Bypass some ISP blocks with Encrypted Client Hello (ECH)

Enabling ECH on the web-browser will bypass blocks often, but not for all countries or all websites.

Check if it's enabled already

Nowadays Chrome and Firefox have this enabled by default, so probably you will only have to do the first step, which is Configure DNS, if you haven't done it already.

Use any of these tools to verify if you have enabled ECH:

• https://www.cloudflare.com/ssl/encrypted-sni/ - Click on Check my browser. The 4 results should be green for this to work. (the 1st one can be yellow and be OK)
• https://crypto.cloudflare.com/cdn-cgi/trace - In the SNI section encrypted should appear instead of plain text
• https://defo.ie/ech-check.php
• https://tls-ech.dev/

Block trackers

1. Install something to block trackers like uBlock Origin if you don't have it already. Surprisingly this is a requirement for bypassing these blocks in some cases.

Chrome (and Chromium-based browsers)

1. Configure DNS: In Chrome settings, go to Privacy and security > Security and in the 'Use secure DNS' option, choose Cloudflare, NextDNS or alternatives. Anything but Current service provider because this will probably be your ISP.
2. Configure ECH: Go to the address chrome://flags and do the following:
   • Enable encrypted-client-hello
   • Enable use-dns-https-svcb-alpn
3. Restart the browser

Firefox (and Firefox-based browsers)

1. Configure DNS: Open Settings, search for a setting called "DNS over HTTPS", enable it, and select Cloudflare or NextDNS.
   (If on Librewolf, select "Custom" and paste this address: https://cloudflare-dns.com/dns-query)
   Other alternative DNS providers will work too.
2. Configure ECH: Open the about:config settings menu(write about:config in the address bar)
   Set the following parameters (to find them, paste their names in the search bar inside this menu)
   1- network.dns.echconfig.enabled to true
   2- network.dns.http3_echconfig.enabled to true
   3- network.trr.mode to 3
   4- network.dns.use_https_rr_as_altsvc to true
3. Restart the browser

---

Additional info

article by Mozilla / article by Cloudflare

When does this work?

It works for most of the sites that use Cloudflare like 1337x.to or fmoviesz.to, as long as your ISP is just blocking the domain names, and not the actual IP address of these sites.

You can check if a site is using Cloudflare with www.urlvoid.com, looking at the ASN row in the results.

It doesn't work for these (they don't use Cloudflare): Amazon (including AWS, Twitch…), Microsoft (including Azure, OneDrive, Outlook, Office 365…), Google (including Gmail, Google Cloud…), Apple (including iCloud, iMessage…), Reddit, YouTube, Facebook, Instagram, Twitter, GitHub

It doesn't work in China according to this

---

Alternatives

1. Tools that send the Client Hello in fragments (instead of encrypted), such as GoodbyeDPI and similar projects / 2 / 3.
2. Intermediaries like Proxies, VPNs or Tor. These should be the last choice because they limit internet speed.