TheGreat Firewall (GFW;simplified Chinese:防火长城;traditional Chinese:防火長城;pinyin:Fánghuǒ Chángchéng) is the combination of legislative actions and technologies enforced by thePeople's Republic of China to regulate theInternet domestically.[1] Its role ininternet censorship in China is to block access to selected foreign websites and to slow down cross-border internet traffic.[2] The Great Firewall operates by checkingtransmission control protocol (TCP) packets for keywords or sensitive words. If the keywords or sensitive words appear in the TCP packets, access will be closed. If one link is closed, more links from the same machine will be blocked by the Great Firewall.[3] The effect includes: limiting access to foreign information sources, blocking popular foreign websites (e.g.Google Search,[4]Facebook,[5]Twitter,[6]Wikipedia,[7][8] and others) and mobile apps, and requiring foreign companies to adapt to domestic regulations.[9][10]
Besides censorship, the Great Firewall has also influenced the development of China's internal internet economy by giving preference to domestic companies[11] and reducing the effectiveness of products from foreign internet companies.[12] The techniques deployed by the Chinese government to maintain control of the Great Firewall can include modifying search results for terms, such as they did followingAi Weiwei’s arrest, and petitioning global conglomerates to remove content, as happened when they petitionedApple to remove theQuartz business news publication’s app from its Chinese App Store after reporting on the2019–2020 Hong Kong protests.[13][14]
The Great Firewall was formerly operated by theSIIO, as part of theGolden Shield Project. Since 2013, the firewall is technically operated by theCyberspace Administration of China (CAC), which is the entity in charge of translating theChinese Communist Party'sideology and policy into technical specifications.
As mentioned in the "one country, two systems" principle, China'sspecial administrative regions (SARs)—Hong Kong andMacau—are not affected by the firewall, as SARs have their own governmental and legal systems and therefore enjoy a higher degree of autonomy. Nevertheless, theU.S. State Department has reported that the central government authorities have closely monitored Internet use in these regions,[15] and Hong Kong'sNational Security Law has been used to block websites documentinganti-government protests.[16]
Provincial governments in parts of China, such asHenan Province, run their own versions of the firewall.[17][18][19]
The termGreat Firewall of China is a combination of the wordfirewall with theGreat Wall of China. The phrase "Great Firewall of China" was first used in print by AustraliansinologistGeremie Barmé in 1997.[20][21]
A favorite saying ofDeng Xiaoping's in the early 1980s, "If you open the window, both fresh air and flies will be blown in", is considered to be the political and ideological basis of the GFW Project.[nb 1] The saying is related to a period of the economic reform of China that became known as the "socialist market economy". Superseding the political ideologies of theCultural Revolution, the reform led China towards amarket economy and opened up the market for foreign investors. Nonetheless, despite the economic freedom, values and political ideas of the Chinese Communist Party (CCP) have had to be protected by "swatting flies" of other unwanted ideologies.[22]
Theinternet in China arrived in 1994,[23] as the inevitable consequence of and supporting tool for a "socialist market economy". Gradually, while Internet availability has been increasing, the Internet has become a common communication platform and tool for trading information.
