How the Great Firewall Actually Works and Why Do Modern VPNs Use VLESS?

China's internet censorship program — officially called the Golden Shield project, known everywhere else as the Great Firewall of China (GFW) — is the most sophisticated national-scale filtering system ever built. This guide breaks down why it exists, exactly how it works layer by layer, what it blocks, and why the answer to "can you bypass it" is more complicated than most people assume. It also covers why modern protocols like VLESS, used by Octohide VPN, were built specifically for networks like this one.

TL;DR

• The GFW isn't one tool — it's a stack of DNS poisoning, IP blocking, SNI/URL filtering, TCP reset attacks, and Deep Packet Inspection (DPI) working together.
• It exists mainly to control the flow of information in and out of mainland China, while also protecting a domestic tech industry from foreign competition.
• It blocks thousands of sites and services, including nearly all mainstream Western platforms and most international VPNs.
• It is inconsistently enforced — what's blocked in one province may load fine in another.
• No VPN can guarantee it will work reliably against the GFW at all times, but protocols designed to disguise VPN traffic as ordinary HTTPS — like VLESS — hold up meaningfully better than legacy protocols.

What Is the Great Firewall of China?

Since the late 1990s, the Chinese government has viewed the open internet as both an economic opportunity and a political risk. Its answer was the Golden Shield project, a censorship and surveillance framework that the rest of the world nicknamed the Great Firewall. The first phase went live in the mid-2000s, and it has expanded in scope and technical sophistication ever since — today routing essentially all cross-border traffic through a small number of heavily monitored international gateways.

The GFW isn't concerned with domestic dissent directly (a separate, large-scale domestic monitoring apparatus handles that). Its job is narrower: filter what crosses the border, in both directions. Notably, mainland China's firewall does not extend to Hong Kong or Macau, which historically retained separate, uncensored internet access, though that distinction has narrowed since Hong Kong's 2020 national security law.

Why Does the Great Firewall Exist?

Two motivations sit behind the GFW, and they reinforce each other.

Political control. As China opened economically in the 1980s and 90s, its population gained more exposure to outside ideas and media. The government's response was to keep the economic benefits of connectivity while filtering the parts of the internet it considered destabilizing.

Economic protectionism. By blocking Google, YouTube, Instagram, Twitter/X, and most Western platforms, China effectively created an internet-within-an-internet for roughly a quarter of the world's internet users. That captive market let domestic alternatives — Baidu, Weibo, WeChat, Bilibili, and others — grow without foreign competition, while remaining fully compliant with government content and data-sharing requirements.

How Does the Great Firewall Actually Work?

The GFW layers several distinct techniques. None of them is decisive on its own — together, they form one of the hardest filtering systems in the world to consistently get around.

Destination IP blocking

The simplest layer: connections to entire ranges of IP addresses belonging to blocked services are dropped outright, regardless of what's inside the traffic.

DNS filtering and poisoning

Since most DNS queries route through domestic ISPs, authorities can instruct those ISPs to return false answers or no answer at all for blocked domains — so your device never learns the correct IP address to connect to.

SNI and URL filtering

During a standard TLS handshake, the hostname you're connecting to is historically visible in plaintext via Server Name Indication (SNI), even though the rest of the connection is encrypted. Transparent proxies inspect this field (along with HTTP headers and URLs) for blocklisted domains or keywords, and interrupt the connection before it completes. This is one of the reasons emerging standards like Encrypted Client Hello (ECH) matter — they aim to hide the hostname from this kind of inspection, though rollout is still uneven across browsers and networks.

TCP reset attacks

When a connection to a flagged server is detected, government infrastructure can inject forged packets that tell both ends of the connection to close immediately — a technique known as a TCP reset attack.

Deep Packet Inspection (DPI)

Originally built to detect VPN traffic specifically, DPI has become central to the GFW. Rather than reading the content of encrypted traffic, DPI systems analyze how it behaves — packet timing, sizes, and handshake structure — to fingerprint which protocol is in use. China's DPI implementation is among the most advanced deployed anywhere, which is precisely why many traditional VPN protocols struggle here even when their encryption itself is unbroken.

Certificate-level interference

Because HTTPS relies on trusted Certificate Authorities to vouch for domain ownership, control over even one domestic CA can, in theory, enable man-in-the-middle interception of "secure" traffic. This has been documented in isolated incidents involving Chinese CAs in the past, which is part of why browser vendors keep tightening trust requirements for CAs globally.

