Research background · IEEE S&P 2025
A Wall Behind a Wall
Emerging Regional Censorship in China
China’s Great Firewall (GFW) has long been associated with relatively centralized Internet censorship. Reports from Henan in August 2023 pointed to an additional regional firewall. The study documents TLS SNI and HTTP Host filtering of traffic leaving the province. Aggressive, frequently changing domain rules led Henan to block ten times as many websites as the GFW at some points during the study. Explore the daily SNI blocklists below to compare both firewalls, follow individual hostnames, and download a day’s observations.
Follow censorship over time.
Henan Firewall vs. GFW · Compare exact hostname histories.
Absence from a censored list does not confirm access. Missing or excluded days stay separate. Select a cell to inspect its source.
Geographic context
A firewall within a firewall
Henan’s location and the measurement setup described in the study.
ChinaHenanZhengzhouGuangzhouBoundaries:geoBoundaries, CC BY 4.0 (2019; rounded and projected). City points:Natural Earth. Paths are schematic; dots locate cities, not measurement machines.
Why Henan is different
The Henan Firewall filters traffic leaving the province, including connections to other parts of China. The GFW filters international traffic. The study found more frequent changes in Henan’s blocking, with broad domain-suffix rules contributing to large swings.Findings ↗
How the two were measured
Clients in Zhengzhou, Henan sent probes to controlled receiving servers in Guangzhou and San Francisco. Domestic paths isolated regional filtering; international paths could encounter both systems, distinguished through their reset-packet fingerprints.Methodology ↗
The paper’s daily study tested Tranco’s top million domains four times for TLS censorship, marking a domain blocked if any probe received a reset. Its Henan measurements cover China Unicom’s AS4837. These charts use the supplied archive, which is not the paper’s larger, 227-million-domain experiment.