What Is a Meek Bridge in Tor?

A meek bridge is a specialized pluggable transport designed for the Tor network to help users bypass heavy internet censorship. It utilizes a technique called “domain fronting” to disguise Tor traffic as legitimate, everyday HTTPS connections to major cloud service providers. This article explains how meek bridges function, why they are effective at evading deep packet inspection, and the limitations associated with their use.

How a Meek Bridge Works

Standard Tor bridges simply use hidden IP addresses to evade basic IP-blocking mechanisms. However, sophisticated firewalls can still detect and block standard Tor traffic patterns through deep packet inspection (DPI).

Meek solves this problem through domain fronting by taking advantage of Content Delivery Networks (CDNs) and large cloud platforms:

1. Outer Request: When a user initiates a connection, the unencrypted parts of the TLS handshake (such as the Server Name Indication, or SNI, and DNS queries) point to an innocuous, high-reputation domain hosted on a major cloud platform, such as Microsoft Azure.
2. Encrypted Inner Request: Once the secure TLS connection is established, meek sends an encrypted HTTP request with a hidden Host header pointing to a Tor bridge backend hosted on that same cloud service.
3. Traffic Forwarding: The cloud provider reads the inner Host header and proxies the traffic to the Tor bridge, which then forwards the connection into the broader Tor network.

Why Meek Bridges Evade Censorship

To a censor or network observer, the traffic appears to be a standard, encrypted connection to a critical cloud service or popular commercial website.

Because many essential services, businesses, and government websites share the same cloud infrastructure, a censor cannot easily block meek traffic without blocking access to the entire cloud platform. This makes blocking meek economically and politically costly for state censors.

Limitations of Meek Bridges

While highly effective, meek bridges come with specific drawbacks:

• Slower Speeds: Because traffic is routed through intermediary cloud services before reaching the Tor network, meek bridges introduce higher latency and slower connection speeds compared to direct bridges like obfs4.
• Cost: Running meek backends incurs bandwidth costs on commercial cloud providers, making them expensive to maintain compared to volunteer-run relays.
• Provider Restrictions: Several major cloud providers have restricted or disabled domain fronting on their platforms to prevent misuse, which has reduced the number of available services that can support meek bridges.

Despite these constraints, meek remains a critical fallback option in regions with advanced, nation-scale firewalls where standard obfuscation techniques fail.