[2] https://news.ycombinator.com/item?id=36531485
Snawoot · 2023-05-05
Wireguard is known to be fingerprintable[1]. But at this moment it is unlikely UDP traffic will be filtered by Chinese GFW[2]. But this may change any moment.
[1]: https://lists.zx2c4.com/pipermail/wireguard/2018-September/003290.html
[2]: https://gfw.report/publications/usenixsecurity23/en/#sec:residual
beermonster · 2021-02-06
Shadowsocks always used to work well enough to evade the GFoC if you hosted your own VPS. Which is simpler than say strongSwan - and IPSEC gives the game away anyway.
https://gfw.report/blog/ss_advise/en/
https://gfw.report/blog/ss_tutorial/en/
justDankin · 2020-09-29
Ah yes, my bad. I meant to say ESNI
Read https://gfw.report/blog/gfw_esni_blocking/en/ some time back, recalled it incorrectly