The Chinese government's control over the Internet began in 1996 when PremierLi Peng signed State Council Order No. 195, issuing the "Interim Regulations on the Management of International Networking of Computer Information Networks". Article 6 of the Regulations states: "Computer information networks that directly connect to the international network must use the international entry and exit channels provided by the Ministry of Posts and Telecommunications’ national public telecommunications network. No unit or individual may establish or use other channels to connect to the international network on their own." This regulation was later widely used to punish "climbing over the firewall".[24]
TheMinistry of Public Security took initial steps to control Internet use in 1997, when it issued comprehensive regulations governing its use. The key sections, Articles 4–6, are:
Individuals are prohibited from using the Internet to: harm national security; disclose state secrets; or injure the interests of the state or society. Users are prohibited from using the Internet to create, replicate, retrieve, or transmit information that incites resistance to thePRC Constitution, laws, or administrative regulations; promoting the overthrow of the government or socialist system; undermining national unification; distorting the truth, spreading rumors, or destroying social order; or providing sexually suggestive material or encouraging gambling, violence, or murder. Users are prohibited from engaging in activities that harm the security of computer information networks and from using networks or changing network resources without prior approval.[25]
In 1998, the Chinese Communist Party feared that theChina Democracy Party (CDP) would breed a powerful new network that CCP elites might not be able to control.[26] The CDP was immediately banned, followed by arrests and imprisonment.[27] That same year, the GFW project was started. The first part of the project lasted eight years and was completed in 2006. The second part began in 2006 and ended in 2008. On 6 December 2002, 300 people in charge of the GFW project from 31provinces andcities throughout China participated in a four-day inaugural "Comprehensive Exhibition on Chinese Information System".[28] At the exhibition, many western high-tech products, includingInternet security,video monitoring and humanface recognition were purchased. It is estimated that around 30,000–50,000 police were employed in this gigantic project.[29]
Fang Binxing is known for his substantial contribution toChina's Internet censorship infrastructure, and has been dubbed "Father of China's Great Firewall".[30][31][32]
China's view of the Internet is one of "Internet sovereignty": the notion that the Internet inside the country is part of the country's sovereignty and should be governed by the country.[12][33]
While the United States and several other western countries passed laws creating computer crimes beginning in the 1970s, China had no such legislation until 1997. That year, China's sole legislative body – theNational People's Congress (NPC) – passed CL97, a law that deals with cyber crimes, which it divided into two broad categories: crimes that target computer networks, and crimes carried out over computer networks. Behavior illegal under the latter category includes, among many things, the dissemination ofpornographic material, and the usurping of "state secrets."[34]
Some Chinese judges were critical of CL97, calling it ineffective and unenforceable. However, the NPC claimed that it intentionally left the law "flexible" so that it could be open to future interpretation and development. Given the gaps in the law, the central government of China relies heavily on its administrative body, theState Council, to determine what falls under the definitions, and their determinations are not required to go through the NPC legislative process. As a result, the Chinese Communist Party has ended up relying heavily on state regulation to carry out CL97.[35]
The latter definition of online activities punishable under CL97, or "crimes carried out over computer networks", is used as justification for the Great Firewall, and can be cited when the government blocks any ISP, gateway connections, or any access to anything on the internet. The definition also includes using the internet to distribute information considered "harmful to national security," and using the internet to distribute information considered "harmful to public order, social stability, and Chinese morality." The central government relies heavily on its State Council regulators to determine what specific online behavior and speech fall under these definitions.[citation needed]
The reasons behind the Internet censorship in China include:
