What the Great Firewall (GFW) is

The term “Great Firewall (GFW)” is commonly used to describe systems that restrict internet access and/or online content. In practice, these systems influence what connections succeed, what content can be reached, and sometimes how fast connections perform.

It’s best to think of the GFW as a collection of techniques rather than a single switch. The exact mechanisms, coverage, and thresholds can change over time, so any explanation should focus on general behavior patterns rather than guaranteeing outcomes.

How it works at a high level

Most descriptions of the GFW’s operation point to network-level inspection and enforcement. Two ideas are central:

  1. Traffic classification and inspection: Requests and connections can be examined using information available in network flows (such as IP addresses, domains, and protocol behaviors) and, in some setups, deeper inspection of connection characteristics.
  2. Enforcement actions: Once traffic is identified as matching certain criteria, enforcement can include blocking (making access fail), resetting connections, returning errors, or altering routing/connection behavior.

Depending on the situation, enforcement may target:

  • Domain names (so certain sites fail to resolve or connect)
  • IP addresses or destination ranges
  • Specific protocols or connection patterns
  • Content categories or observable behaviors

Because inspection depends on what a connection reveals “on the wire,” the same destination can behave differently depending on protocol, transport, and how the client initiates the connection.

Common limitations and why results differ

Even when filtering is strong, the outcome you see can vary. Important limitations include:

  • Destination- and protocol-specific behavior: Some services or protocols may be handled differently. For example, one transport may be blocked while another continues to work.
  • Evasion/robustness arms race: Blocking rules can adapt to new traffic patterns, and traffic that previously succeeded may fail later.
  • Imperfect visibility: Inspection is constrained by what can be reliably observed and attributed. When traffic is designed to minimize observable indicators, enforcement can become less consistent (though not necessarily absent).
  • Over- and under-blocking: Systems may block more than intended or miss some targeted traffic, leading to mixed results.

So, if you run the same check repeatedly, you may see different outcomes over time. That variability is a key reason to interpret GFW-related testing as “signal gathering,” not as a definitive truth about what is globally blocked.

Practical checks you can do

If your goal is to understand whether a particular site or service is being restricted, keep the checks simple and focused on reachability.

  1. Check DNS resolution vs. connection failure

    • If a domain cannot be resolved, the issue may be related to name handling or routing to the resolved address.
    • If it resolves but connections fail, the enforcement may occur later during connection establishment or early in the session.

  2. Compare outcomes across networks (where possible)

    • Trying from different networks can help separate local ISP/home routing issues from broader filtering effects.
    • Even then, conclusions should remain cautious because network paths can differ.

  3. Observe error patterns

    • “Cannot connect,” connection resets, or timeouts at specific stages can suggest where enforcement may be happening.
    • Avoid assuming a single error message maps to one exact cause.

  4. Compare protocol behavior (carefully)

    • If a service supports multiple ways to connect, you may notice that one option works while another fails.
    • This can reveal protocol-specific filtering without relying on any single “magic” indicator.

As a general principle: interpret results as evidence about your path and your connection method at that moment, not as a universal statement about what everyone will see.

Several terms often appear alongside “Great Firewall,” and understanding them clarifies what you may be observing:

  • Censorship vs. filtering: “Censorship” is the broader goal of restricting information access; “filtering” is the technical enforcement mechanism.
  • DPI (Deep Packet Inspection): A class of techniques that attempt to examine more than just basic header information. How “deep” inspection is can vary by system.
  • Throttling: Sometimes interference doesn’t fully block access; it may degrade performance, making services feel unreliable.
  • Blocking by name vs. blocking by address: Enforcement can happen at the DNS layer, the IP layer, or both.

These concepts don’t replace direct testing, but they help you reason about why failures can occur at different stages.

What would change your conclusions (the clear criterion)

Your conclusions about “GFW is blocking this” become more credible when multiple independent indicators point to consistent enforcement behavior:

  • The same destination fails for the same reason across different networks or times.
  • The failure stage (DNS resolution vs. connection establishment) remains similar.
  • Error patterns align with the same enforcement point.

If results are inconsistent or change with local configuration, the cause might be mix-and-match: local network issues, service-side changes, or ordinary routing problems. In those cases, it’s safer to treat the evidence as inconclusive rather than certain.