How to bypass ISP censorship - Revision history

Admin: /* V2Ray */

2026-06-06T10:44:33Z

V2Ray

← Older revision		Revision as of 10:44, 6 June 2026
Line 194:		Line 194:

	== [https://github.com/v2fly/v2ray-core V2Ray] ==		== [https://github.com/v2fly/v2ray-core V2Ray] ==
	A platform or framework for building proxies. It is not a single protocol, but a “box” that can manage multiple inbound and outbound protocols, transports, and advanced routing rules. By wrapping its proxy traffic inside Web Socket and TLS for example, it makes the traffic appear as standard, indistinguishable ~~HTTPS~~ traffic.		A platform or framework for building proxies. It is not a single protocol, but a “box” that can manage multiple inbound and outbound protocols, transports, and advanced routing rules. By wrapping its proxy traffic inside Web Socket and TLS for example, it makes the traffic appear as standard, indistinguishable web traffic.

	'''PROs:'''		'''PROs:'''
Line 203:		Line 203:
	'''CONs:'''		'''CONs:'''
	* <span style="color:red">'''Complex:'''</span> Requires understanding of its complex concepts of inbounds, outbounds, and transports.		* <span style="color:red">'''Complex:'''</span> Requires understanding of its complex concepts of inbounds, outbounds, and transports.
	* <span style="color:red">'''Performance Overhead:'''</span> ~~Layered~~ encryption adds ~~significant~~ latency.		* <span style="color:red">'''Performance Overhead:'''</span> In some methods layered encryption adds latency.
	* <span style="color:red">'''VMess is Detectable:'''</span> The original VMess protocol is now considered detectable by advanced GFW packet sniffing.		* <span style="color:red">'''VMess is Detectable:'''</span> The original VMess protocol is now considered detectable by advanced GFW packet sniffing.

Line 211:		Line 211:

	== [https://github.com/XTLS/Xray-core X-ray] ==		== [https://github.com/XTLS/Xray-core X-ray] ==
	A high-performance, open-source proxy platform and a fork of V2Ray. Developed by the XTLS community. Xray-core supports all of V2Ray's protocols and adds ~~XTLS~~. ~~XTLS is~~ a “direct encryption” technology that avoids the performance-draining “TLS-in-TLS” problem, resulting in lower latency and higher speeds ~~than most VLESS configurations~~.		A high-performance, open-source proxy platform and a fork of V2Ray. Developed by the XTLS community. Xray-core supports all of V2Ray's protocols and adds its own protocols. X-ray has a “direct encryption” technology that avoids the performance-draining “TLS-in-TLS” problem, resulting in lower latency and higher speeds.

	'''PROs:'''		'''PROs:'''
	* <span style="color:green">'''Faster:'''</span> X-ray with its ~~XTLS protocol~~ is generally considered faster and more efficient.		* <span style="color:green">'''Faster:'''</span> X-ray with its new protocols is generally considered faster and more efficient.
	* <span style="color:green">'''Backward Compatible:'''</span> Acts as a drop-in, enhanced replacement for V2Ray-core.		* <span style="color:green">'''Backward Compatible:'''</span> Acts as a drop-in, enhanced replacement for V2Ray-core.
	* <span style="color:green">'''Advanced Protocols:'''</span> ~~VLESS and XTLS are~~ highly effective at mimicking standard web traffic.		* <span style="color:green">'''Advanced Protocols:'''</span> It is highly effective at mimicking standard web traffic.

	'''CONs:'''		'''CONs:'''

Admin at 14:49, 5 June 2026

2026-06-05T14:49:56Z

@@ Line 91: / Line 91: @@
 * <span style="color:green">'''No IP Change:'''</span> Shares the same benefits as Zapret; it does not interfere with local, geo-restricted services. Also, no third party to trust.
 * <span style="color:green">'''Effective:'''</span> It is designed to actively bypass both “Passive DPI” (which tries to “race” the real server with a fake reset packet) and “Active DPI” (which sits in-line and modifies traffic).
 '''CONs:'''

