Introduction
If you have ever traveled to China or spoken to someone who lives there, you have probably heard the same frustration: "My VPN stopped working." This is not a glitch or a server issue. It is the result of one of the most sophisticated censorship systems ever built.
China's internet filtering apparatus, officially known as the Golden Shield Project but commonly called the Great Firewall (GFW), has evolved significantly since its inception in the early 2000s. What began as basic IP blocking has grown into a multi-layered detection system that identifies and disrupts VPN connections with remarkable accuracy.
In this post, we will examine how the Great Firewall detects and blocks VPN traffic, why popular protocols like OpenVPN and WireGuard struggle to survive, and how V2Ray was specifically designed to address these challenges.
What Is the Great Firewall?
The Great Firewall is China's national internet censorship and surveillance system. Officially called the Golden Shield Project, it was initiated in 1998 by the Ministry of Public Security and became operational in 2003. Its purpose is to regulate and control what content is accessible to internet users within China.
The GFW blocks access to thousands of foreign websites and services, including Google, YouTube, Facebook, Twitter (X), WhatsApp, Instagram, and many international news outlets. It also monitors domestic internet traffic for restricted content.
What makes the GFW particularly effective is not any single technique, but the combination of multiple detection methods working in concert.
How the Great Firewall Detects VPNs
The GFW uses several layered detection methods, each designed to catch different types of circumvention traffic.
Deep Packet Inspection (DPI)
DPI is the most powerful tool in the GFW's arsenal. Rather than simply looking at where traffic is going (IP addresses) or which port it uses, DPI examines the actual contents and structure of network packets.
Every protocol has a fingerprint. The way packets are structured, the order of bytes in a handshake, the size patterns of data transfers — all of these create identifiable signatures. DPI engines compare live traffic against known protocol signatures to detect VPN connections in real time.
DNS Poisoning
When you type a website address, your device sends a DNS query to translate that domain name into an IP address. The GFW intercepts these queries and returns false IP addresses for blocked domains, directing users to dead ends or warning pages.
IP Blacklisting
The GFW maintains and regularly updates blacklists of IP addresses associated with known VPN services. When a VPN server's IP gets flagged, all traffic to that address is blocked. This is why VPN providers constantly rotate server IPs.
Active Probing
This is perhaps the most sophisticated technique. When the GFW suspects a server might be running a proxy or VPN, it sends its own test connections to that server. If the server responds in a way consistent with a VPN protocol, it gets blocked.
Active probing makes it insufficient to simply disguise outgoing traffic. The server itself must behave convincingly as a normal web server when probed by unknown connections.
Why OpenVPN Fails in China
OpenVPN is one of the most widely used VPN protocols globally. It is open source, well audited, and supports strong encryption. However, it has a fundamental weakness in censored environments: it is easily identifiable.
Recognizable TLS Handshake
OpenVPN uses a custom TLS handshake that differs from standard HTTPS traffic. Even when running on port 443 (the standard HTTPS port), OpenVPN's handshake includes specific byte patterns and packet sequences that DPI engines can detect.
The OpenVPN protocol begins with a distinctive opcode byte and includes a static key identifier in its initial packets. These features were designed for reliability and easy configuration, not stealth. DPI systems can flag this traffic within the first few packets of a connection.
Packet Size and Timing Patterns
OpenVPN's packet sizes and timing patterns also differ from standard HTTPS browsing. These statistical features provide additional signals for DPI engines even if the initial handshake is somehow obscured.
Obfuscation Add-Ons Are Limited
Some VPN providers use tools like obfsproxy or XOR scrambling on top of OpenVPN to disguise its traffic. While these can help against basic detection, the GFW has demonstrated the ability to identify and block many of these obfuscation layers as well.
Why WireGuard Fails in China
WireGuard is praised for its speed and simplicity, but these same qualities work against it in censored environments.
Fixed UDP Pattern
WireGuard communicates exclusively over UDP and has a fixed handshake pattern. The initial handshake messages are always 148 bytes (initiator) and 92 bytes (responder). These fixed sizes make WireGuard connections trivial to fingerprint.
