A Tale Of Building A REAL Full Speed Anti-Censorship Router

A Tale Of Building A REAL Full Speed Anti-Censorship Router

Speakers: KaiJern Lau (Qiling Framework)

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=NY7kBh3XVzE

Overview

In this compelling talk at HITB Amsterdam, KaiJern Lau, founder of the Qiling Framework, shared his personal journey and technical expertise in circumventing the sophisticated censorship mechanisms of China's Great Firewall (GFW). Titled "A Tale Of Building A REAL Full Speed Anti-Censorship Router," Lau's presentation detailed the evolution of internet censorship in China, the limitations of traditional VPN solutions, and the innovative, high-performance router he engineered to maintain consistent, uncensored internet access. His narrative underscores the relentless "cat and mouse" game between state-sponsored censorship and the determined efforts of individuals and open-source communities seeking internet freedom.

The talk is particularly significant as it moves beyond theoretical discussions to present a practical, real-world solution developed out of necessity during the prolonged COVID-19 lockdowns in China. Lau's custom-built OpenWrt-based router, integrated with advanced tunneling protocols and intelligent traffic management, offers a blueprint for achieving full-speed, reliable access to the global internet from heavily censored environments. It highlights the critical role of open-source projects and community-driven development in empowering users to bypass increasingly complex digital barriers.

Lau's presentation serves as a vital resource for anyone grappling with internet censorship, whether individuals, businesses, or cybersecurity professionals. It not only provides a deep technical dive into effective bypass strategies but also sheds light on the socio-political context of digital control, offering nuanced insights into the operational realities of living and working under strict internet restrictions. The speaker’s candid anecdotes, including his initial fears about the talk's implications, lend a unique authenticity to the technical discussion, making the challenges and solutions all the more palpable.

Background

▶ Watch: Speaker's personal journey to building anti-censorship router (4:00)

The genesis of China's Great Firewall (GFW) can be traced back to 2009, following the 2008 Beijing Olympics. Initially, the Chinese government adopted a more open stance during the Olympics, but a year later, concerns over the spread of "false news" on platforms like Facebook led to a significant shift. The government requested Facebook to implement content restrictions, which Mark Zuckerberg reportedly refused. This refusal precipitated the construction of the GFW, leading to the blocking of major international platforms such as Google, Twitter, Facebook, and Gmail. The censorship evolved to include not just "improper" websites like PornHub, but also a stringent system for all websites hosted within China.

This system mandates that any website, whether corporate (e.g., Tesla China) or personal, must be registered with local police, detailing its content and purpose. A unique approval number must be displayed on the website. Furthermore, business registrations or personal identity documents (like passports) are linked to these approvals, with websites automatically shut down if these documents expire or companies deregister. VPNs, while not entirely illegal for corporations that report their usage to authorities, are strictly prohibited for personal use. The GFW's mechanisms also extend to content pre-screening: videos uploaded to Chinese platforms like Bilibili (China's YouTube equivalent) undergo human review, which can take hours, ensuring "appropriate" content. Interestingly, this human-based filtering often exhibits quirks, such as stricter censorship for Chinese bad language compared to English rap songs or certain Chinese dialects like Cantonese.

Over time, the GFW's sophistication has escalated dramatically. Post-2019, censorship became more granular, with "massive blocking" occurring at different geographical scales—from entire cities to small housing areas. These blocks can be intermittent, sometimes even affecting local Chinese websites, leading to an unstable "Intranet" experience. Specific periods, such as parliamentary meetings, consistently trigger heightened restrictions, making international connectivity exceptionally difficult for weeks. Early bypass methods, primarily traditional VPNs (SSL VPN, IPSec, WireGuard), initially offered a solution. However, they soon proved problematic for users in China who also needed seamless access to local services like WeChat, Alipay, and Didi. Routing all traffic through an international VPN server (e.g., in Singapore) and then back to China for local services created unacceptable latency and performance issues, rendering traditional VPNs impractical for daily life. This inadequacy spurred the development of more advanced, flexible anti-censorship tools.

Key Findings

▶ Watch: Evolving, localized, and intermittent censorship tactics (17:00)

KaiJern Lau's personal experience of being stuck in China from 2020 to early 2023 due to COVID-19 lockdowns served as the crucible for his project. His primary finding was the critical need for a bypass solution that could offer full-speed, reliable, and intelligently routed internet access without compromising local Chinese services. The traditional VPNs of the past (2017-2018 era) were no longer sufficient, leading to the rise of more sophisticated, open-source alternatives.