Admin at 13:07, 5 June 2026

2026-06-05T13:07:11Z

← Older revision		Revision as of 13:07, 5 June 2026
Line 53:		Line 53:
	\| '''Level 1''' \|\| DNS over HTTPS (DNS over TLS can be blocked but it may be an easier solution if you use Android >9 since it is built-in) + Encrypted Client Hello (supported by most modern browsers)		\| '''Level 1''' \|\| DNS over HTTPS (DNS over TLS can be blocked but it may be an easier solution if you use Android >9 since it is built-in) + Encrypted Client Hello (supported by most modern browsers)
	\|-		\|-
	\| '''Level 2''' \|\| Level 1 + DPI bypassing (Zapret/GoodbyeDPI/DPI Tunnel v2/PowerTunnel)		\| '''Level 2''' \|\| Level 1 + DPI bypassing (Zapret/GoodbyeDPI/gecit/DPI Tunnel v2/PowerTunnel)
	\|-		\|-
	\| '''Level 3''' \|\| Level 2 + WireGuard (preferably with AmneziaWG protocol)		\| '''Level 3''' \|\| Level 2 + WireGuard (preferably with AmneziaWG protocol)

Admin: /* Tor Project */

2026-05-31T21:11:24Z

Tor Project

← Older revision		Revision as of 21:11, 31 May 2026
Line 273:		Line 273:

	'''CONs:'''		'''CONs:'''
	* <span style="color:red">'''~~Very~~ Slow:'''</span> ~~Impractical~~ for streaming or large downloads.		* <span style="color:red">'''Slow:'''</span> Sometimes impractical for streaming or large downloads.
	* <span style="color:red">'''Blocked by Default:'''</span> Relay lists are public and easily blocked.		* <span style="color:red">'''Blocked by Default:'''</span> Relay lists are public and easily blocked.
	* <span style="color:red">'''Stigma:'''</span> Can attract suspicion from ISPs or law enforcement.		* <span style="color:red">'''Stigma:'''</span> Can attract suspicion from ISPs or law enforcement.

Admin: /* Obfuscated Proxy Protocols & Platforms */

2026-05-31T21:10:12Z

Obfuscated Proxy Protocols & Platforms

← Older revision		Revision as of 21:10, 31 May 2026
Line 169:		Line 169:
	# '''Phase 1 (Encrypt):''' Standard VPNs (OpenVPN, WireGuard) are encrypted but have obvious “fingerprints”.		# '''Phase 1 (Encrypt):''' Standard VPNs (OpenVPN, WireGuard) are encrypted but have obvious “fingerprints”.
	# '''Phase 2 (Scramble):''' Tools like Shadowsocks and obfs4 encrypt and “scramble” traffic to look like “random” data.		# '''Phase 2 (Scramble):''' Tools like Shadowsocks and obfs4 encrypt and “scramble” traffic to look like “random” data.
	# '''Phase 3 (Mimic):''' Tools like V2Ray ~~(VLESS+TLS)~~ and Trojan are designed to mimic standard, benign HTTPS traffic.		# '''Phase 3 (Mimic):''' Tools like V2Ray and Trojan are designed to mimic standard, benign HTTPS traffic.
	# '''Phase 4 (Be Indistinguishable):''' Tools like Naïve Proxy reuse the actual network stack from a real browser (Chrome) to be bit-for-bit indistinguishable.		# '''Phase 4 (Be Indistinguishable):''' Tools like Naïve Proxy reuse the actual network stack from a real browser (Chrome) to be bit-for-bit indistinguishable.

Line 181:		Line 181:
	'''CONs:'''		'''CONs:'''
	* <span style="color:red">'''Detectable by Advanced DPI:'''</span> Advanced DPI can detect Shadowsocks traffic through traffic analysis and active probing.		* <span style="color:red">'''Detectable by Advanced DPI:'''</span> Advanced DPI can detect Shadowsocks traffic through traffic analysis and active probing.
	* <span style="color:red">'''Not a Full VPN:'''</span> Does not tunnel all system traffic by default, ~~leading~~ to ~~potential “leaks”~~.		* <span style="color:red">'''Not a Full VPN:'''</span> Does not tunnel all system traffic by default, it is your job to be sure everything uses it.

	== [https://github.com/v2fly/v2ray-core V2Ray] ==		== [https://github.com/v2fly/v2ray-core V2Ray] ==
	A platform or framework for building proxies. It is not a single protocol, but a “box” that can manage multiple inbound and outbound protocols, transports, and advanced routing rules. By wrapping its proxy traffic inside Web Socket and TLS, it makes the traffic appear as standard, indistinguishable HTTPS traffic.		A platform or framework for building proxies. It is not a single protocol, but a “box” that can manage multiple inbound and outbound protocols, transports, and advanced routing rules. By wrapping its proxy traffic inside Web Socket and TLS for example, it makes the traffic appear as standard, indistinguishable HTTPS traffic.

