# What Are Proxy Servers and How Do They Bypass Censorship?

> Discover how proxy servers bypass censorship by acting as intermediaries. Learn how they mask your IP and encrypt traffic to access blocked content securely and privately.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: deep-dive
- Published: 2026-06-12

---

**Proxy servers act as intermediate relays between a client and target Internet resources, masking the client’s true IP address and encrypting traffic to evade censorship filters.**

The bannedbook/fanqiang repository hosts a comprehensive suite of open-source circumvention tools that demonstrate how proxy servers bypass network restrictions. By routing traffic through intermediate nodes located outside censored jurisdictions, these implementations obscure the origin and content of network requests while maintaining compatibility with standard protocols.

## Architectural Layers of Proxy-Based Circumvention

Proxy servers in the fanqiang ecosystem operate across four distinct network layers, each addressing specific censorship mechanisms documented throughout the repository.

### Application Layer Protocol Handling

At the application layer, proxy servers terminate original requests and forward them to destinations. The fanqiang repository ships multiple implementations including **Clash**, **Xray**, **V2Ray**, **Hysteria**, and **NaiveProxy**, which operate as HTTP or SOCKS5 proxies. These tools handle specific protocols while presenting a standardized interface to client applications, as documented in the Android and Windows README sections.

### Transport Layer Encryption

To hide payloads from Deep Packet Inspection (DPI), proxies employ encryption protocols like TLS and WebSocket. The configuration in `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md` demonstrates how V2Ray wraps traffic in TLS encryption, making circumvention traffic appear identical to standard HTTPS connections. This transport layer obfuscation prevents automated filtering systems from identifying the traffic as proxy-related.

### Network Layer Forwarding

The network layer enables transparent forwarding through reverse proxies. In `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md`, an Nginx configuration uses `proxy_pass http://127.0.0.1:10000;` to forward WebSocket traffic from public Internet ports to local V2Ray listeners. This mechanism makes censorship filters see only standard HTTP traffic while the actual proxy communication occurs over an encrypted tunnel.

### System-Wide Proxy Integration

At the system layer, proxies integrate with operating environments through environment variables. The Linux guide in [`linux/readme.md`](https://github.com/bannedbook/fanqiang/blob/main/linux/readme.md) shows how exporting `http_proxy` and `https_proxy` forces all command-line tools—including `curl`, `git`, and package managers—to route through the proxy automatically. Similarly, `v2ss/Docker 代理设置说明.md` documents applying these variables to the Docker daemon for containerized applications.

## How Proxy Servers Bypass Censorship

The fanqiang implementations employ four primary strategies to circumvent network restrictions:

**Geographic Relocation**: By routing requests through servers located in jurisdictions without relevant filters, proxies make traffic appear to originate from allowed regions. This masks the client’s true location from geo-blocking systems.

**Traffic Obfuscation**: TLS and WebSocket protocols mimic allowed services like HTTPS. By encrypting payloads and wrapping them in standard protocol headers, proxies prevent DPI systems from classifying traffic as "blocked" or "suspicious."

**Port Hopping and Multiplexing**: Tools like V2Ray and Xray dynamically change ports and multiplex several streams over single connections. This reduces the effectiveness of static port blocking, a common censorship technique.

**System-Wide Routing**: Environment variables (`http_proxy`, `https_proxy`) ensure consistent bypass across all applications. When configured as shown in [`linux/readme.md`](https://github.com/bannedbook/fanqiang/blob/main/linux/readme.md), these settings force CLI applications to route through the proxy without individual configuration.

