Can the Great Firewall of China Block Tor?

The Great Firewall of China (GFW) employs some of the world’s most advanced censorship mechanisms to restrict access to the Tor network, successfully blocking default connections and public entry nodes. However, the firewall cannot completely block Tor because of advanced obfuscation techniques, non-public bridge relays, and dynamic circumvention protocols like Snowflake and meek, which disguise Tor traffic as ordinary web traffic.

How the Great Firewall Restricts Standard Tor Access

China uses a multi-layered approach to detect and disrupt standard connections to the Tor network:

• Public Relay Blacklisting: The Tor Project publishes a public directory of its relay nodes. The GFW continuously scrapes this list and blocks the corresponding IP addresses and ports at the infrastructure level.
• Deep Packet Inspection (DPI): Even if an IP is not yet blacklisted, the GFW analyzes data packets in real time. Standard Tor traffic has specific cryptographic signatures during its TLS handshake that DPI algorithms detect and drop immediately.
• Active Probing: When the GFW suspects an unlisted server might be a Tor bridge, it initiates an automated connection to that server pretending to be a Tor client. If the server responds using the Tor protocol, the firewall immediately blocks the IP address.

Why Complete Blocking Remains Impossible

Despite these aggressive measures, Tor developers have created tools designed specifically to bypass sophisticated state-level censorship:

• Pluggable Transports (Obfuscation): Tools like obfs4 transform Tor traffic to look like random, unidentifiable data streams, stripping away the protocol signatures that Deep Packet Inspection looks for.
• Domain Fronting and meek: The meek transport routes traffic through major third-party Content Delivery Networks (CDNs) like Microsoft Azure or Amazon Web Services. To block meek, the GFW would have to block the entire CDN, which would cause massive collateral damage to legitimate commercial services inside China.
• Snowflake: This modern circumvention system uses WebRTC to route connections through a constantly changing network of volunteer-run browser proxies. Because these temporary proxies appear and disappear in seconds, the GFW cannot maintain an effective blacklist without disrupting standard peer-to-peer web communication.
• Private Bridges: Tor users can obtain private, unlisted bridge addresses via email or secure channels. Since these IPs are distributed in small batches to individual users, the GFW’s automated scrapers cannot discover and block them all at once.

Conclusion

The battle between the Great Firewall of China and Tor is an ongoing cat-and-mouse game. While China makes it extremely difficult for an average user to connect to Tor out of the box, completely eliminating access is technically unfeasible without shutting down all encrypted international internet traffic or adopting an extreme whitelist-only model for foreign connections.