How National Firewalls Detect and Block VPN Traffic Without Breaking Encryption
This explainer analyzes the techniques used by state-level censors and national firewalls, most notably China's Great Firewall, to detect and block VPN traffic without decrypting it. It stresses that detection relies on metadata rather than cryptanalysis: IP reputation and blocklisting of known VPN datacenter ranges, port/protocol filtering, deep packet inspection (DPI) of protocol-specific handshake patterns (e.g., WireGuard's fixed 148-byte initiation and 92-byte response messages, OpenVPN header patterns), TLS fingerprinting, and active probing of suspected proxy servers. The article cites academic research showing these methods can identify the large majority of VPN flows on real ISP networks, and explains how the Great Firewall shifted in November 2021 to flagging and blocking 'fully encrypted' traffic that lacks any recognizable protocol signature, rather than trying to fingerprint obfuscation protocols directly. It concludes that circumvention tools have adapted by mimicking ordinary traffic (TLS mimicry, wrapping WireGuard inside other transports) rather than trying to look like random noise.
Detalhes técnicos
The article describes a layered detection stack network operators use from cheapest to most expensive: IP blocklists, port/protocol blocking (e.g., dropping UDP or default OpenVPN port 1194), DPI, TLS fingerprinting, and active probing. It cites a USENIX Security 2022 paper in which researchers combined passive traffic analysis with active probing, working with an ISP serving about a million users, and identified more than 85% of OpenVPN flows with negligible false positives, also identifying connections using 34 of the 41 obfuscated VPN configurations tested. It also references a USENIX Security 2023 study describing how China's Great Firewall, since November 2021, stopped trying to directly identify obfuscation protocols like Shadowsocks, VMess, and obfs4, and instead applies cheap heuristic rules — examining bit entropy and printable ASCII characters in the first TCP data packet — to exempt traffic that resembles recognized protocols (TLS, HTTP) and treat everything else as suspect, with blocking observed on selected hosting-provider IP ranges at roughly a 26% probability for qualifying connections.
Remediação
The article notes that circumvention tools have shifted strategy in response: providers such as Proton VPN (its Stealth protocol, launched October 2022, wraps traffic in obfuscated TLS tunneling over TCP) and Mullvad (which shut down OpenVPN support on January 15, 2026, and now carries WireGuard over transports such as QUIC and Shadowsocks) aim to make VPN traffic resemble ordinary HTTPS sessions rather than uniform random noise, since the Great Firewall's entropy-based rules can flag unexplained randomness as suspicious. The piece cautions that no obfuscation method is permanent, since well-resourced censors continuously update detection rules, and that a successful VPN connection does not prove the connection went undetected, including on corporate and campus networks that run scaled-down versions of the same detection stack.
Linha do tempo
-
How National Firewalls Detect and Block VPN Traffic Without Breaking Encryption
ler a análise desta fonte ocultar
This explainer analyzes the techniques used by state-level censors and national firewalls, most notably China's Great Firewall, to detect and block VPN traffic without decrypting it. It stresses that detection relies on metadata rather than cryptanalysis: IP reputation and blocklisting of known VPN datacenter ranges, port/protocol filtering, deep packet inspection (DPI) of protocol-specific handshake patterns (e.g., WireGuard's fixed 148-byte initiation and 92-byte response messages, OpenVPN header patterns), TLS fingerprinting, and active probing of suspected proxy servers. The article cites academic research showing these methods can identify the large majority of VPN flows on real ISP networks, and explains how the Great Firewall shifted in November 2021 to flagging and blocking 'fully encrypted' traffic that lacks any recognizable protocol signature, rather than trying to fingerprint obfuscation protocols directly. It concludes that circumvention tools have adapted by mimicking ordinary traffic (TLS mimicry, wrapping WireGuard inside other transports) rather than trying to look like random noise.
Technical Details
The article describes a layered detection stack network operators use from cheapest to most expensive: IP blocklists, port/protocol blocking (e.g., dropping UDP or default OpenVPN port 1194), DPI, TLS fingerprinting, and active probing. It cites a USENIX Security 2022 paper in which researchers combined passive traffic analysis with active probing, working with an ISP serving about a million users, and identified more than 85% of OpenVPN flows with negligible false positives, also identifying connections using 34 of the 41 obfuscated VPN configurations tested. It also references a USENIX Security 2023 study describing how China's Great Firewall, since November 2021, stopped trying to directly identify obfuscation protocols like Shadowsocks, VMess, and obfs4, and instead applies cheap heuristic rules — examining bit entropy and printable ASCII characters in the first TCP data packet — to exempt traffic that resembles recognized protocols (TLS, HTTP) and treat everything else as suspect, with blocking observed on selected hosting-provider IP ranges at roughly a 26% probability for qualifying connections.
Remediation
The article notes that circumvention tools have shifted strategy in response: providers such as Proton VPN (its Stealth protocol, launched October 2022, wraps traffic in obfuscated TLS tunneling over TCP) and Mullvad (which shut down OpenVPN support on January 15, 2026, and now carries WireGuard over transports such as QUIC and Shadowsocks) aim to make VPN traffic resemble ordinary HTTPS sessions rather than uniform random noise, since the Great Firewall's entropy-based rules can flag unexplained randomness as suspicious. The piece cautions that no obfuscation method is permanent, since well-resourced censors continuously update detection rules, and that a successful VPN connection does not prove the connection went undetected, including on corporate and campus networks that run scaled-down versions of the same detection stack.