Internet circumvention: choosing routes and assessing risk

A site that will not open is not always being censored. If blocking is deliberate, get tools only from official paths and do not trust random circumvention apps from chat channels. A VPN hides traffic from the local network but shows it to the VPN provider. Do not confuse reaching a site with being anonymous, and do not confuse Tor with a site simply opening.

Read the path of a request in how the internet works and where access is restricted. Take the limits seriously in communication anonymity: arriving at a page does not mean your identity stayed hidden.

First see whether it is really blocking

A typo in the address, a server outage, an expired certificate, the wrong clock on the device, a geographic sales limit, a hotel Wi-Fi sign-in page and even a full disk can all produce the same “it will not open.” If you install a circumvention tool for a problem that is not censorship, you waste time and you may install something dangerous.

1. Check the address from a bookmark or by typing it again; one missing or extra letter produces a different page.
2. Try several different sites. If nothing opens, the problem may be the connection itself, the Wi-Fi or a captive portal.
3. Try the same site on mobile data, then on Wi-Fi. If it fails on only one of them, a limit on that network is more likely.
4. Set the device’s time and date to automatic. A wrong clock causes certificate warnings and a secure site will not open.
5. If the browser warns about a certificate, do not bypass the warning just so it “opens.” Check the network and the clock first.
6. If you can, ask from another device or network whether that page opens for other people. A widespread outage is not the same as local blocking.

Blocking can happen at several layers

Sometimes only the domain name will not resolve, sometimes the numeric address is blocked, sometimes the connection is recognized from the site name or from a traffic pattern and cut, and sometimes the app itself is not allowed to update in a store or on the network. You do not need to diagnose the exact type like a network engineer; it is enough to know that one tool does not solve every layer. The stops on the path are explained in the internet-path guide.

• If only one site fails and others work, that destination may be the one being limited.
• If a whole family of services fails together, the limit is broader than one domain.
• If Tor or a VPN will not connect either, entry to those networks may be limited separately and you may need connection settings or a bridge.
• Severe slowness is sometimes a limit and sometimes only a busy network; do not install a new tool only for ordinary slowness.

Get the tool from a path you can trust

The most common practical danger is not the blocking itself; it is installing an app that a message, an ad or a search result calls a “free VPN” or “Tor,” and that then reads your traffic or drops malware. Get the tool from that project’s official site or from the maker’s official store, not from a file sent in a group.

1. Open the official address from a source you already know, or type it carefully, not from the first search ad.
2. The connection should be HTTPS without a certificate warning.
3. Do not install a file from a chat channel, a promotional flash drive or an unknown short link.
4. If the official site will not open on this network, use that project’s own official alternative method, not the first “mirror” file in a group.
5. After you install, read the app’s permissions: a circumvention tool that wants SMS, contacts and unrelated storage is suspicious.

Where to get Tor Browser

The safest way to download Tor Browser is from the Tor Project’s official site. If that page will not open on your network, the project itself offers official alternatives. Do not confuse those with a random file that happens to be named Tor.

1. From a device that can reach the official site, open the Tor Project download page and get the Windows, Mac, Linux or Android edition.
2. If the main site is blocked, use GetTor: send mail to gettor@torproject.org and write only the word windows, osx, linux or android in the body. The official reply sends a download link and information for checking the file.
3. Do not confuse the links in that reply with a file a stranger sends you.
4. After installation, open Tor Browser from its own shortcut; do not imitate “Tor” with an unknown extension in your ordinary browser.
5. Update Tor Browser from inside itself or again from the official path, not by installing a side package.

The first connection, and when Tor will not connect directly

1. When Tor Browser opens, tapping Connect is enough on most networks.
2. If you know the connection is limited, or the progress bar stalls, open Configure Connection.
3. Connection Assist can suggest a bridge based on your location. If the location is not detected, choose a region from the list and try a bridge.
4. To choose manually, open Settings, then Connection, and pick one of the built-in bridges. Options such as obfs4, Snowflake, meek or WebTunnel are designed to get you onto Tor when direct entry is limited.
5. If a built-in bridge does not work, use Request bridges in that same Connection section, complete the check, and connect.
6. Do not take a bridge from someone who sends you a “ready list” in chat and asks you to install another app, unless it is the project’s own official path.

Enter a bridge in the browser settings

1. If Tor Browser is already open, open the menu, then Settings, then Connection.
2. In the Bridges section, choose to enter bridge addresses you already have and put each address on its own line.
3. Connect. If that fails, the bridge may be down; get a fresh set from the official path.
4. On Android, open Connection settings or Config Bridge, turn on Use a Bridge, and if you have an address tap Provide a Bridge I know.
5. An incomplete address, or only the emoji that represent a bridge, is not enough to connect; you need the full address.