A central discovery was the evolution from basic VPNs to protocols like ShadowSocks and ShadowSocksR (SSR), which offered lighter encryption and were designed to be less detectable. These protocols introduced GeoIP-based routing, allowing traffic to be intelligently segregated: Chinese IPs would go directly to the local intranet, while international IPs would be routed through a proxy server. This marked a significant shift towards smart traffic management, addressing the dual-access problem.

However, the "cat and mouse" game continued, with GFW operators frequently blocking GitHub repositories of these open-source projects. This led to a proliferation of new protocols and frameworks, such as Trojan, VMESS, and VLESS, often consolidated under projects like X-ray. These newer protocols were designed to mimic legitimate HTTP or HTTPS traffic, making them harder for the GFW to detect and block. They could even run in front of web servers like Nginx or Apache to further obfuscate their nature.

Lau's project underscored the finding that a truly effective anti-censorship solution requires:

1. Multi-protocol support: The ability to switch between or combine various tunneling protocols to adapt to GFW changes.
2. Intelligent traffic categorization: Beyond GeoIP, this includes application-specific routing (e.g., Netflix to Japan, ChatGPT to the US, Spotify to Hong Kong).
3. Customizable DNS: To circumvent DNS poisoning and pollution.
4. High-performance hardware: To handle encryption, routing, and high bandwidth without becoming a bottleneck.
5. Active community development: The continuous evolution of open-source projects like OpenClash is crucial for maintaining effectiveness against an actively evolving censorship system.

Finally, Lau highlighted a nuanced understanding of the GFW's enforcement: bypassing the GFW is generally not considered a "serious crime" for common users, provided it's not used for activities deemed "bad things" by the government (e.g., spreading "fake news"). This tacit allowance, where authorities "choose to ignore" common usage, creates a delicate balance, but constant vigilance and adaptation are still necessary to avoid service disruption. A third-party internal statistic suggests that around 60% of Chinese internet users have experience in bypassing the GFW.

Technical Deep Dive

▶ Watch: Deep dive into Open Clash's advanced routing features (34:00)

The technical core of Lau's solution revolves around a custom-built, high-performance router running OpenWrt, augmented with advanced open-source tunneling and traffic management frameworks. This setup is designed to address the GFW's sophisticated blocking techniques and provide a seamless "proper internet" experience.

Initially, Lau utilized an industrial control server, featuring a 7th-gen Intel Core i7 processor and 32GB RAM, running VMware vSphere. While functional, this setup was resource-hungry and had driver compatibility issues common with non-enterprise hardware on ESXi. The limitations prompted an upgrade to a more powerful, custom-built CPU box. This new hardware supports a more flexible virtualization environment, specifically Proxmox, allowing for the deployment of various containers and QEMU virtual machines, including the dedicated OpenWrt instance. The custom box also included a 10 Gigabit Network Interface Card (NIC) for high-speed throughput.

The OpenWrt firmware itself is a heavily modified version, incorporating several Chinese-developed plugins for content filtering and bypass. Crucially, Lau cleaned up the interface and scripts, translating everything to English for wider usability and maintainability. The firmware is built from source, ensuring transparency and preventing hidden backdoors.

At the heart of the intelligent routing capability lies OpenClash, a powerful plugin for OpenWrt. OpenClash acts as a unified interface and manager for various tunneling protocols, including ShadowSocks, SSR, Trojan, VMESS, and VLESS. These protocols are designed to be stealthier than traditional VPNs:

• VMESS and VLESS are particularly interesting as they can obfuscate traffic to appear as standard HTTP or HTTPS traffic, even allowing them to run behind legitimate web servers like Nginx or Apache. This makes detection by deep packet inspection much harder for the GFW.
• Trojan is another protocol that mimics HTTPS traffic, often using TLS to blend in with normal web traffic.

OpenClash leverages highly detailed categorization rules, which are actively maintained by a dedicated developer community. These rules extend far beyond simple GeoIP filtering:

• GeoIP-based routing: Automatically directs traffic to Chinese IP ranges directly to the local intranet and international IPs through the chosen proxy.
• Application-specific routing: This is a standout feature. OpenClash can route traffic for specific applications or services (e.g., Apple services, Netflix, Spotify, YouTube, ChatGPT) through different proxy servers located in different countries. For instance, a user can configure Netflix traffic to go through a Japanese server for regional content, while ChatGPT traffic routes through a US server, and general browsing goes via Hong Kong. This granular control optimizes both performance and access to geo-restricted content.
• Custom DNS server: To bypass DNS pollution, the router can utilize specific DNS servers, preventing the GFW from redirecting or poisoning DNS queries for blocked sites.
• UDP traffic filtering: Essential for services like ChatGPT, which might use UDP, ensuring these connections are also properly proxied.