	'''PROs:'''		'''PROs:'''
Line 201:		Line 201:

	== [https://github.com/XTLS/Xray-core X-ray] ==		== [https://github.com/XTLS/Xray-core X-ray] ==
	A high-performance, open-source proxy platform and a fork of V2Ray. Developed by the XTLS community. Xray-core supports all of V2Ray's protocols and adds XTLS. XTLS is a “direct encryption” technology that avoids the performance-draining “TLS-in-TLS” problem, resulting in lower latency and higher speeds than VLESS~~+TLS~~.		A high-performance, open-source proxy platform and a fork of V2Ray. Developed by the XTLS community. Xray-core supports all of V2Ray's protocols and adds XTLS. XTLS is a “direct encryption” technology that avoids the performance-draining “TLS-in-TLS” problem, resulting in lower latency and higher speeds than most VLESS configurations.

	'''PROs:'''		'''PROs:'''

Admin: /* Zapret */

2026-05-31T14:30:23Z

Zapret

← Older revision		Revision as of 14:30, 31 May 2026
Line 81:		Line 81:

	'''CONs:'''		'''CONs:'''
	* <span style="color:red">'''No Extra Privacy or Anonymity:'''</span> This is ~~critical~~ to ~~understand~~. Zapret does not provide extra privacy or anonymity. Your ISP can still see which sites you are visiting; the tool just prevents the automated block to provide access.		* <span style="color:red">'''No Extra Privacy or Anonymity:'''</span> This is important to know. Zapret does not provide extra privacy or anonymity. Your ISP can still see which sites you are visiting; the tool just prevents the automated block to provide access.
	* <span style="color:red">'''Specific Use Case:'''</span> It only defeats DPI. It does not bypass DNS-level blocking (it must be paired with an encrypted DNS service like DoH/DoT) or IP-address-level bans.		* <span style="color:red">'''Specific Use Case:'''</span> It only defeats DPI. It does not bypass DNS-level blocking (it must be paired with an encrypted DNS service like DoH/DoT) or IP-address-level bans.

Admin: /* How Online Content is Blocked */

2026-05-31T12:50:46Z

How Online Content is Blocked

← Older revision		Revision as of 12:50, 31 May 2026
Line 13:		Line 13:
	: The censor intercepts requests to resolve a domain name and either returns no answer or a false IP address. This is the simplest and most common form of blocking, but also the easiest to bypass in some cases. To bypass it, a third party (not from your ISP) DNS server should be used with a DNS protocol supporting encryption like DNS over HTTPS. If blocks are still in place, your ISP may be using DPI.		: The censor intercepts requests to resolve a domain name and either returns no answer or a false IP address. This is the simplest and most common form of blocking, but also the easiest to bypass in some cases. To bypass it, a third party (not from your ISP) DNS server should be used with a DNS protocol supporting encryption like DNS over HTTPS. If blocks are still in place, your ISP may be using DPI.
	; Deep Packet Inspection (DPI)		; Deep Packet Inspection (DPI)
	: This is a more advanced method. State-level “middle boxes” (like Russia's TSPU or China's Great Firewall (GFW)) actively inspect the content of unencrypted (or encrypted for their own certificate authority) traffic. For encrypted traffic, they inspect the “metadata,” such as the Server Name Indication (SNI) in a TLS handshake. The SNI field, which states the domain you are visiting, is unencrypted and provides a simple way for censors to identify and block HTTPS connections. However, even when SNI is encrypted or absent, advanced middle boxes can infer your destination through non-SNI leaks. They achieve this by analyzing TLS fingerprints (like JA4 signatures), monitoring packet sizes and timing patterns to profile websites. Even if a client successfully hides the destination domain during the initial handshake (for instance, by omitting the SNI), censors can simply look at the plaintext certificate returned by the server in some cases. In standard TLS connections below version 1.3, the server sends its X.509 certificate completely unencrypted. Censors intercepting this packet instantly know exactly which website you are communicating with. Bypassing ~~this~~ requires specialized programs. If blocks are still in place, your ISP may be using IP blacklisting.		: This is a more advanced method. State-level “middle boxes” (like Russia's TSPU or China's Great Firewall (GFW)) actively inspect the content of unencrypted (or encrypted for their own certificate authority) traffic. For encrypted traffic, they inspect the “metadata,” such as the Server Name Indication (SNI) in a TLS handshake. The SNI field, which states the domain you are visiting, is unencrypted and provides a simple way for censors to identify and block HTTPS connections. However, even when SNI is encrypted or absent, advanced middle boxes can infer your destination through non-SNI leaks. They achieve this by analyzing TLS fingerprints (like JA4 signatures), monitoring packet sizes and timing patterns to profile websites. Even if a client successfully hides the destination domain during the initial handshake (for instance, by omitting the SNI), censors can simply look at the plaintext certificate returned by the server in some cases. In standard TLS connections below version 1.3, the server sends its X.509 certificate completely unencrypted. Censors intercepting this packet instantly know exactly which website you are communicating with. Bypassing DPI requires specialized programs. If blocks are still in place, your ISP may be using IP blacklisting.
	; IP Blacklisting		; IP Blacklisting
	: The censor blocks all network traffic to and from known IP addresses associated with a “forbidden” service (e.g., a VPN provider's servers or a specific website). Bypassing this is harder and requires connecting to a proxy/VPN server that doesn't have these restrictions. This can create a chicken-and-egg problem, like a proxy/VPN service being IP blocked but needing a proxy/VPN to bypass it.		: The censor blocks all network traffic to and from known IP addresses associated with a “forbidden” service (e.g., a VPN provider's servers or a specific website). Bypassing this is harder and requires connecting to a proxy/VPN server that doesn't have these restrictions. This can create a chicken-and-egg problem, like a proxy/VPN service being IP blocked but needing a proxy/VPN to bypass it.