Choose a VPN with its limits in mind

A VPN hides the device’s or that app’s traffic from the current network and takes it to the VPN provider. That provider can usually see which destinations you visit. You cannot verify a “no logs” promise from inside the app itself. An unknown free VPN spread in a messenger ad is one of the riskiest choices.

1. If an organization or group you trust gives you VPN or Outline access, get the client from that project’s official site and enter only the key or configuration file they themselves provided.
2. Do not republish an access key in a public group.
3. For personal use, install a provider you chose from its official site, not the first “free VPN” result.
4. Do not accept a certificate or VPN profile someone sends in a message with “install this to connect,” unless you have verified the source separately.
5. After you connect, see whether the whole device uses that path or only one app; read that in the tool’s own settings.

What does not change after you connect

1. You still have to respect the browser lock and certificate warnings. A new path does not fix a fake site.
2. Signing in with a personal account tells the site who you are. If anonymity was the goal, read the anonymity-limits guide.
3. Do not install a root certificate or an unknown “install this profile for internet” prompt to make a site open; that can make the traffic readable.
4. Do not mix links on a hotel Wi-Fi sign-in page with a circumvention tool; finish that portal first, or switch to mobile data.
5. Lower speed than a direct connection is normal. If nothing opens at all, change the tool or request another official bridge; do not turn off every security warning.

Judge the risk against the goal

Laws about circumvention tools differ from place to place. This guide is not legal advice. Before you install, judge whether opening that site is worth the local network seeing that you joined an alternate path, and whether that path’s provider is acceptable to you.

1. Do not install a personal tool on a work- or school-managed device; it may break policy and it may also be visible.
2. If you only need to send one important message or email, mobile data instead of limited Wi-Fi is sometimes enough and no new tool is required.
3. Do not install and remove several suspicious tools in a row; each one leaves permissions and history on the device.
4. Write down the goal: only opening a news site, or keeping an identity separate. An access tool does not solve the second.

Do not treat Android, iPhone and a computer as the same

1. On a computer, keep Tor Browser apart from your everyday browser, and do not open the main account’s bookmarks there if the identity should stay separate.
2. On Android, install Tor Browser from the project’s official path. Third-party apps with a similar name are not a substitute.
3. On iPhone, the official store is stricter with some tools. Do not install whatever is offered from outside the store with an unknown “organization profile” just to get around a block.
4. Do not postpone system updates because you worry “the circumvention tool might stop working”; an unpatched device is the larger risk.

Common mistakes

• Installing the circumvention app suggested in the same message that says the site will not open.
• Searching for a Tor download and taking the first file from an advertising site.
• Bypassing a certificate warning so the page will open.
• Assuming that after a VPN connects you are anonymous.
• Pasting an Outline key or a configuration file into an app that is not the official client.
• Installing every bridge or every app after a couple of failures, without going back to the official path.

Tell a fake download site from the official one

Many pages with a name like the Tor Project, or with a “free download” title, show up in search results. A familiar icon and color are not enough.

1. Read the address letter by letter. One extra letter or a different domain is enough for the file to be malicious.
2. If the browser warns about a certificate, or the page suddenly jumps to downloading an executable, do not take that file.
3. Use a mirror only when the project itself lists it in official documentation, not every site that contains the word mirror.
4. After the download, if you can, compare the file with the integrity information sent by that same official path.

Do not mix session identity inside Tor Browser

1. If you did something in a Tor session that should not join to the next task, choose New Identity from the menu. That closes sessions and builds a fresh circuit.
2. For a single site, use New Circuit for this Site when that page will not connect and you want to try another path inside Tor.
3. Leave the window at its default size; stretching it a lot makes you more distinctive among Tor users.
4. Do not use Tor for file-sharing in a way the project advises against; it puts identity at risk and also stresses the network.
5. Do not install extra extensions on Tor Browser; that raises both the fingerprint and the attack surface.

Outline and organizational tools

1. If a group you know gives you Outline access, get the client from the official Outline site.
2. Enter the access key in that app by adding a server, not in an unknown app with a similar name.
3. If the key fails, ask that same group for a fresh key; do not install a third-party “booster” app.
4. After the collaboration ends, remove the access from the device.

Leftover circumvention settings on the system

Suspicious apps sometimes leave a VPN profile, a proxy or a certificate behind even after you delete the icon.

1. On Windows open Network & internet settings, then VPN and also Proxy, and remove anything you do not recognize.
2. On a Mac, look at Network settings and any VPN profiles that were added.
3. On iPhone go to Settings > General > VPN & Device Management and delete an unknown profile or VPN.
4. On Android read Settings > Network & internet > VPN and check Always-on if you did not turn it on yourself.
5. Always-on to an unstable VPN can leave you with no internet at all when that path dies; turn it on deliberately.