Blocking access to circumvention tools themselves

It isn't just VPN traffic that's targeted — access to VPN provider websites, app store listings, and download pages is frequently blocked too, which is why security professionals consistently recommend installing and configuring a VPN before traveling into a heavily filtered network, not after.

What Does the Great Firewall Block?

The GFW's blocklist runs into the thousands of domains and covers most platforms considered "the default internet" almost everywhere else, including:

• Google (Search, Gmail, Maps, Docs, Play Store)
• YouTube, Instagram, Facebook, Twitter/X
• WhatsApp, Signal, Telegram (intermittently)
• Wikipedia
• Most major international news organizations
• Dropbox, OneDrive
• Most international VPN provider websites and app listings

Enforcement is notably inconsistent: a domain blocked in one province can sometimes load in another, and blocking decisions don't always track logically with how politically sensitive the content actually is.

Is It Possible to Bypass the Great Firewall?

Honestly: there's no method that works 100% of the time, for everyone, indefinitely. That's true for every VPN provider making this claim, not just some. What actually helps:

• Encrypted DNS (DoH/DoT) resists basic DNS poisoning, though it doesn't help against IP-level or DPI-based blocking on its own.
• Protocol obfuscation — disguising VPN traffic so it resembles ordinary HTTPS browsing rather than an identifiable VPN handshake — is currently the most effective single technique against DPI-based detection.
• Server diversity and fast switching matter because individual IPs get blocklisted; being able to move to a fresh, unflagged server quickly extends usable connection time.
• Installing before you arrive avoids the problem of provider sites and app stores being blocked once you're already inside the restricted network.

Why Octohide VPN Uses VLESS

This is exactly the environment VLESS was designed for. Instead of relying on the connection patterns of older VPN protocols — which DPI systems have had years to learn to fingerprint — VLESS minimizes protocol overhead and, in Octohide VPN's implementation, layers in Vision REALITY and XTLS to make VPN traffic resemble regular HTTPS web browsing rather than a recognizable VPN handshake. We cover the mechanics in detail in:

• What Is VLESS Encryption and Why Is It Important for VPNs?
• How to Unlock the Web with VLESS: Fast, Private, and Unblockable
• What's the Difference Between VLESS, Xray, Reality, and VMess?
• Does Octohide VPN Work in China? (Complete 2026 Guide)

We won't claim VLESS guarantees a connection in every restricted network at every moment — nobody honest can claim that about any protocol. What we can say is that it's built around today's filtering reality rather than a decade-old one, backed by a network of 4,500+ servers across 60+ locations so you're never stuck if one gets blocklisted, all running under our no-logs, MASA-audited infrastructure with no registration required.

Download Octohide VPN free →

Final Thoughts

The scale of the Great Firewall says something real about how seriously information control is taken at a national level — and about how much effort it takes to filter an entire country's internet traffic without cutting off its economic benefits entirely. No VPN protocol, including VLESS, can promise to defeat a system this well-resourced in every case. But building a protocol around obfuscation, speed, and a large, actively managed server network — rather than around assumptions from 2010 — gives users meaningfully better odds than legacy VPN technology.

Frequently Asked Questions

What is the Great Firewall of China? It's China's national internet censorship and traffic-control system, officially the Golden Shield project, combining DNS filtering, IP blocking, SNI inspection, and Deep Packet Inspection to regulate what crosses the country's borders online. 

Why does China block Google, Facebook, and Twitter/X? Officially for content and political reasons; practically, it also removed major foreign competitors from a market of hundreds of millions of users, letting domestic platforms grow in their place.

Is it legal to use a VPN in China? There's no law that specifically criminalizes VPN use by individuals, though unlicensed VPN services have faced crackdowns, and enforcement against individual users has historically been rare but not unheard of. This isn't legal advice — check current guidance before you travel.

What is Deep Packet Inspection (DPI)? A technique that analyzes traffic behavior — packet timing, size, and structure — to identify what protocol is being used, even without decrypting the contents. See our dedicated explainer: What Is VLESS Encryption and Why Is It Important for VPNs?

Does Octohide VPN work in China? It can, particularly using the VLESS protocol, though results vary with network conditions and setup. Full detail here: Does Octohide VPN Work in China? (Complete 2026 Guide)

Can a VPN guarantee it will bypass the Great Firewall? No — and any provider claiming otherwise isn't being fully upfront. What matters is which technologies give you the best realistic odds, which is why protocol choice (like VLESS) and server diversity matter more than marketing claims.