## Configuration Examples from the fanqiang Repository

### System-Wide Proxy Settings on Linux

To configure system-wide proxy settings on Linux or macOS, export the environment variables as documented in [`linux/readme.md`](https://github.com/bannedbook/fanqiang/blob/main/linux/readme.md):

```bash

# Replace 127.0.0.1:7890 with your local proxy address

export http_proxy="http://127.0.0.1:7890"
export https_proxy="http://127.0.0.1:7890"

# Verify the variables are set

echo $http_proxy
echo $https_proxy

# To unset later

unset http_proxy
unset https_proxy

```

### Docker Daemon Proxy Configuration

For containerized environments, create [`/etc/systemd/system/docker.service.d/http-proxy.conf`](https://github.com/bannedbook/fanqiang/blob/main//etc/systemd/system/docker.service.d/http-proxy.conf) as specified in `v2ss/Docker 代理设置说明.md`:

```ini
[Service]
Environment="HTTP_PROXY=http://127.0.0.1:7890/"
Environment="HTTPS_PROXY=http://127.0.0.1:7890/"

```

Then reload systemd and restart Docker:

```bash
sudo systemctl daemon-reload
sudo systemctl restart docker

```

### Nginx Reverse Proxy for V2Ray WebSocket

The following Nginx configuration from `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md` creates a reverse proxy that forwards WebSocket traffic to a local V2Ray instance:

```nginx
server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    location /ray {
        proxy_redirect off;
        proxy_pass http://127.0.0.1:10000;   # V2Ray listening on 10000

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

```

### V2Ray Client Configuration

A basic V2Ray client configuration from the repository establishes a SOCKS5 proxy locally that tunnels traffic via WebSocket:

```json
{
  "inbounds": [
    {
      "port": 1080,
      "listen": "127.0.0.1",
      "protocol": "socks",
      "settings": { "auth": "noauth" }
    }
  ],
  "outbounds": [
    {
      "protocol": "vmess",
      "settings": {
        "vnext": [{
          "address": "your.v2ray.server",
          "port": 443,
          "users": [{ "id": "uuid", "alterId": 64 }]
        }]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": { "path": "/ray" }
      }
    }
  ]
}

```

## Summary

- **Proxy servers** act as intermediaries that relay traffic between clients and destinations, hiding the client's true network identity.
- The **bannedbook/fanqiang** repository implements proxies across four layers: application (Clash, V2Ray), transport (TLS/WebSocket), network (Nginx reverse proxy), and system (environment variables).
- **Circumvention strategies** include geographic relocation, traffic obfuscation via encryption, port hopping, and system-wide routing through `http_proxy` variables.
- **Configuration files** like [`linux/readme.md`](https://github.com/bannedbook/fanqiang/blob/main/linux/readme.md) and `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md` provide production-ready implementations for Linux system proxies and encrypted WebSocket tunnels.

## Frequently Asked Questions

### What is the difference between a proxy server and a VPN?

A proxy server typically operates at the application layer, routing specific traffic (HTTP, SOCKS) through an intermediary, while a VPN operates at the network layer, creating an encrypted tunnel for all system traffic. The fanqiang repository primarily focuses on application-layer proxies like V2Ray and Clash, though these can be configured to tunnel all traffic when combined with system-level proxy settings.

### How does TLS encryption help proxy servers bypass censorship?

TLS encryption obscures the actual content of proxy traffic, making it appear as standard HTTPS connections to Deep Packet Inspection (DPI) systems. As implemented in `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md`, wrapping V2Ray traffic in TLS prevents censors from distinguishing circumvention traffic from legitimate secure web browsing, effectively masking the proxy protocol signatures.

### Can proxy servers bypass all types of Internet censorship?

While proxy servers can circumvent IP blocking, DNS poisoning, and basic DPI, they may struggle against advanced techniques like active probing, traffic correlation analysis, or complete protocol whitelisting. The fanqiang repository addresses this by supporting multiple protocols (Shadowsocks, VMess, Hysteria) and obfuscation techniques, allowing users to switch methods when one is blocked.

### How do I configure system-wide proxy settings on Linux?

Export the `http_proxy` and `https_proxy` environment variables in your shell configuration or session, as documented in [`linux/readme.md`](https://github.com/bannedbook/fanqiang/blob/main/linux/readme.md). Set both variables to your local proxy address (e.g., `http://127.0.0.1:7890`), which forces CLI tools like `curl`, `git`, and package managers to route through the proxy automatically. For permanent configuration, add these exports to `~/.bashrc` or `/etc/environment`.