Captive portals and security software

1. In a hotel or airport, finish the Wi-Fi sign-in page first; many circumvention tools will not work before the internet itself is open.
2. If everything is still closed after that sign-in, then try an alternate path.
3. Some security apps inspect HTTPS traffic and cause certificate warnings or breakage. If you have such an app, investigate it as a cause instead of turning warnings off forever.
4. A manual proxy you once set for one network can break everything on another network; clear that setting after you travel.

A browser extension instead of an app

An extension that claims to send all traffic through a VPN can see every page you open in that browser. An unknown extension is as dangerous as a shady system install. If you ever use an extension, install it only from a maker you chose on that maker’s official site, and know that it covers only that browser, not the rest of the device.

When none of them connect

1. Once, move the device to another network—mobile data or a different Wi-Fi—to see whether the problem is that network.
2. Request a fresh bridge from the official path and set the old one aside.
3. Do not leave several VPN apps on at once; they interfere with each other.
4. If you only need to get a short text to someone, consider another channel you already have and trust, instead of installing a fifth unknown file.
5. Do not fix repeated failure by turning off the browser’s security.

Prepare before a wide disruption

When blocking becomes widespread, those same official download pages may open too late. Preparation is cheap.

1. While the internet is stable, install or update Tor Browser from the official path and watch it connect once.
2. Write down the GetTor address and the official site somewhere other than “whatever I remember in the moment.”
3. If you depend on an organizational tool, test it while it still works, not on the night of an incident.
4. Do not postpone operating-system updates; the day of a disruption is a poor time to install a large package.
5. Do not store an access key in a public photo gallery or a group chat.

Do not stack several tools on top of each other

Turning on several VPNs, an extension and Tor at once without a clear plan usually breaks the connection or makes the path impossible to understand. Each extra layer is another point of failure and another provider.

1. Try one method fully and look at the result, then move to the next official method.
2. Use complicated combinations only when a source you trust has recommended that mix for your situation.
3. If something worked and then stopped after you installed a third app, remove that last app and check leftover proxy settings.

App-level and network-level are not the same

1. Sometimes the browser works but one app cannot reach its server. That app may be limited separately, or its certificate may be the problem.
2. The other way around, sites may open through a VPN while a messenger fails because of that app’s own settings.
3. For an official circumvention app on Android, check battery restrictions so the system does not kill it in the background and drop the connection without notice.
4. Take a disconnected-VPN notice seriously; without it you may think you are still on the alternate path.

Accounts and cost

1. Do not share the password of a paid VPN with other people; you all appear as one identity to the provider, and account ejection is common.
2. Treat a message that says “your account has expired, install this file” like any other phishing mail, and sign in from the official site.
3. An unknown free edition with in-app ads may inject pages of its own. If the quality feels wrong, remove it.

Request bridges only from an official channel

The Tor Project itself offers several official ways to get bridges. Those are not the same as a “bridge list” in a random group.

1. The first choice is to request them from inside Tor Browser: Settings, Connection, Find more bridges or Request bridges, then complete the check.
2. If the official Tor bridges website is reachable from another network, you can get bridges from that official page and enter them in the browser.
3. The project documents an official Telegram bot for sending bridges. Use only that account listed in official Tor documentation, not look-alike accounts.
4. Official documentation also describes mail to bridges@torproject.org. Do not confuse the reply with a message that claims to be from Tor but has another address.
5. Do not republish a bridge you received in a public group; that shortens its life and breaks it for other people too.

After the page opens, look at the destination again

1. Read the site address after it loads. A circumvention tool gets you to a page, but the page can still be fake.
2. Sign into a bank or mailbox from your own bookmark, not from a search result in a hurried session.
3. If a tool opens a “start page” full of ads and download buttons, treat that tool as suspicious.
4. Update Tor Browser from the app’s own notice or again from the official path, not from a file that arrived by mail titled as a Tor update.
5. If a page that usually opened with HTTPS now opens without a lock or with a warning, stop and change path.

What to do today

1. The next time a site will not open, try mobile data, the device clock and a few other sites before you install anything.
2. If you need Tor Browser, write down the official download path or the GetTor mail method now, so on a day of blocking you do not take a file from a chat group.
3. Review any unknown circumvention app you installed from a message; remove it if it has no official source.
4. After a successful connection, look once, deliberately, at certificate warnings and at the account you are signing into.
5. Write down the access goal separately from the anonymity goal.
6. Open the system VPN and proxy settings once and remove leftover unknown items.
7. If you regularly need an organizational tool, test that it connects once this week, not on the night of a wide disruption or a general outage.

That test should be on the same device you will have with you on the day of an incident, not only on a home computer or that same stable, everyday network.