How China's Great Firewall Censors the Internet | Explained

The Domain Name System (DNS) functions as a translator that converts human-readable domain names (like www.google.com) into numerical IP addresses (like 216.58.22.196) that computers use to locate servers on the internet; this process involves a hierarchical query system where a computer first checks its local cache, then queries a DNS resolver, which may need to consult root servers, TLD servers, and finally authoritative name servers to obtain the correct IP address before establishing a connection.

DNS (Domain Name System) is a hierarchical directory service that translates human-readable domain names (like netflix.com) into numerical IP addresses that computers use to locate servers on the internet. When a user types a domain name in their browser, the browser sends a request to a DNS resolver, which queries root name servers, then top-level domain name servers, and finally authoritative name servers to find the correct IP address. Once the IP address is obtained, the browser can connect to the server and retrieve the requested resources.

The Domain Name System (DNS) translates human-readable domain names (like google.com) into numerical IP addresses that computers use to communicate. DNS servers maintain databases mapping domain names to IP addresses. When you enter a website address, your computer queries DNS servers to find the corresponding IP address. This system makes the internet more user-friendly by allowing people to remember names instead of numerical addresses. DNS operates hierarchically with root servers, top-level domain servers, and authoritative name servers working together to resolve names efficiently.

DNS (Domain Name System) translates human-readable domain names (like www.microsoft.com) into IP addresses that computers use to communicate. When a user types a domain name, their computer sends a DNS query to a DNS server asking for the corresponding IP address. The DNS server checks its records and returns the IP address mapping. The application then uses this IP address to establish a connection with the destination server. DNS queries typically use UDP rather than TCP for faster response times, though TCP may be used for larger responses. This translation process is essential because computers communicate using numerical IP addresses rather than human-friendly names.

The Domain Name System (DNS) translates human-readable domain names (like www.example.com) into IP addresses that computers use for communication. When you type a domain name into your browser, your computer contacts a DNS server to look up the corresponding IP address. This translation process is essential because humans find it easier to remember domain names than numerical IP addresses, while computers require numerical addresses to route data correctly.

Guard firewalls examine packet contents during transit and can modify addresses, allow passage, or drop packets based on content analysis. They are highly configurable for custom filtering and modification rules. Personal firewalls implement as software programs on individual devices, providing protection for home computers and mobile devices connecting to untrusted networks. Encryption serves as the primary defense for data in transit. Link encryption secures data during transmission but decrypts immediately upon arrival. End-to-end encryption protects data throughout their journey through intermediaries. Secure Shell (SSH) provides encrypted remote access, while TLS/SSL establishes encrypted communications channels with authentication. IPsec handles encrypted network data at the IP layer. Digital signatures verify code authenticity, and encrypted email protects message confidentiality during transit.

SSL/TLS (Secure Sockets Layer/Transport Layer Security) is a cryptographic protocol that establishes encrypted connections between clients and servers. It encrypts data transmitted between users and web servers to create secure, private communication channels, preventing hackers from intercepting sensitive information like usernames and passwords. SSL was first released in 1995 with versions 1.0, 2.0, and 3.0, while TLS emerged in 1999 as its successor with versions 1.0, 1.1, 1.2, and 1.3. The authentication process involves the server sending its certificate and public key, the client generating a private key encrypted with the server's public key, and both parties using this shared secret for secure communication. SSL/TLS inspection in firewalls involves intercepting encrypted traffic, decrypting it for content inspection, and re-encrypting before forwarding. Sophos firewall provides Managed Exclusion List (automatically maintained) and Local Exclusion List (customizable) to prevent decryption issues with certain websites.

SSL (Secure Socket Layer) and TLS (Transport Layer Security) provide encryption for secure websites (HTTPS), with browsers displaying padlock icons for secured connections. Network hardware includes modems (convert digital to analog signals for transmission), routers (forward packets between networks with WAN and LAN connections), switches (redirect packets within LANs, available as managed or unmanaged), and wireless access points (enable Wi-Fi devices to connect to wired networks). Firewalls monitor and control traffic based on security rules, acting as barriers between trusted internal networks and untrusted external networks like the internet.

Encryption converts readable data (plaintext) into unreadable format (ciphertext) using mathematical algorithms so only authorized parties can access the original information. Decryption reverses this process using the correct key. SSL/TLS decryption allows NGFWs to inspect encrypted web traffic (HTTPS) by decrypting it before inspection and re-encrypting it after. This enables detection of threats hidden in encrypted traffic, which traditional firewalls cannot do. Over 90% of web traffic is now encrypted using HTTPS, making decryption essential for comprehensive security.

SSL/TLS encryption works through a handshake process where the client and server exchange supported cipher suites, negotiate algorithms, and exchange public keys to generate a shared session key for symmetric encryption; however, this encryption prevents firewalls from inspecting traffic content, so SSL decryption requires the firewall to act as a proxy by intercepting traffic, generating a self-signed certificate, and performing dual decryption and re-encryption to inspect and filter encrypted data while maintaining security policies.

VPN (Virtual Private Network) is a protocol that creates encrypted communication channels between devices. A protocol defines rules for message formatting, exchange order, and error handling. Tunneling wraps network packets inside encrypted outer layers, hiding original content from observers. VPN architecture involves: application → TUN interface → VPN client (encrypts, compresses) → VPN server (decrypts, routes) → internet. The TUN interface is a virtual network layer that bridges VPN clients with physical network cards, enabling encrypted traffic routing. This allows users to mask their IP addresses and access content from different locations.

This section introduces the fundamental concepts of Virtual Private Network (VPN) architecture. A basic VPN system consists of three core components: the user device (such as a PC or laptop), the VPN client software installed on the device, and the VPN server. The architecture creates an encrypted tunnel that routes internet traffic through the VPN server before reaching its destination. This fundamental structure enables secure network access by masking the user's original location and encrypting data transmissions. The presenter demonstrates this with a practical example showing how connecting to a VPN server in Australia changes the apparent geographic location, illustrating how VPNs provide both privacy and security benefits.

VPNs serve multiple purposes: bypassing access restrictions, hiding internet activities from ISPs and third parties, and securely connecting to remote computers. The basic mechanism involves clients sending packets to VPN servers, which replace client IP addresses with server IP addresses before forwarding to destinations. Network TUN interfaces act as virtual network adapters that allow user-level programs to process packets, unlike physical adapters that operate at kernel level. VPN architecture consists of three components: client, VPN server, and destination website. The client modifies routing tables to redirect all traffic through the TUN interface, reads packets from this interface, and sends them securely to the VPN server via IP and port.

A Virtual Private Network (VPN) encrypts private data for secure transmission over public networks like the internet. The architecture includes a VPN concentrator as the endpoint device, which can be hardware-based, software-based, or integrated into operating systems. IPsec-based VPNs wrap encrypted data with additional headers (IPsec header, trailer, and outer IP header) to route packets correctly. The concentrator decrypts and forwards traffic into the corporate network. SSL/TLS VPNs operate over port 443, enabling seamless firewall traversal for remote access from individual devices.

VPN tunnels work by creating an outer packet that carries the original inner packet. The outer packet contains the source and destination IP addresses of the tunnel endpoints, while the inner packet contains the actual data and original IP addresses. When the outer packet reaches the destination, it is stripped away and the inner packet is forwarded to its final destination. IPsec VPN tunnels use protocols like Authentication Header (AH) for data integrity or Encapsulating Security Payload (ESP) for both encryption and authentication, providing comprehensive protection for data transmitted over the internet.