Notes

The Incomplete Guides On Getting Past The GFW

Warning

I'm not claiming to be an expert on these subject matters. I'm just someone on the Internet that has read a lot on these subjects and topics related to the GFW. Using what I have learned, through many trials and errors, I'm able to set up multiple types of proxy servers and clients. So any information I write on these subject matters could be incorrect and might not work for you on your end.

The reason I call these guides incomplete is the constant "cat and mouse" game between China's Great Firewall(GFW) and Chinese Internet users over blocking and accessing websites outside of China. OpenVPN and wireguard(used by many popular VPN providers) protocols are easily detected by the GFW's deep packet inspection(DPI), as those protocols have very predictable packet sizes and packet header labels them as OpenVPN or wireguard. Which works great outside of China, Iran, and Russia. As most countries around the world's ISP don't use DPI on your Internet traffic.

Speaking of Iran and Russia, I don't have any experience with those two countries' firewalls. So I can't say these guides will help anyone getting past their firewalls. All I know is that China uses blacklisting, Iran uses whitelisting, and Russia maybe uses a combination of both. With blacklisting, you can't access any domain names and/or IP addresses(including VPN servers) that are on the blacklist with new ones being added temporarily or permanently by DPI. With whitelisting, you can only access domain names and/or IP addresses that are in the whitelist. That’s why Iranian Internet traffic dropped by 99% when their firewall changed to a full whitelisting system.

China GFW, ISP, and VPN/Proxy Providers

So the GFW is not just one great firewall like the Great Wall of China. There are firewall servers located all over China at datacenters used by all of the Chinese IPS. So during politically sensitive events like National Party Congress, all the firewall servers will heavily block well known China VPN/proxy providers.

There are three major Internet Service Providers(ISP) in China. While all three provide mobile Internet services, China Telecom and China Unicom also provide broadband Internet service with China Mobile well being mobile only. From my experience, I chose China Unicom over the other two providers for both mobile and broadband. Some apartment buildings only have either China Unicom or Telecom as the only broadband provider, but I find China Telecom's network is overloaded during holidays when everyone is streaming IPTV at home. I find China Mobile will actively start blocking when I use it for a couple of minutes on my phone.

Note

Jichang(机场), translated as Airport, is Chinese slang term for Chinese commercial VPN/proxy service.

I have stopped using commercial VPN/proxy in China. There is a big dichotomy for these providers. The more popular your service gets, the more likely your servers get blocked by the GFW. There is no way to hide the IP addresses of those servers. The VPN/proxy client app needs to know the hostnames/IP addresses of VPN/proxy servers, so it could try to connect to them. So the people who run the GFW just have to subscribe to the popular services and they also get the same list of IP addresses. So during sensitive events, they just put those IP addresses on the blacklist. Doesn't matter if they keep changing the IP addresses, get to see the new ones as soon as they put them out to their customers.

So you will see many posts on different China sub-Reddits saying ShadowFly, V1VPN, LetsVPN, WannaFlix, Astrill, or Mullvad works great for me and then you see the post get downvoted with a reply saying same provider isn't working for them. Well the original poster might be in a different part of China with a different ISP than the person that's replying. Or the same VPN provider might work great on one day and another day, it stops working because the GFW decide to block their servers.

Running Your Own VPN/Proxy Server

So the answer is to running your VPN/proxy server. From now on, it's just going to call it a proxy server. VPN protocols encrypt their traffic and hide your real IP address and don't actively hide themselves from DPI. The proxy protocols that I'm writing about are trying to actively disguise themselves as regular Internet traffic to hide from DPI.

You're the only one using the proxy server(s). You might share the server(s) with a couple of friends or family members. So it's very unlike it/they get noticed by the GFW.

Proxy Hosting Server

I have multiple proxy servers set up with different VPS hosting providers. Basically I find cheapest hosting deals at LowEndTalk.com, usually with 1vCPU, +1GB RAM, and +10GB Storage. I paid from US$1 to $5 a month and unlimited data usage of 1TB to unlimited. The cheaper the VPS you get, the more likely you're sharing the resources on the physical server. While running the proxy service on the VPS does not take a lot of CPU, memory, nor disk resources, but you might not have enough data transfer rate to watch a 1080p video on YouTube or Netflix.

On the order page for the VPS, there will be a selection of Linux OS that will be installed on the VPS. Always select Debian and the latest stable version, 13 "trixie". Some providers might only have the older version 12 "bookworm", which stopped being actively being supported by the main team, but by volunteers that might not give timely security updates.

Note

I also set up a used Dell mini computer at a family member's home and running Debian Linux with 3x-ui as my last resort backup server. It's mainly connected to it when my banking website won't let me log in because they detect a VPN IP address.

Domain Name

Although it's not required, you should a register a domain and have unique hostname for each of your VPS servers. Especially if you're planning to use Cloudflare CDN. You don't have to buy and register a domain with, they cost around $10 per year. You could get Porkbun.com and register a .top domain for less than $2 and pay $5 to renew it. It just need extra steps to have Cloudflare being the 2 DNS servers for the domain and copy the DNSSEC info over PorkBun.com to lock it down.

3x-ui Web Control Panel

3x-ui is a set of bash script that one can run a Linux server and install web service that will allow one to setup a proxy server that support multiple proxy protocols without the need for one to manually create and edit a bunch of config and script files to run the proxy server properly. It basically setup a nice web front end for the Xray-core that does all hard work of the proxy server.

Proxy Protocols

Basically, the guides will you two of the most useful proxy protocols current out there, Vless and Hysteria2. Hysteria2 is faster as it uses UDP verse Vless that uses TCP. Basically, TCP trys to verify that every data packet that is being send has made it to it's intended destination. While UCP doesn't care it the data packet gets there or not. And if it didin't, it assumes that the destination doesn't care if the packet has been lost. If destination does care, it will ask for the packet again. UCP is great for streaming video. But it will still work for regular web traffic. I mainly use Hysteria2 for my day to day Internet usage.

Vless has many options as it can support different transport and security protocols. Transport/Transmission protocol like raw(just regular web), web socket, gRPC, and other older ones to the latest XHTTP. For security. it can use none, TLS(same secure cert use by HTTPS), or latest Reality(which it will mask the traffic from another domain name).

Cloudflare CDN

Another method of hiding is to put the proxy server behind content delivery network(CDN) like the free one from Cloudflare.

Warning

Protocol that already can mask their traffic does not work with CDN like Hysteria2 and Reality.

Client Apps

There proxy client for the major OS, including ones for OpenWrt Router. Some of them, especially the ones for mobile phones, doesn't support all of latest proxy/transport protocol.

Recommended apps that support Hysteria2, Vless/XHTTP/Reality, and Vless/XHTTP with Cloudflare CDN.

There are also clients available for OpenWrt/ImmortalWrt like OpenClash, Passwall, and Passwall2. I have written an install guide for Passwall2 on OpenWrt routers and write a setup/user guide for Passwall2 sometime in the future.