GFW Report is a research group that analyzes how the Great Firewall of China detects, blocks and can be circumvented.
HN commenters cite it as a reliable source on Chinese censorship, covering SNI and ESNI blocking, deep packet inspection, and the ongoing cat-and-mouse with circumvention tools.
This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private servers) from inside of China anymore, and it's usually not even possible to _tunnel_ a VPN connection through some other protocol because the GFW now detects that too.
Stepping back and looking at it from a purely technical perspective, it's actually insanely impressive.
Here's a USENIX paper from a few years ago on how it is done: https://gfw.report/publications/usenixsecurity23/en/
China has blocked ESNI
https://gfw.report/blog/gfw_esni_blocking/en/
But SNI is not CH and ESNI is not ECH
Will China block ECH
ECH blocking has been detected in Russia
https://github.com/net4people/bbs/issues/417
According to Niere et al. (2025)
"Additionally, with the ECH extension not yet being widely used [17], [71] and focusing on privacy protection rather than censorship circumvention [60], it can be censored easily by blocking it entirely [14], [76]."
The paper describes various GFW bypass methods that currently work, including removing the SNI extension entirely
It does not mention anyone using ECH to bypass GFW
Perhaps it is too early to conclude "China blocks ECH" because ECH is not in widespread use
You can start with studying research work about Chinese firewall to get the idea how DPI usually works [1]. Then you can start up a Wireshark and try sending different packets and see which are blocked and which pass through, or experiment with modifying VPN packets to make them pass through.
To experiment with this you need to buy a VPS abroad.
If you don't want to do that then you can search for existing utilities like: GoodbyeDPI, XRay/reality, AmneziaVPN etc.
[1] https://gfw.report/publications/usenixsecurity23/en/
NO.
They can do unconditional blocking at any moment and suddenly you can experience Internet blackout. [1]
The censorship from GFW is ever evolving. See the endless cat-and-mouse games yourself. [2][3]
[1] https://github.com/net4people/bbs/issues/511
[2] https://github.com/net4people/bbs/issues?q=is%3Aissue+state%3Aopen+label%3AChina
[3] https://gfw.report/en/
Wireguard is known to be fingerprintable[1]. But at this moment it is unlikely UDP traffic will be filtered by Chinese GFW[2]. But this may change any moment.
[1]: https://lists.zx2c4.com/pipermail/wireguard/2018-September/003290.html
[2]: https://gfw.report/publications/usenixsecurity23/en/#sec:residual
Shadowsocks always used to work well enough to evade the GFoC if you hosted your own VPS. Which is simpler than say strongSwan - and IPSEC gives the game away anyway.
https://gfw.report/blog/ss_advise/en/
https://gfw.report/blog/ss_tutorial/en/