The selection of the remote proxy server (the "exit point") is critical for performance. Lau emphasized the importance of specific network lines:

• CN2 (ChinaNet Next Generation): A direct, high-speed line between Hong Kong and mainland China, crucial for fast connections into and out of China. Servers without CN2 links will experience significantly slower routes.
• GIA (Global Internet Access): A premium link between Asia and the US, vital for optimal performance when connecting to American services.

When choosing a Virtual Private Server (VPS) for self-hosting the proxy, factors like maintenance, protocol updates (X-ray, VMESS, VLESS protocols are constantly evolving), and usage volume are important. Sharing a VPS with many users increases the risk of the IP being blocked by the GFW. Alternatively, users can subscribe to commercial tunnel providers, which range from "suspiciously cheap" (e.g., $3-5/month for 150-300GB bandwidth, raising data privacy concerns) to "professional and expensive" (e.g., $70-80/month for high bandwidth, dedicated support, and frequent IP updates). Lau personally opted for the more expensive, reliable providers.

The entire system is designed for high throughput. The speaker's home setup, with a 1 Gigabit per second (Gbps) fiber internet connection, demonstrated near full-line speed when connecting to proxy servers: 850 Mbps to Malaysia, 948 Mbps to Hong Kong, and 943 Mbps to Singapore, showcasing the effectiveness of the optimized hardware and software stack.

Demo / Proof of Concept

▶ Watch: Demonstrating full gigabit internet speeds with the router (37:00)

While KaiJern Lau did not perform a live, interactive demo during his talk, he effectively showcased the capabilities and performance of his anti-censorship router through detailed screenshots and performance metrics from his own home setup. This served as a compelling proof of concept for the "REAL Full Speed" aspect of his solution.

The key demonstration points included:

1. OpenClash Interface Visualization: Lau presented screenshots of the OpenClash interface running on his OpenWrt router. This visually highlighted the sophisticated traffic categorization capabilities. The interface displayed various "running boards" or profiles, allowing users to select different routing strategies. Crucially, it showed the granular rule sets, such as:

• Proxy: General international traffic.
• Domestic: All Chinese domains and websites, routed directly.
• Apple: Specific rules for Apple services.
• Asian TV, Netflix, Spotify, YouTube: Dedicated routing rules for popular streaming and media services.
• ChatGPT: A specific category for OpenAI's ChatGPT, indicating the need for specialized routing, potentially including UDP traffic filtering, due to its use of Cloudflare and IP tracking.

Each category could be independently configured to route through a specific server location (represented by "little round cubes" in the UI), allowing for highly customized internet access. For example, Netflix traffic could be directed to Japan, ChatGPT to the US, and general browsing to Hong Kong, all simultaneously.

1. Proxy Tester and Latency Measurement: The OpenClash interface also includes a "proxy tester" tab. This feature allows users to evaluate the latency (ping value) and delay of different proxy servers in various countries. This is crucial for selecting the fastest and most reliable exit nodes for specific services, ensuring optimal performance.

1. High-Speed Performance Metrics: The most impactful proof of concept was the speed test results from Lau's own 1 Gigabit fiber internet connection. He showed screenshots demonstrating near line-speed performance when connecting to international servers through his custom router:

• Almost full speed to Hong Kong.
• 850 Mbps to Malaysia.
• 800 Mbps to Singapore.
• 948 Mbps to Hong Kong (another test).
• 943 Mbps to Singapore (another test).

These figures clearly illustrate that the solution can deliver "proper internet" at speeds comparable to uncensored connections, effectively overcoming the bandwidth limitations often associated with VPNs and other bypass methods in censored environments. This disproved the common notion that bypassing the GFW inevitably leads to significant speed degradation.

The demonstration, through these detailed visual and numerical proofs, effectively conveyed the power, flexibility, and high-performance capabilities of the custom OpenWrt router with OpenClash.

