Internet censorship: technical solutions to stay connected

The textbook case: Gabon, February 2026

On 17 February 2026, Gabon's High Authority for Communication (HAC) ordered Facebook, TikTok, YouTube, WhatsApp and Instagram suspended nationwide, officially to fight "hateful and defamatory" content, against a backdrop of social unrest and two months before a presidential election.

VPN demand exploded by 25,000% in 24 hours according to NetBlocks — 180,000 downloads in the first week versus 45,000 before. Proton VPN recorded +60,000% Gabonese signups. The HAC announced it wanted to block VPNs too, but three weeks later no VPN blocking was in effect.

Gabon isn't an isolated case: the DRC is considering similar measures, and Russia, China and Iran already block. Understanding how internet censorship works, and how to bypass it, is a basic technical skill.

How a state blocks the internet

Tier 1 — DNS blocking. The government orders ISPs to alter their DNS servers so queries for facebook.com return an NXDOMAIN error instead of the real IP address. That's exactly what Gabon did: OONI analysis confirms pure DNS tampering, with no IP blocking or DPI. Trivial to bypass — but enough to block 90% of the population.

Tier 2 — IP blocking. The ISP blocks the target's server IP addresses directly. More effective, but hard to maintain: large platforms have thousands of IPs and keep adding more.

Tier 3 — Deep Packet Inspection. DPI analyses packet contents in real time and identifies traffic type (VPN, Tor) to block it, even when DNS and IP are bypassed. That's the Chinese Great Firewall: expensive, technically complex, and it slows the whole network down.

Tier 4 — full shutdown. The kill switch: cut the fibre, turn off the towers. No technical solution bypasses a physical shutdown.

Solution 1: change DNS

Difficulty: trivial — 2 minutes, nothing to install

If the blocking is DNS-based, just stop using your ISP's resolver:

Android: Settings → Network → Private DNS → one.one.one.one (Cloudflare) or dns.google. That's DNS-over-TLS, so the ISP can't even see the queries.

iPhone: Settings → Wi-Fi → network → Configure DNS → Manual → 1.1.1.1 and 1.0.0.1. For cellular, the 1.1.1.1 app applies encrypted DNS system-wide.

Desktop:

# Linux - temporary change
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

# Linux - permanent with systemd-resolved
sudo mkdir -p /etc/systemd/resolved.conf.d
cat << EOF | sudo tee /etc/systemd/resolved.conf.d/dns.conf
[Resolve]
DNS=1.1.1.1 1.0.0.1
DNSOverTLS=yes
EOF
sudo systemctl restart systemd-resolved

On Windows: Settings → Network → Adapter properties → DNS → 1.1.1.1.

Limitations: only works against DNS blocking. And some ISPs intercept DNS queries even to third-party servers (DNS hijacking) — you then need encrypted DNS.

Solution 2: DNS-over-HTTPS (DoH)

Difficulty: easy — 5 minutes

DoH wraps DNS queries in ordinary HTTPS traffic. To the ISP it looks like a normal web connection to cloudflare-dns.com, impossible to distinguish or intercept without blocking HTTPS entirely.

Natively in the browser:

• Firefox: Settings → Privacy → DNS-over-HTTPS → Max Protection → Cloudflare
• Chrome: Settings → Security → Use secure DNS → Cloudflare (1.1.1.1)

To cover the whole system, dnscrypt-proxy:

# Debian/Ubuntu
sudo apt install dnscrypt-proxy
# Config in /etc/dnscrypt-proxy/dnscrypt-proxy.toml (default servers already use DoH)
sudo systemctl enable --now dnscrypt-proxy

Then point the system DNS at 127.0.0.1.

Limitations: effective against DNS blocking and DNS hijacking, useless if platform IPs are blocked directly.

Solution 3: commercial VPN

Difficulty: easy — 5 minutes, one app to install

A VPN encrypts all traffic and exits it in another country. The ISP only sees an encrypted connection to the VPN server. The criteria that matter against censorship: obfuscated protocols (raw WireGuard is DPI-identifiable), a no-log policy verified by independent audit, jurisdiction outside the 14 Eyes.

