Bypass ISP blocks with Firefox

On Firefox (or Librewolf) (use updated versions):

  1. Install something to block trackers like uBlock Origin if you don't have it already. Surprisingly this is a requirement in many cases.
  2. Open Settings, search for a setting called "DNS over HTTPS", enable it, and select Cloudflare.
    (If on Librewolf, select "Custom" and paste this address: https://cloudflare-dns.com/dns-query)
    Other alternative DNS providers will work too.
  3. Open the about:config settings menu(write about:config in the address bar)
    Set the following parameters to "true" (to find them, paste their names in the search bar inside this menu)
    1- network.dns.echconfig.enabled
    2- network.dns.use_https_rr_as_altsvc
  4. Restart Firefox (necessary sometimes)
  5. Finally, test the connection privacy with this Tool. Click on Check my browser. The 4 results should be green for this to work.

When does this work?

It works on sites that use Cloudflare like 1337x.to or rarbg.to or fmovies.to, as long as your ISP is just blocking the domain names, and not the actual IP address of these sites.

You can check if a site is using Cloudflare with www.urlvoid.com, looking at the ASN row in the results.

It doesn't work for these (they don't use Cloudflare): Amazon (including AWS, Twitch…), Microsoft (including Azure, OneDrive, Outlook, Office 365…), Google (including Gmail, Google Cloud…), Apple (including iCloud, iMessage…), Reddit, YouTube, Facebook, Instagram, Twitter, GitHub

It doesn't work in China according to this


Extra: why does this work?

the TLS protocol used in most HTTPS connections in most Browsers (Chrome/Brave among them) will leak the Domain Name again through SNI handshakes (this can be checked here at Cloudflare). As of the writing of this guide, only Firefox-based browsers supports ECH (Encrypted Client Hello previously known as eSNI) on some websites which will encrypt everything end to end (in addition to using a secure private DNS over TLS/HTTPS) and will allow you to hide your DNS requests from a third party. And this option is not enabled by default either so you will have to enable it yourself.
In addition to limited browser support, only web Services and CDNs behind Cloudflare CDN support ECH/eSNI at this stage.

source: The Hitchhiker’s Guide to Online Anonymity - Your DNS and IP requests

we recommend that users wait for ECH to be enabled by default, some may want to enable this functionality earlier. This can be done in about:config by setting network.dns.echconfig.enabled and network.dns.use_https_rr_as_altsvc to true, which will allow Firefox to use ECH with servers that support it.

source: Encrypted Client Hello: the future of ESNI in Firefox


by Rust1667

Edit
Pub: 03 Jan 2023 04:37 UTC
Edit: 22 Feb 2023 07:29 UTC
Views: 3079