As part of the Great Firewall, beginning in 2003, China started theGolden Shield Project, a massive surveillance and censoring system, the hardware for which was provided by mostly U.S. companies, includingCisco Systems. The project was completed in 2006, and is now carried out in buildings with machines operated by civilians and supervised by China's national police force, thePublic Security Bureau (PSB,Chinese:公安局). The main operating procedures of the gatekeepers at the Golden Shield Project include monitoring domestic websites, email, and searching for politically sensitive language and calls to protest. When damaging content is found, local PSB officials can be dispatched to investigate or make arrests. However, by late 2007, the Golden Shield Project proved to operate sporadically at best, as users had long adapted tointernet blocking by using proxy servers, among other strategies, to make communications and circumnavigate to blocked content.[37]
Internet cafés, an extremely popular way of getting online in developing countries and where fewer people can afford a personal computer, are regulated by the Chinese government and by local Chinese government officials. Minors (in China, those under the age of 18) are not allowed into Internet cafés, although this law is widely ignored, and when enforced, has spurred the creation of underground "Black Web Bars" visited by those underage. As of 2008, internet cafés were required to register every customer in a log when they used the internet there. These records may be confiscated by either local government officials or the PSB. To illustrate local regulation of internet cafés, in one instance, a government official in the town of Gedong lawfully banned internet cafés from operating in the town because he believed them to be harmful to minors, who frequented them to play online games (including those considered violent) and surf the internet. However, internet cafés in this town simply went underground, and most minors were not deterred from visiting them.[38]
In May 2015, China indefinitely blocked access to the Chinese-language Wikipedia.[39] In 2017, China discussed plans for its own version of Wikipedia.[40][41] As of May 2019, all language versions of Wikipedia have been blocked by the Chinese government.[42]
The Great Firewall is mainly deployed at three largeinternet exchanges in Beijing, Shanghai, and Guangzhou.[43][44]
One function of the Chinese firewall is to selectively prevent content from being accessed. It is mostly made of Cisco, Huawei, and Semptian hardware.[45][46] Not all sensitive content gets blocked; in 2007, scholar Jedidiah R. Crandall and others argued that the main purpose is not to block 100%, but rather to flag and to warn, in order to encourage self-censorship.[47] An illustrative but incomplete list of tactics includes:
| Method | Description |
|---|---|
| IP range ban usingblack holes | The Chinese firewall maintains a list ofIP ranges that are automatically dropped (network black-holing).[48] Because of the complexity involved in maintaining a large, up-to-date banned network list with dynamic IPs (and as this method has proven incompatible with services usingcontent delivery networks) it is usually used as a last resort, with other blocking methods preferred (such as filtering based onQoS). |
| DNS spoofing, filtering and redirection | One part of the Chinese firewall is made of liar DNS servers andDNS hijackers returning incorrect IP addresses.[49] Studies seems to point out that this censorship is keyword-based.[50] Contrary to popular belief,[51] foreign DNS resolvers such asGoogle Public DNS IP address 8.8.8.8 are reported to work correctly inside the country; however, these DNS servers are also subject to hijacking as their connections are not encrypted: DNS queries do reach the DNS server, but if the request matches a banned keyword, the firewall will inject a fake DNS reply before the legitimate DNS reply arrives. The vast majority of these fake responses contain public IP addresses of U.S. companies, including Facebook, Twitter, and Dropbox.[52] Typical circumvention methods include modifying theHosts file, typing the IP address instead of the domain name in aWeb browser or usingDNS over TLS/HTTPS.[53] |
| URL filtering using transparent proxies | The Chinese firewall is made oftransparent proxies filtering web traffic. These proxies scan the requestedURI, the "Host" Header and the content of the web page (for HTTP requests) or theServer Name Indication (for HTTPS requests) for target keywords.[54] Like for DNS filtering, this method is keyword-based. Encrypting the Server Name Indication (Encrypted Client Hello or ECH) can be used to bypass this method of filtering. It is currently in development by theIETF,[55] and is enabled by default for supported websites inFirefox andChromium (Google Chrome,Microsoft Edge,Samsung Internet, andOpera).[56][57][58][59] However, in July 2020,iYouPort, theUniversity of Maryland, and theGreat Firewall Report, reported that the GFW blocks TLS connections using some encrypted SNI extension in China. |
