Mint Tea

Posted on Feb 4

Studying the Great Firewall's obfuscation and detection techniques (GFW)

#networking #china #vpn #security

The Great Firewall (GFW) doesn't just block IP addresses anymore, it actively inspects traffic using stateful deep packet inspection (DPI). If you're relying on standard OpenVPN or WireGuard in 2026, you're already blocked.

This guide explains how the GFW works (brief technical overview), why your VPN keeps dying, and how to deploy robust self-hosted solutions like Hysteria2 and V2Ray on optimized CN2 GIA routes.

The Mechanics of Active Filtering

The GFW employs active filtering techniques to sabotage and attack any existing VPN connections. It doesn't sit "in-line" blocking every packet (that would slow down the entire country). Instead, it mirrors traffic via optical splitters at the international gateway.

When it sees a handshake it doesn't like—say, a TLS Client Hello with a suspicious SNI—it weaponizes the TCP protocol against you.

TCP Reset Injection

The GFW injects forged TCP RST (Reset) packets.

To You: A packet that looks like it came from the server saying "Stop."
To the Server: A packet that looks like it came from you saying "Stop."

Because the GFW is physically closer to you than the server is, its fake packet wins the race. Your connection dies instantly.

DNS Hijacking

For UDP traffic (DNS), the GFW uses DNS Hijacking. It detects queries for banned domains and immediately shoots back a fake DNS response with a garbage IP. Your computer accepts the first answer it gets (the fake one) and ignores the real answer that arrives milliseconds later.

Why Commercial VPNs Fail

Most big-name VPNs are huge targets.

Static Signatures: Their protocols have predictable headers.
Active Probing: Once the GFW suspects a server, it sends its own "probe" to your server. If your server replies like a VPN, the IP gets blacklisted.
Shared IPs: Thousands of users on one IP makes traffic analysis trivial.

So by purchasing a large commercial VPN, you are essentially painting a big red target on your back.

Solution 1: Hysteria2 (The Speed King)

Hysteria2 is built on UDP (QUIC), similar to HTTP/3. It uses a custom congestion control called Brutal that ignores packet loss, making it incredibly fast even on bad lines. Brutal works by "brute forcing" packages through congested lines, ignoring previously negotiated limits. I have personally used hysteria2 for my trips in china during june and september 2025 and they have proven themselves to be reliable options in China.

However, it is important to note that QUIC has been limited (and somewhat throttled in china) due to the widespread usage of QUIC vpns (which is what Hysteria2 is based on)
https://gfw.report/publications/usenixsecurity25/zh/

How to Self-Host Hysteria2

You need a VPS (Virtual Private Server).

Installation (Linux):

# Download the latest release
bash <(curl -fsSL https://get.hy2.sh/)

# Configure config.yaml
listen: :443
tls:
  cert: /path/to/your.crt
  key: /path/to/your.key
auth:
  type: password
  password: "your_secure_password"
masquerade:
  type: proxy
  proxy:
    url: https://bing.com
    rewriteHost: true

Note: You need a valid domain name and some technical knowledge on forwarding (you may need to forward ip addresses through cloudflared, or rent a VPS from digitalOcean for it to work effortlessly.

Why Self-Host?

Privacy: No logs. You own the pipe.
IP Reputation: You aren't sharing an IP with 5,000 other people (some of whom are doing shady stuff).
Speed: No throttling from a provider.

Solution 2: V2Ray (The Stealth Master)

V2Ray (specifically VLESS + XTLS-Reality) is designed to look exactly like you're browsing a normal website. It "steals" the TLS handshake of a real site (like Microsoft or Apple), so to the GFW, you're just visiting a safe page.

V2Ray comes in 2 flavours: Vmess and vless. I generally recommend vless because it's a lighter and newer protocol.

How to Self-Host V2Ray (using 3X-UI)

The easiest way is using the 3X-UI panel.

Installation:

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

Access the panel at http://YOUR_IP:2053.
Go to Inbounds -> Add Inbound.
Select Protocol: VLESS.
Enable XTLS-Reality security.
Set Dest to www.microsoft.com:443 and Server Names to www.microsoft.com.

Client Setup

For Android/iOS, use hApp or v2rayNG.

Import your server string (vless:// or hysteria2://).
Crucial Step: Set "Routing" to "Bypass LAN & Mainland China". This ensures your WeChat/Alipay traffic doesn't go through the VPN (which slows it down).

The fourth option??

Shadowsocks has also existed for a long time, being essentially a modified version of socks5 with obfuscation since 2016. while it still works as of writing in China, it is becoming increasingly unreliable due to the obfuscation having a clear entropy fingerprint that can be detected by the GFW. Using shadowsocks exposes you to a higher risk of getting your server IP banned, though personally it has not happened to me before.

The Critical Factor: Routing (CN2 GIA)

Protocol is only half the battle. If your physical route to the server is congested, no software can fix it.

CN2 GIA (China Telecom Next Gen Carrier Network - Global Internet Access) is the premium lane. It avoids the congested public backbone (163 network).

163 Network: High packet loss (10-20%) during peak hours.
CN2 GIA: <1% packet loss, stable latency.

If you self-host, pay extra for a provider that guarantees CN2 GIA routes.

What if i dont want to self host?

Self-hosting is fun, but hunting for clean CN2 GIA IPs and maintaining servers got annoying fast. So, I built a solution to scratch my own itch.

I developed V-Rail to automate all of this. It deploys fully optimized CN2 GIA nodes with Hysteria2 pre-configured, so you don't have to mess with config files or worry about IP blocks. I've already done the hard work for you—feel free to check it out if you'd rather spend your time coding instead of debugging routing tables.

Alternatively, you may also use other vpns like astrilVPN or letsVPN but V-Rail, built on VLess, is the cheapest and most reliable option of the three, costing only 2.49 USD/month for 50GB of unthrottled data. Furthermore, one account could be used across different devices.

DEV Community