Defensive Implications

▶ Watch: Q&A: Nuances of VPN blocking and evasion tactics (51:00)

From the perspective of those operating the Great Firewall, KaiJern Lau's talk implicitly highlights the continuous and evolving challenge of maintaining effective internet censorship. The talk demonstrates that relying on static blocking lists or easily detectable VPN protocols is insufficient. The constant development of new obfuscation techniques (like VMESS/VLESS mimicking HTTPS), intelligent traffic categorization, and the rapid adaptation by open-source communities means that GFW operators must perpetually update their detection mechanisms, including advanced deep packet inspection and traffic analysis. The widespread adoption of bypass techniques (estimated 60% of Chinese internet users having experience) also indicates that the GFW's effectiveness in completely isolating the population is limited, forcing a nuanced approach to enforcement.

For individuals and companies operating within censored environments, the defensive implications are primarily about resilience and strategic access.

1. For individual users: The talk provides a clear pathway to regaining internet freedom. It emphasizes moving beyond simplistic VPNs to more robust, multi-protocol solutions. The legal nuance – that bypassing the GFW isn't a crime unless used for "bad things" like spreading "fake news" – offers a practical framework for risk assessment. Users are advised to avoid drawing undue attention to their bypass activities by not engaging in politically sensitive content dissemination.
2. For companies with employees traveling to China: The talk offers critical advice.

• Short-term travel: Relying on international roaming data or commercial VPNs (like ExpressVPN, NordVPN) might suffice, though their reliability can be inconsistent.
• Long-term presence: A more robust solution, such as a self-hosted server with a CN2 or GIA line, or subscribing to a professional bypass service, is essential for stable business operations. The speaker notes that companies need to report their VPN usage to the police.
• Security posture: Companies should be wary of extremely cheap tunnel providers, as their business model raises concerns about data privacy and potential compromise ("I still believe they try to steal some data from us"). Opting for more expensive, reputable providers is recommended for sensitive corporate data.
• Traffic Obfuscation: The advice to make traffic look legitimate (e.g., hosting a fake Git repository with high traffic) is a practical defensive measure to reduce suspicion compared to a simple "welcome to my homepage" site with suspicious traffic volumes.
• Constant Adaptation: Both individuals and companies must recognize that this is an ongoing "cat and mouse" game. Solutions that work today may be blocked tomorrow, necessitating continuous updates to protocols, server IPs, and configurations. The use of actively maintained open-source projects like OpenClash, with their rapid updates, is therefore a strong defensive strategy.

In essence, the talk equips users and organizations with the knowledge to build a robust defense against censorship, turning the tables by leveraging technical sophistication to maintain connectivity in restrictive environments.

Key Takeaways

• The Great Firewall is a sophisticated, evolving censorship system: It extends beyond simple website blocking to include mandatory website registration, human content review, granular geographical blocking, and real-time adaptation against bypass methods.
• Traditional VPNs are often insufficient for comprehensive bypass: They struggle with the dual need for international and local Chinese internet access, leading to performance issues and unreliability.
• Multi-protocol, intelligent routing is essential: Solutions like OpenWrt with OpenClash and X-ray, leveraging protocols like ShadowSocks, SSR, Trojan, VMESS, and VLESS, offer superior obfuscation and flexibility by mimicking legitimate HTTP/HTTPS traffic.
• Granular traffic categorization optimizes performance and access: GeoIP-based routing combined with application-specific rules (e.g., for Netflix, Spotify, ChatGPT) allows for tailored internet access, directing different traffic types through optimal international proxy servers.
• Hardware and server selection are critical for speed and reliability: High-performance router hardware and strategically chosen proxy servers with premium network lines (CN2 for China-Hong Kong, GIA for Asia-US) are vital for achieving full-speed internet access.
• Bypassing the GFW carries nuanced risks: While not a "serious crime" for casual use, engaging in activities deemed politically sensitive can lead to severe consequences, and extremely cheap commercial bypass services may pose data privacy risks.

About the Speaker(s)

KaiJern Lau is the founder of the Qiling Framework, an open-source project focused on binary emulation and analysis. Hailing from Malaysia, he has been an active presence in the cybersecurity conference circuit, giving talks and training sessions at events like Black Hat and previous editions of Hack In The Box (HITB) since 2019. His work with the Qiling Framework has showcased his deep expertise in reverse engineering and system-level security. In this particular talk, Lau shared a deeply personal and practical application of his technical prowess, born from his experience of being stuck in China during the COVID-19 pandemic and his determination to maintain uncensored internet access.