| Quality of service filtering | Since 2012, the GFW is able to "learn, filter, and block" users based on traffic behavior, usingdeep packet inspection.[60] This method was originally developed for blocking VPNs and has been extended to become part of the standard filtering system of the GFW. The method works by mirroring all traffic (using anetwork tap) to a dedicated analytics unit, that will then deliver a score for each destination IP based on how suspicious the connection is deemed to be. This score is then used to determine apacket loss rate to be implemented by routers of the Chinese firewall, resulting in a slowed connection on the client side. The method aims to slow down traffic to such an extent that the request times out on the client side, thus effectively having succeeded in blocking the service altogether. It is believed that the analytics system is usingside-channel (such as the handshake headers, and packet sizes) to estimate how suspicious a connection is.[61] It is able to detect traffic protocols (such as SSH tunneling,VPN orTor protocols), and can measure theentropy of packets to detect encrypted-over-encrypted traffic (such as HTTPS over an SSL tunnel). This attack may be resisted by using a pluggable transport in order to mimic 'innocent' traffic, and never connect to 'suspicious' IPs by always having the circumvention software turned on, yet not proxy unblocked content, and the software itself never directly connects to a central server.[62] |
| Packet forging andTCP reset attacks | The Chinese firewall may arbitrarily terminate TCP transmissions, usingpacket forging. The blocking is performed using a TCP reset attack. This attack does not block TCP requests nor TCP replies, but sends a malicious TCP RST packet to the sender, simulating an end-of-connection. Recent research has also confirmed that these TCP reset behaviors are not only observable from within China, but can also be detected from outside the country. In particular, a 2024 study showed that the firewall engages in TCP non-compliant behavior, including bidirectional resets, allowing external observers to identify and measure censorship remotely.[63] Side channel analysis seems to indicate that TCP Resets are coming from an infrastructure co-located or shared with QoS filtering routers.[64] This infrastructure seems to update the scoring system: if a previous TCP connection is blocked by the filter, future connection attempts from both sides may also be blocked for short periods of time (up to a few hours). An efficient circumvention method is to ignore the reset packet sent by the firewall.[65] A patch for FreeBSD has been developed for this purpose.[66] |
| Man-in-the-middle attack with TLS | TheNational Intelligence Law of the People's Republic of China theoretically allows the Chinese government to request and use the root certificate from any Chinese certificate authority,[67] such asCNNIC, to make MITM attacks with valid certificates. Multiple TLS incidents have occurred within the last decade, before the creation of the law. On 26 January 2013, theGitHub SSL certificate was replaced with a self-signed certificate in China.[68] On 20 October 2014, the iCloud SSL certificate was replaced with a self-signed certificate in China.[69] It is believed that the Chinese government discovered a vulnerability on Apple devices and was exploiting it.[70] On 20 March 2015, Google detected valid certificates for Google signed by CNNIC in Egypt. In response to this event, and after a deeper investigation, the CNNIC certificate was removed by some browsers.[71] Due to the removal being based on proof and not suspicion, no other Chinese certificate authority has been removed from web browsers, and some have been added since then.[72] This type of attack can be circumvented by websites implementingCertificate Transparency andOCSP stapling or by using browser extensions.[73] |
In addition to previously discussed techniques, theCAC is also usingactive probing in order to identify and block network services that would help escaping the firewall. Multiple services such asTor orVPN providers reported receiving unsolicited TCP/IP connections shortly after legitimate use, for the purported purpose ofnetwork enumeration of services, in particularTLS/SSL and Tor services, with the aim of facilitating IP blocking. For example, shortly after a VPN request is issued by a legitimate Chinese VPN client and passes outbound though the Great Firewall to a hidden VPN IP, the Great Firewall may detect the activity and issue its own active probe to verify the nature of the previously unknown VPN IP and, if the probe confirms the IP is part of a blacklisted VPN, blacklist the IP.[74][75] This attack can be circumvented with the Obfs4 protocol, which relies on an out-of-bandshared secret.[74][75]
The Great Firewall scrapes the IPs of Tor and VPN servers from the official distribution channels, and enumerates them.[76][77][78][79] The strategy to resist this attack is to limit the quantity of proxy IPs revealed to each user and making it very difficult for users to create more than one identity.[80][81][82] Academics have proposed solutions such as Salmon, a volunteer-based proxy network designed to combat censorship.[83][84][85][86] Dynamic IPs are quite effective to flush out from blacklists.