Admin at 10:32, 18 May 2026

2026-05-18T10:32:03Z

← Older revision		Revision as of 10:32, 18 May 2026
Line 13:		Line 13:
	: The censor intercepts requests to resolve a domain name and either returns no answer or a false IP address. This is the simplest and most common form of blocking, but also the easiest to bypass in some cases. To bypass it, a third party (not from your ISP) DNS server should be used with a DNS protocol supporting encryption like DNS over HTTPS. If blocks are still in place, your ISP may be using DPI.		: The censor intercepts requests to resolve a domain name and either returns no answer or a false IP address. This is the simplest and most common form of blocking, but also the easiest to bypass in some cases. To bypass it, a third party (not from your ISP) DNS server should be used with a DNS protocol supporting encryption like DNS over HTTPS. If blocks are still in place, your ISP may be using DPI.
	; Deep Packet Inspection (DPI)		; Deep Packet Inspection (DPI)
	: This is a more advanced method. State-level “middle boxes” (like Russia's TSPU or China's Great Firewall (GFW)) actively inspect the content of unencrypted (or encrypted for their own certificate authority) traffic. For encrypted traffic, they inspect the “metadata,” such as the Server Name Indication (SNI) in a TLS handshake. The SNI field, which states the domain you are visiting, is unencrypted and provides a simple way for censors to identify and block HTTPS connections. Bypassing this requires specialized programs. If blocks are still in place, your ISP may be using IP blacklisting.		: This is a more advanced method. State-level “middle boxes” (like Russia's TSPU or China's Great Firewall (GFW)) actively inspect the content of unencrypted (or encrypted for their own certificate authority) traffic. For encrypted traffic, they inspect the “metadata,” such as the Server Name Indication (SNI) in a TLS handshake. The SNI field, which states the domain you are visiting, is unencrypted and provides a simple way for censors to identify and block HTTPS connections. However, even when SNI is encrypted or absent, advanced middle boxes can infer your destination through non-SNI leaks. They achieve this by analyzing TLS fingerprints (like JA4 signatures), monitoring packet sizes and timing patterns to profile websites. Even if a client successfully hides the destination domain during the initial handshake (for instance, by omitting the SNI), censors can simply look at the plaintext certificate returned by the server in some cases. In standard TLS connections below version 1.3, the server sends its X.509 certificate completely unencrypted. Censors intercepting this packet instantly know exactly which website you are communicating with. Bypassing this requires specialized programs. If blocks are still in place, your ISP may be using IP blacklisting.
	; IP Blacklisting		; IP Blacklisting
	: The censor blocks all network traffic to and from known IP addresses associated with a “forbidden” service (e.g., a VPN provider's servers or a specific website). Bypassing this is harder and requires connecting to a proxy/VPN server that doesn't have these restrictions. This can create a chicken-and-egg problem, like a proxy/VPN service being IP blocked but needing a proxy/VPN to bypass it.		: The censor blocks all network traffic to and from known IP addresses associated with a “forbidden” service (e.g., a VPN provider's servers or a specific website). Bypassing this is harder and requires connecting to a proxy/VPN server that doesn't have these restrictions. This can create a chicken-and-egg problem, like a proxy/VPN service being IP blocked but needing a proxy/VPN to bypass it.
Line 53:		Line 53:
	\| '''Level 1''' \|\| DNS over HTTPS (DNS over TLS can be blocked but it may be an easier solution if you use Android >9 since it is built-in) + Encrypted Client Hello (supported by most modern browsers)		\| '''Level 1''' \|\| DNS over HTTPS (DNS over TLS can be blocked but it may be an easier solution if you use Android >9 since it is built-in) + Encrypted Client Hello (supported by most modern browsers)
	\|-		\|-
	\| '''Level 2''' \|\| Level 1 + ~~WireGuard~~ (~~preferably with AmneziaWG protocol~~)		\| '''Level 2''' \|\| Level 1 + DPI bypassing (Zapret/GoodbyeDPI/DPI Tunnel v2/PowerTunnel)
	\|-		\|-
	\| '''Level 3''' \|\| Level 2 + ~~DPI bypassing~~ (~~Zapret/GoodbyeDPI~~)		\| '''Level 3''' \|\| Level 2 + WireGuard (preferably with AmneziaWG protocol)
	\|-		\|-
	\| '''Level 4''' \|\| Level 3 + tools similar to V2Ray		\| '''Level 4''' \|\| Level 3 + tools similar to V2Ray or DNS tunneling (slow)
	\|-		\|-
	\| '''Level 5''' \|\| '''Do Your Own Research If You Still Can't Connect to Websites'''		\| '''Level 5''' \|\| '''Do Your Own Research If You Still Can't Connect to Websites'''
Line 94:		Line 94:
	'''CONs:'''		'''CONs:'''
	* <span style="color:red">'''No Extra Privacy or Anonymity:'''</span> Like Zapret, this provides no extra encryption and is not a privacy tool. It is for access only.		* <span style="color:red">'''No Extra Privacy or Anonymity:'''</span> Like Zapret, this provides no extra encryption and is not a privacy tool. It is for access only.