Proton VPN has a limited but functional free tier.

Limitations: cost (~€5-10/month for the good ones; free ones are limited or dubious); commercial server IPs are known and listed, hence blockable; and you're moving your trust from the ISP to the VPN provider.

Solution 4: Tor

Difficulty: easy to install, slow to use

Tor routes traffic through three successive relays, each knowing only part of the path. Nobody — not the ISP, not the relays, not the destination site — can reconstruct the full chain.

# Tor Browser: download from torproject.org
# Or from the command line on Debian
sudo apt install tor torbrowser-launcher
torbrowser-launcher

On Android: Tor Browser from the Play Store or F-Droid.

If the government blocks known Tor relays, bridges exist — relays not listed publicly. obfs4 bridges disguise Tor traffic as random noise: Settings → Connection → Bridges → Use a built-in bridge → obfs4.

Limitations: slow (three encryption hops, unusable for streaming or video calls), browser-only, and many services block Tor exit IPs.

Solution 5: SSH tunnel (SOCKS proxy)

Difficulty: intermediate — requires a server abroad

ssh -D 1080 -N -f user@my-server.com

This creates a local SOCKS5 proxy on port 1080; configure the browser to use localhost:1080. All traffic then goes through your server, encrypted inside SSH.

Limitations: only covers apps configured to use the proxy, and SSH is DPI-identifiable (port 22, characteristic handshake).

Solution 6: VLESS+Reality (Xray)

Difficulty: intermediate — requires a server abroad

This is the most effective option against advanced DPI in 2026. Xray with the VLESS+Reality protocol doesn't just encrypt traffic: it makes it look like a legitimate HTTPS connection to a real website (e.g. www.microsoft.com).

Unlike a classic VPN that creates an identifiable tunnel, VLESS+Reality performs a genuine TLS 1.3 handshake with the target site. To an observer, the traffic is indistinguishable from a normal visit to microsoft.com. The Chinese Great Firewall and Russian TSPU can't block it without blocking microsoft.com.

The principle: Xray runs on a VPS abroad, listens on port 443 and impersonates www.microsoft.com. A client on your device connects to it; DPI sees a normal HTTPS connection and lets it through, while your traffic is tunnelled inside.

Limitations: requires a VPS and technical skills; it's a proxy, not a mesh VPN; and if the government blocks your VPS IP specifically, you have to change it.

Which solution for which block?

*With obfuscated protocols (Stealth, obfs4 bridges) — variable effectiveness

Applied to the Gabon case

Since the blocking is DNS tampering confirmed by OONI, changing DNS is enough to unblock everything. No VPN or Tor needed. The logical progression:

1. Immediate: change the Android phone's private DNS to one.one.one.one. Thirty seconds.
2. If that's not enough (ISP DNS hijacking): Proton VPN or Cloudflare WARP, both free.
3. If VPNs get blocked: Stealth protocol in Proton VPN, or Tor with obfs4 bridges.

Three weeks after the suspension, step 1 still suffices. The HAC announced it wanted to block VPNs, but the economics are deterrent: DPI-based VPN blocking costs between $3 and$10 million to deploy, plus $1-3 million a year to run — and it would break the digital economy, since businesses, banks and NGOs all use VPNs.

What next?

All of these solutions depend on a third party: Cloudflare for DNS, Proton for the VPN, the Tor network for bridges.

In the second part, we'll see how to take back full control: running your own VPN server with Headscale plus a VLESS+Reality (Xray) proxy on a Swiss VPS, both sharing port 443 through nginx SNI routing — Headscale for the daily VPN, Xray to bypass DPI while travelling.

The techniques presented here aim to preserve access to information, a fundamental right recognised by Article 19 of the Universal Declaration of Human Rights. Use them responsibly and with awareness of local laws.