Tor Bridges for China

China's GFW uses multiple layers to detect Tor: (1) IP blocklists: the GFW maintains continuously updated lists of known Tor relay IPs (obtained from the public Tor relay directory). Standard Tor is blocked at the IP level. (2) Deep packet inspection: the GFW analyzes traffic patterns to identify Tor's protocol signatures, including the TLS handshake patterns used by both vanilla Tor and some pluggable transports. (3) Active probing: when the GFW detects traffic that might be Tor, it actively sends probe packets to the suspected bridge IP to confirm it is a Tor bridge. Pluggable transports that correctly handle active probing (by responding like a legitimate server when probed) avoid this detection method. obfs4 handles active probing. (4) Machine learning classification: traffic pattern analysis beyond rule-based DPI, classifying traffic by statistical properties. This affects even obfuscated transports over time as the classifier is retrained with new samples.

Meek is a pluggable transport that uses domain fronting: connections appear to go to a legitimate, unblockable service (historically Google, Amazon, or Azure CDN) but are tunneled to a Tor bridge. The GFW cannot block the CDN IP without breaking access to all services on that CDN. Meek-azure (using Microsoft Azure CDN) is currently the most reliable meek variant in China. Configuration in Tor Browser: select 'Built-in bridges' and choose meek-azure. Meek's limitation: it routes traffic through CDN servers, which adds latency and is slower than direct bridge connections. CDN providers have also worked to prevent domain fronting in some configurations (Google discontinued support for domain fronting in 2018). meek-azure remains operational but may change. Meek is particularly important as a fallback when other transports are blocked in China.

Snowflake's effectiveness in China is variable. The GFW has developed capabilities to identify and block some WebRTC traffic patterns used by Snowflake. However, Snowflake's decentralized architecture (using volunteer proxies worldwide) means blocking requires the GFW to block WebRTC broadly - which would affect video conferencing and other WebRTC-dependent applications. As of 2025, Snowflake provides some bypass capability in China but is less reliable than in other censored countries. The Tor Project continues to improve Snowflake's obfuscation specifically for GFW environments. Check the current Tor Project blog for the latest Snowflake status in China. When Snowflake works, it is the easiest option (no bridge addresses to manage). When it does not, meek-azure and private obfs4 bridges are the alternatives.

In China, the freshness of bridge addresses is critical. The GFW discovers and blocks bridge IPs over time via active probing. A fresh bridge IP (never published to the public bridge pool) provides a window of time before it is discovered. Strategy for Chinese users: obtain bridges via the email method (bridges@torproject.org) rather than the web form - email bridges are distributed less widely and may be fresher. Better: a trusted contact outside China runs a private obfs4 bridge and shares the address exclusively. This private bridge is never submitted to the Tor Project's bridge pool and is shared with only a small number of people, extending the time before the GFW discovers and blocks it. The bridge operator should run it on a VPS with a clean IP reputation (not previously associated with Tor). Iceland and Romania data center IPs are less likely to be pre-blocked. Regular bridge rotation: have the bridge operator be willing to generate a new bridge (new IP, new keys) when the current one gets blocked, and securely share the new bridge address.

Given GFW sophistication, Chinese users should maintain multiple circumvention options. A layered approach: (1) Primary: obfs4 with a private bridge from a trusted contact - highest reliability when working. (2) Secondary: meek-azure via Tor Browser's built-in bridges - reliable as a fallback, slower but consistent. (3) Backup: Shadowsocks or V2Ray - popular censorship circumvention tools specifically developed by the Chinese community for GFW bypass. They are outside the Tor ecosystem but provide access to configure Tor with bridges retrieved from outside China. (4) Emergency: Psiphon - centralized but maintained specifically for censored environments. Switch between options when one is blocked. The GFW blocking is often temporary or incomplete - a tool blocked today may work tomorrow as the GFW adjusts rules and different ISPs implement blocks at different rates.