			== Mobile DPI Bypass Tools ==
			Stand-alone, open-source DPI circumvention tools exists on mobile devices too. They are mostly inspired by Zapret. The catch being not being capable as tools designed for computers. They mostly rely on 3 ways to see the packets. Having root, giving the VPN slot to the app, setting up a proxy inside your phone. You will usually have to set the bypass rules manually. Most popular ones are “DPI Tunnel v2”, “Bye DPI”, “Power Tunnel”. They don't increase battery usage that much compared to VPNs.

			'''PROs:'''
			* <span style="color:green">'''High Performance:'''</span> Adds negligible latency. It is significantly faster than a full tunnel.
			* <span style="color:green">'''No IP Change:'''</span> It does not change your public IP address, making it ideal for accessing local, geo-restricted services (like banking, streaming, or city services) that would be broken by a VPN. It also does not need to trust any third party servers.
			* <span style="color:green">'''Easy to Use:'''</span> After initial configuration, enabling or disabling is only one press.

			'''CONs:'''
			* <span style="color:red">'''No Extra Privacy or Anonymity:'''</span> These tools don't provide extra privacy or anonymity. Your ISP/GSM can still see which sites you are visiting; the tool just prevents the automated block to provide access.
			* <span style="color:red">'''Needs either root or a VPN slot:'''</span> Android only allows one active VPN slot at a time. If you are running a DPI bypass app, you cannot simultaneously run a standard VPN or a system-wide ad blocker without root.

	= Standard (Non-Obfuscated) Protocols =		= Standard (Non-Obfuscated) Protocols =

Admin: /* Tor vs. I2P Comparison */

2026-05-15T19:52:46Z

Tor vs. I2P Comparison

← Older revision		Revision as of 19:52, 15 May 2026
Line 389:		Line 389:

	= Tor vs. I2P Comparison =		= Tor vs. I2P Comparison =
	''This part of the guide is taken from the [https://geti2p.net/en/comparison/tor i2p projects comparison page]~~. You may read the [[Tor Overview]] page to learn how Tor works~~.''		''This part of the guide is taken from the [https://geti2p.net/en/comparison/tor i2p projects comparison page].''

	{\| class="wikitable" style="width:100%; vertical-align:top;"		{\| class="wikitable" style="width:100%; vertical-align:top;"

Admin at 19:46, 15 May 2026

2026-05-15T19:46:24Z

Show changes