Article 15 of a 20 September 2000 document from theChinese State Council, posted by the Xinhua News Agency, lists 9 categories of information which should becensored, blocked, or filtered from access to the citizens using the internet within China:
To filter this content, the Chinese government not only uses its own blocking methods, but also heavily relies on internet companies, such as ISPs, social media operators such as Weibo,[88] and others to actively censor their users.[89] This results in private companies censoring their own platform for filtered content, forcing Chinese internet users to use websites not hosted in China to access this information. Much of this information is related to sensitive topics.[90] The Great Firewall's goal is perceived by the Chinese Communist Party as helping to protect the Chinese population by preventing users from accessing these foreign websites which, in their opinion, host content which would be 'spiritual pollution', as well as information about these sensitive topics.[91] These topics include:
A 2020 study found that the Great Firewall blocks approximately 311,000 domains.[95][96]
TheCybersecurity Law behind the firewall is targeted at helping increase internet user privacy, increase protections on personal data, and making companies more responsible for monitoring bad actors, in hopes to make the Internet a safer place for Chinese citizens.[97] Despite this, there have been growing criticisms that the actions of the Chinese government have only hurt Chinese free speech, due to increased censorship, and lack of non-sanctioned sources of information, such as Wikipedia and many English news sources.[96] This has resulted in reports of some cases of legal persecution of those charged with spreading this information.[91]
The Chinese government itself does legally support free speech; article 35 of theConstitution of China states that "citizens of the People's Republic of China enjoyfreedom of speech, of thepress, ofassembly, of association, of procession, and of demonstration."[98] In recent decades, many criticisms of the Chinese government found that some of these laws are often abused. A study byPEN America claimed that "Some of the government's most rights-abusive laws are aimed at criminalizing free speech that — in the eyes of the government — encourages subversion, separatism, or rejection of the State’s authority."[90]
Censorship of sensitive topics in China has also been easier for the government because of the firewall and its filtering. Because the monitoring of social media and chat apps in China presents a possibility of punishment for a user, the discussion of these topics is now limited to the thought of the Chinese Communist Party, or one's home and private spaces, reducing the chance for information about these topics to spread, reducing any threat of protest against the CCP.[99][100] According toYaqiu Wang, a prominent human rights researcher, there was a time in China where the internet provided a method for Chinese citizens to learn about the sensitive topics the government had censored in the news, through access to international news reports and media coverage. She claims that, in the past 10 years, it has been increasingly difficult to access second opinions on events, meaning that students rarely have the opportunity to learn diverging viewpoints — only the "correct" thought of the CCP.[99]
The Great Firewall has also allowed China to develop its own major internet services, such asTencent,Alibaba,Baidu,[101][102]Renren,Youku, andWeibo.[103]: 8 China has its own version of many foreign web properties, for example:Bilibili andTencent Video (YouTube),Weibo (Twitter),Moments[104] andQzone (Facebook),WeChat (WhatsApp),Ctrip (Orbitz and others),Zhihu[105] (Quora), andXiaohongshu (Instagram). With nearly one quarter of the global internet population (700 million users), the internet behind the GFW can be considered a "parallel universe" to the Internet that exists outside.[12]
While the Great Firewall has had an impact on Chinese citizens' ability to use the internet to find information about sensitive topics about the Chinese Communist Party, it has not completely stopped them from doing so. The firewall itself has caused much frustration amongst both individuals and internationally operating companies in China, many of whom have turned to VPNs, speaking in codes,[106] and other methods to retain their access to the international internet.[107]
Because the Great Firewall blocks destination IP addresses and domain names and inspects the data being sent or received, a basic censorship circumvention strategy is to use proxy nodes and encrypt the data. Bypassing the firewall is known asfānqiáng (翻墙, "climb over the wall"), and most circumvention tools combine these two mechanisms:[108]
In 2017, the Chinese government declared unauthorized VPN services illegal, requiring VPN providers to obtain state approval.[115] Although China restricts VPNs, they remain widely used by private individuals.[116]: 109 State-owned enterprises or state institutions also use VPNs for official work.[116]: 109 The Chinese government has authorized several official VPN providers.[116]: 109 Those who develop or sell their own VPNs potentially face years in prison.[116]: 109
Non-proxy circumvention strategies include:
Some circumvention had been tolerated in the past by the Chinese government; however, there has been publicized criminal enforcement against VPN use.[125] Under the current, unamended law, VPN providers can be prosecuted in China under Supreme Court Guidelines on computer crimes. Providing a type of VPN in a way that severely disrupts the telecommunications market constitutes the offense of unlawful business operations. If a VPN is used to commit illegal activities and is provided to aid and abet the criminal activity, then the VPN provision can fall under aiding and abetting a crime.[126] In November 2025, theMinistry of State Security issued a warning concerning the illegality of using a VPN for circumvention.[127]
In 2010, aroot name server run byNetnod in China started returning poisoned DNS results to global users, preventing users inChile and the U.S. from accessing sites such as Facebook. The server was shut down to stop the poisoning.[128]
In 2014, two-thirds of China's DNS infrastructure began resolving unrelated domains to 65.49.2.178, an address owned by the US-basedDynamic Internet Technology, Inc.,resulting in widespread internet outage in China. No damage to DIT services were reported despite what amounts to an accidentalDDoS. While some sources attribute this incident to GFW's DNS poisoning,[129] others (mostly quoting Chinese sources) speculate this incident was somehow caused by DIT themselves.[130]
Reporters Without Borders suspects that countries such asCuba,Iran,[131]Vietnam,Zimbabwe, andBelarus have obtained surveillance technology from China, although the censorship in these countries is less stringent than in China.[132]
Since at least 2015, the RussianRoskomnadzor agency collaborates with Chinese Great Firewall security officials in implementing its data retention and filtering infrastructure.[133][134][135] During his visit to Beijing in June 2016, Vladimir Putin signed a joint communiqué withXi Jinping on information space, followed by Russia's National Forum for Information Security in October hosted byFang Binxing, the architect of the Chinese Great Firewall.[134]
Especially since the2022 Russian invasion of Ukraine, in order to enforce thewar censorship law, Russian authorities were making an internet surveillance system akin to Chinese Great Firewall.[136]
The Digital Silk Road of theBelt and Road Initiative has also been used to export Great Firewall technology to several other countries.[137]
In September 2025, leaked documents from Geedge Networks—a Chinese company backed byFang Binxing—revealed that China had exported its Great Firewall surveillance technology toKazakhstan,Ethiopia,Pakistan, andMyanmar.[138][139]
Critics have argued that if other large countries begin following China's approach, the whole purpose of the creation of the Internet could be put in jeopardy. If like-minded countries are successful in imposing the same restrictions on their inhabitants and globalized online companies, then the free global exchange of information could cease to exist.[140]
TheUnited States Trade Representative's (USTR) "National Trade Estimate Report" in 2016 referred the China's digital Great Firewall: "China's filtering of cross-border Internet traffic has posed a significant burden to foreign suppliers."[141] Claude Barfield, theAmerican Enterprise Institute's expert of International trade, suggested that the U.S. government should bring a case against the Firewall, a huge trade barrier, in the World Trade Organization in January 2017.[142] Eight of the 24 more trafficked websites in China have been blocked by the Great Firewall. This has created a burden to foreign suppliers who rely on these websites to sell their products or services. The lobby's 2016 business climate survey showed 79 percent of its members reported a negative impact on business due to internet censorship.[143]
According toStephen Rosen, the GFW is reflective of the Chinese government's fear of civil disobedience or rebellion among the Chinese population against the Chinese Communist Party's rule:
If you want to know what people are worried about look at what they spend their money on. If you’re afraid of burglars you buy a burglar alarm. What are the Chinese spending their money on? We’re told from Chinese figures they’re spending on thePeople's Armed Police, the internal security force is about as big as they’re spending on the regular military. This whole great firewall of China, this whole massive effort to control the internet, this effort to use modern information technology not to disseminate information, empowering individuals, but to make people think what you want them to think and to monitor their behavior so that you can isolate and suppress them. That’s because this is a regime which is fundamentally afraid of its own people. And it’s fundamentally hostile to them.[144]
.svg)
_cap_insignia.svg)
.png)
{{cite web}}: CS1 maint: archived copy as title (link)
Media related toGreat Firewall at Wikimedia Commons
The dictionary definition offirewall at Wiktionary
Quotations related toGreat Firewall at WikiquoteInternet censorship circumvention technologies | |||||||
|---|---|---|---|---|---|---|---|
| Background |
| ||||||
| Principles |
| ||||||
| Anti-censorship software |
| ||||||
| Anonymity |
| ||||||
| Physical circumvention methods | |||||||
| Relevant organizations | |||||||
| Reference | |||||||
