Censorship by region: why the same tool behaves so differently across borders

The region filter on the rankings page is not decoration. A tool that flies in Russia may never complete a handshake in mainland China, and a protocol that is rock solid in China means nothing in Iran during a shutdown. The reason is mundane: each country's censorship system was built by different people, with different equipment, following different policy. Those differences land straight in the speed and stability columns.

Mainland China: layers, plus active probing

The Great Firewall is less a wall than several sieves stacked on top of each other. The outermost is DNS. Ask for a listed domain and you get a forged answer, usually arriving before the real one: DNS poisoning. It is cheap, crude and the easiest layer to get around, which is exactly why there are more layers behind it.

Next is IP-level blocking: certain address ranges are routed into a black hole, so packets leave and nothing comes back. The third layer reads the TLS handshake. Every HTTPS connection starts with a plaintext SNI field naming the host you want, and when a censorship box sees a blacklisted name it injects RST packets to tear the connection down. The old HTTP keyword filtering worked the same way; with plaintext HTTP mostly gone, SNI became the main hook.

What really troubles circumvention tools is the last layer: suspicion of traffic that cannot be classified. The GFW actively probes suspected proxies: it plays client, connects back to your server, and tries to work out whether it is speaking Shadowsocks or some flavour of VPN. In recent years researchers have also documented heuristic blocking of "fully encrypted" traffic: a connection that looks like random bytes from the first packet, resembling neither TLS nor any known protocol, may be cut off for a while. That is the pressure behind the current generation of protocols that work so hard to look like ordinary HTTPS.

There is a time dimension too. Around sensitive dates the blocking tightens visibly; nodes that worked all month drop out together and come back days later. On the rankings you can see that the mainland China group usually has far more tests than any other region, so its medians are comparatively stable. Narrow the period to "today", though, and the swings are much larger than in the 60-day window.

Russia: deep packet inspection at the carrier

Russia's approach is to install a uniform DPI appliance at the edge of every carrier's network, commonly called TSPU ("technical means of countering threats"). The regulator pushes rules to the boxes remotely; carriers cannot refuse. Its strength is protocol identification. WireGuard and OpenVPN, whose traffic patterns are distinctive, are dropped or heavily throttled on many networks rather than merely having a domain blocked.

The other well-documented pattern is slowing a service instead of blocking it — YouTube is the usual example. The page loads, the video buffers forever, and users cannot tell whether it is their connection or the state. For circumvention tools this means the speed figure in the Russia group sometimes says more than plain reachability. Russia has noticeably fewer tests than mainland China on the board, so mind the sample size when reading medians.

Iran: closer to an allowlist

Iran's structure differs from the other two. There is a fairly separate domestic "national information network" on which local services run smoothly, while the international gateways are choked independently. The usual circumvention protocols are blocked wholesale; what tends to survive are schemes deliberately disguised as ordinary website traffic.

The extreme case is a full shutdown. During protests the authorities have cut international access on mobile networks entirely, or kept only allowlisted domestic services reachable. No tool helps then, because the problem is not protocol detection — there is physically no exit. In the data, the Iran group often has only a handful of tests, clustered in certain windows. That is itself a signal: a submitted test means the network was open that day.

Turkmenistan: near-total blocking

Turkmenistan's internet is run by a very small number of operators, international bandwidth is thin to begin with, and blocking is close to total. Very few tools work for ordinary users. This group has the smallest sample on the board, and a single new test can move the median a lot. For this region it is more useful to open individual results and look at the speed and stability recorded that day than to compare rankings.

Why one tool performs so differently from place to place

Put the mechanisms side by side and the variance stops being surprising.

First, the systems target different things. Mainland China mainly asks "is this a proxy?", Russia mainly asks "which protocol is this?", and Iran frequently has no exit at all. A protocol nobody bothers with in one country is the prime target in another.

Second, exit nodes and international bandwidth differ. The same provider's Tokyo and Frankfurt nodes ride entirely different submarine cables, and the path out of Beijing is not the path out of Moscow. A speed test measures the whole route from browser to test server; congestion anywhere along it shows up in the number.

Third, local carrier QoS. Some operators throttle international or UDP traffic during evening peaks. That is not censorship, but it makes QUIC-based protocols look markedly slower in evening tests from certain regions.

Fourth, the tester's device and connection. A phone on mobile data and a desktop on fibre differ by an order of magnitude before any tool is involved. GreatFire's approach is to record the operating system alongside each test, which is why you can split Android from Windows in the filters.

So read the board by choosing a region first, then a period, then checking the test count. Use all three filters and the ranking you get actually applies to your situation. The method details are in How to read the rankings.

FAQ

Why is my speed in mainland China much lower than the median on the board? The median is the middle value across everyone who tested in that period: some on fibre, some at 3 a.m. A single result depends heavily on time of day, carrier and device. Run a few tests before comparing.

Can the rankings tell me whether a tool works in Iran right now? Not directly. The Iran group has few tests, and nobody can submit one during a shutdown. Look at the timestamp of the latest result: if it is a few days old, at least someone connected then.

Is Russian censorship lighter than China's? Hard to compare on one axis. Russia's DPI identifies protocols very accurately but has no equivalent of China's active probing against HTTPS-lookalikes; China has more layers, yet some protocols stay usable there for long stretches. Pick tools from each region's own data rather than assuming one transfers to the other.