No Built-In Obfuscation
WireGuard was designed as a lean, high-performance tunneling protocol. Obfuscation was explicitly not a design goal. Its creator, Jason Donenfeld, has stated that obfuscation should be handled at a different layer. This means WireGuard alone provides no censorship bypass capability.
Easily Blocked
Because WireGuard's handshake is so distinctive and predictable, the GFW can block it with a simple rule matching specific UDP packet sizes. There is no ambiguity for the DPI engine — a 148-byte UDP packet with WireGuard's specific structure is almost certainly a WireGuard connection.
How V2Ray Approaches the Problem Differently
V2Ray, part of Project V, was developed starting in 2015 with censorship resistance as a core design goal. Rather than being a VPN protocol adapted for stealth, it was built from the ground up to be difficult to detect.
WebSocket + TLS: Mimicking Normal HTTPS
V2Ray's most common deployment uses WebSocket as a transport layer, wrapped in TLS encryption. To a DPI engine, this traffic looks identical to a normal HTTPS connection to a website, because at the protocol level, it is a legitimate HTTPS connection.
The TLS handshake is genuine, the certificate is real, and the WebSocket upgrade is standard. The actual proxy data rides inside this encrypted WebSocket connection, invisible to inspection.
Transport Flexibility
Unlike OpenVPN or WireGuard, which have fixed transport mechanisms, V2Ray supports multiple transport options:
- WebSocket — Appears as standard web traffic
- gRPC — Looks like API communication
- HTTP/2 — Mimics modern web browsing
- QUIC — Resembles Google's protocol traffic
- Raw TCP — For environments where other options are sufficient
This flexibility means that if one transport method gets detected, users can switch to another without changing their core setup.
Resistance to Active Probing
When deployed behind a web server like Nginx, a V2Ray server can serve a real website to normal visitors while routing V2Ray traffic through a specific path. If the GFW sends a probe to the server, it receives a normal web page in response, giving no indication that the server is also running a proxy.
This dual-purpose deployment is a significant advantage over traditional VPN protocols, which typically cannot disguise themselves as functional web servers.
The Arms Race Reality
It is important to be honest about the limitations. The relationship between censorship technology and circumvention tools is an ongoing arms race. No tool provides guaranteed, permanent access through the Great Firewall.
The GFW is continually updated and has demonstrated the ability to:
- Detect and block previously undetected protocols
- Temporarily increase filtering during politically sensitive periods
- Use machine learning to identify anomalous traffic patterns
- Block entire IP ranges associated with cloud hosting providers
V2Ray-based tools have proven more resilient than traditional VPN protocols, but they are not invincible. Connection reliability can vary by region within China, by time of day, and during politically significant events when censorship is intensified.
Users in China typically maintain multiple connection methods and stay informed about which approaches are currently working. The circumvention community actively adapts to new blocking techniques, but there are inevitably periods when access is disrupted.
How EdgeVPN Uses V2Ray
EdgeVPN includes V2Ray with VMess over WebSocket+TLS as one of its protocol options, specifically for users who face network restrictions. This setup provides the obfuscation benefits described above while being straightforward to configure.
EdgeVPN also offers WireGuard for users in unrestricted networks where speed is the priority. Having multiple protocols available means users can choose the right tool for their specific situation rather than relying on a single approach.
Conclusion
Traditional VPN protocols were designed for privacy and security in open networks, not for evading sophisticated censorship systems. The Great Firewall exploits their identifiable traffic patterns to detect and block them effectively.
V2Ray takes a fundamentally different approach by making proxy traffic indistinguishable from normal web browsing. While no tool can guarantee permanent, uninterrupted access in censored environments, V2Ray's design provides significantly better resilience against deep packet inspection and active probing.
If you are traveling to or living in a region with internet restrictions, having a V2Ray-capable tool available is a practical step. Just remember that the landscape changes constantly, and staying informed about current conditions is as important as having the right software.