How China Blocks X: Technical Methods Explained

China maintains one of the world's most technically sophisticated internet censorship infrastructures. X (formerly Twitter) has been blocked within mainland China since 2009, and understanding how that block works requires examining multiple overlapping technical layers rather than a single firewall mechanism.

Background

X was accessible in China until mid-2009, when the platform became a focal point for organizing around the Ürümqi riots. The Chinese government, operating through multiple regulatory bodies including the Ministry of Industry and Information Technology (MIIT) and the Cyberspace Administration of China (CAC), implemented blocking rather than legal prohibition. No formal ban on X exists in Chinese law; instead, the blocking occurs through technical means enforced at critical infrastructure points—primarily at the borders where Chinese internet service providers connect to international networks, and at major domestic interchange points.

Current Technical Blocking Methods

China uses at least five distinct technical approaches to block X, often in combination:

DNS Filtering: When a user inside China queries a DNS resolver for twitter.com or x.com, the request is intercepted at the resolver level. The resolver returns either a null response, a timeout, or an IP address pointing to a blocking page. This method is cheap to deploy and affects users who rely on standard DNS resolution. Users see connection timeouts or error pages rather than successful DNS lookups.

IP Blocking: X's known IP addresses are blacklisted at the border. Packets destined for these IPs are dropped or reset by firewalls operated by state-controlled ISPs. This is visible to researchers as connection resets (TCP RST packets) or complete packet loss when attempting to connect directly via IP address rather than domain name.

SNI Inspection: When a user initiates a TLS connection to x.com, the Server Name Indication (SNI) field in the TLS ClientHello packet contains the domain name in plaintext. Chinese deep packet inspection (DPI) systems read this field and block the connection before the TLS handshake completes. A user behind SNI filtering sees the connection reset during the TLS handshake phase, not during DNS resolution.

Deep Packet Inspection (DPI): More advanced filtering inspects encrypted traffic patterns, looking for behavioral signatures consistent with X usage—for example, distinctive connection patterns, timing, or packet sizes. DPI-based blocking is harder for researchers to definitively attribute to a specific domain but is detectable through statistical analysis of blocked flows.

BGP-Level Intervention: At the border gateway protocol level, China can announce routes for specific IP ranges or AS numbers, causing traffic to be misdirected or dropped before reaching the destination. This is rarer and more disruptive than other methods but has been documented in historical censorship events. It affects connectivity at a fundamentally structural level.

Detection by Researchers

Organizations like the Open Observatory of Network Interference (OONI) detect these blocking methods by running standardized tests from vantage points inside China and comparing results to baseline measurements from outside the country. The OONI Probe application tests DNS resolution, attempts HTTP requests, and performs TLS handshakes, logging exactly where the connection fails—at DNS, at TCP, or during TLS negotiation. This data, published in the OONI database, allows researchers to identify which blocking mechanism is active.

Citizen Lab and independent researchers use similar techniques: they measure response times, examine packet-level behavior, and correlate findings with known Chinese censorship infrastructure. When a connection is reset by a Chinese firewall, forensic analysis of the RST packet's TTL and TCP window size can indicate whether it came from a filtering device or a legitimate server.

Impact

According to publicly available OONI measurements and reports from Access Now, X has remained consistently blocked for users within mainland China since 2009. The blocking is not absolute—some connections occasionally succeed, and blocking intensity fluctuates—but persistent. Users attempting to access X see either DNS failures, connection timeouts, or TLS errors depending on which layer blocked the request.

Circumvention Methods

Various circumvention technologies address different layers of blocking. Tools like Tor, particularly Tor pluggable transports such as Snowflake and WebTunnel, obfuscate the destination of the connection. Encrypted DNS (DoH/DoT) bypasses DNS filtering if the recursive resolver is outside China. Open protocols like OpenVPN, WireGuard, and Shadowsocks can tunnel traffic, though they are themselves subject to blocking via DPI. More recent approaches like REALITY and MASQUE attempt to make encrypted tunnels indistinguishable from legitimate traffic. Each technology makes different tradeoffs between speed, detectability, and usability; none provides perfect protection against a motivated adversary with access to backbone-level traffic analysis.

Conclusion

China's blockade of X is not a single technical barrier but a layered system exploiting multiple network layers simultaneously. Researchers can identify which layers are active through measurement, but the blocking persists because it is enforced at infrastructure points where individual users have no control. Understanding these methods is essential for anyone researching internet freedom or circumvention technology.