A block page tells you almost nothing. Same grey screen whether your school's DNS server lied to you, your ISP dropped the connection mid-handshake, or the site itself refused your IP.
Most guides respond to that by handing you ten tricks and wishing you luck. Half of those tricks stopped working two years ago.
Spend sixty seconds finding out what's actually blocking you and the list collapses to one method. That's what this guide does: diagnose first, then fix.
Alt text: Diagram of where a block happens when you open blocked sites without a VPN
How to open blocked sites without a VPN
To open blocked sites without a VPN, find out how the block works first. DNS-level blocks fall to encrypted DNS in one settings toggle. SNI filtering and deep packet inspection need Tor bridges or Encrypted Client Hello. IP blocks need a relay. Diagnose the layer, then pick the matching method.
Three layers, three answers. Everything below is free and nothing needs an install on a locked-down machine except Tor.
Why half the advice you've read no longer works
Search this topic and you'll get the same five suggestions recycled since roughly 2014. Here's what happened to them.
Google's cached pages. Gone. Google pulled the cache link from search results in January 2024 and Danny Sullivan confirmed the retirement that February; the cache: operator stopped answering later the same year. Guides still listing this were not written by anyone who tried it.
The Google Translate trick. Pasting a URL into Translate used to serve the page through Google's domain. It mostly serves you a redirect now, and any filter that inspects the final destination catches it anyway.
URL shorteners. Bitly and TinyURL issue a 301 to the real host. Your browser follows it, your resolver looks up the real domain, and the filter sees the real domain. This never defeated anything beyond a plain-text keyword blocklist.
Typing the raw IP address. Almost every site now shares an IP with hundreds of others behind a CDN. Skip the hostname and the server has no idea which certificate to present, so you get a name-mismatch warning instead of the page.
One of these survived: the Wayback Machine still works, for static content, on a domain your filter probably hasn't listed.
Find out what's blocking you in 60 seconds
Three commands. Run them from a terminal on the blocked network, against whatever site you're trying to reach.
Start with DNS, because it's the most common and the easiest to beat. Compare what your network's resolver says against what Cloudflare says.
# What your network's DNS server returns
nslookup example.org
# What an outside resolver returns for the same name
nslookup example.org 1.1.1.1
Different answers mean DNS-level blocking. You'll usually see NXDOMAIN, 0.0.0.0, 127.0.0.1, or your school's own block-page IP from the first command and a real address from the second. Jump to method 1.
If both resolvers agree, the name is resolving fine and something is killing the connection later. Test whether it's the hostname or the IP:
# Force the connection to the correct IP, but announce the real hostname
curl -sv --resolve example.org:443:93.184.215.14 https://example.org 2>&1 | tail -5
# Now hit the same IP with no hostname in play
curl -skv https://93.184.215.14 2>&1 | tail -5
First fails, second gets any TLS response at all? The filter is reading the hostname out of your handshake. That's SNI filtering: method 2, then 3.
Both fail identically and the IP itself is unreachable. You need a relay, so skip to method 3 or 4.
One more test, and people skip it constantly. Plenty of network filters were configured for IPv4 and never updated:
curl -6 -sI https://example.org | head -1
An HTTP/2 200 there means you're already through. Enable IPv6 on the interface, or set your browser to prefer it, and the block evaporates.
| What you saw | What's blocking you | Go to |
|---|---|---|
| Resolvers disagree | DNS filtering | Method 1 |
| Named request fails, raw IP responds | SNI / DPI inspection | Method 2, then 3 |
| Both fail, other sites fine | IP-level block | Method 3 or 4 |
| IPv6 request returns 200 | IPv4-only filter | Prefer IPv6 |
| Certificate issued by your network | TLS interception | See the limits section |
The methods, ranked by what they cost you
| Method | Beats | Effort | Speed | Holds up under |
|---|---|---|---|---|
| Encrypted DNS | DNS filtering | 1 minute | Full | Most school and ISP filters |
| Encrypted Client Hello | SNI inspection | 3 minutes | Full | Passive DPI |
| Tor with a bridge | DPI, IP blocks, national firewalls | 10 minutes | Slow | Nearly everything |
| Hosted web unblocker | DNS and IP blocks | Seconds | Varies | Filters that haven't listed it |
| Mirrors and archives | Everything, for read-only content | Seconds | Full | Whatever isn't on the blocklist |
Start at the top and stop as soon as the page loads.
Method 1: turn on encrypted DNS
This is the cheapest way to open blocked sites without a VPN. Most consumer-grade blocking is a lie told by a DNS server.
You ask for a hostname, your network's resolver answers with a block page instead of the truth, and your browser obediently goes there.
Encrypt the lookup and your network can't answer it. Your browser talks directly to a resolver over HTTPS, on port 443, mixed in with ordinary web traffic.
In Firefox, it lives under Settings > Privacy & Security > DNS over HTTPS. Pick Max Protection and choose a provider. If you want it enforced rather than best-effort, set the pref directly:
about:config
network.trr.mode = 3
network.trr.uri = https://mozilla.cloudflare-dns.com/dns-query
Mode 3 means DoH only, with no fallback to the network resolver. That's the point: mode 2 quietly falls back to the lying server the moment DoH stalls, which is exactly when you need it most.
Chrome and Edge call it Secure DNS, under Settings > Privacy and security > Security. Choose a custom provider rather than "your current service provider," which on a filtered network is the thing doing the filtering.
Set it system-wide instead and every app benefits. On Windows 11: Settings > Network & internet > Wi-Fi > Hardware properties > DNS server assignment > Edit, then set 1.1.1.1 and toggle DNS-over-HTTPS to On.
This one toggle solves a large share of "site blocked at school" cases. It does nothing against DPI.
Method 2: switch on Encrypted Client Hello
DNS is encrypted, the site still won't load, and your --resolve test showed the hostname is the problem. Your TLS handshake is leaking the destination.
Server Name Indication sends the hostname you want in plaintext, before encryption starts, so a shared server knows which certificate to hand back. Filters read that field and drop the connection. South Korea's regulator rolled out SNI-based blocking in 2019 and other networks copied it.
Encrypted Client Hello closes that gap. The real hostname goes inside an encrypted envelope and the filter sees a generic cover domain instead. Firefox has shipped it since version 118, Chrome since 117.
ECH needs encrypted DNS to work, because the keys arrive in an HTTPS DNS record. Do method 1 first, then:
about:config
network.dns.echconfig.enabled = true
network.dns.http3_echconfig.enabled = true
Restart and confirm at tls-ech.dev. A green result means the hostname left your machine encrypted.
The honest limit: ECH only helps when the site's operator publishes ECH keys, which in practice means sites sitting behind Cloudflare. Russia and China both interfere with ECH traffic directly.
Against a passive corporate or campus filter it works well. Against a state firewall that's hunting for it, go to method 3.
Method 3: Tor Browser with a bridge
Tor is the method that keeps working when the others stop. It's also the slowest, which is why it's third rather than first.
Plain Tor gets blocked easily because the entry relay list is public. Bridges are unlisted entry points, and pluggable transports disguise what the traffic looks like on the wire. In Tor Browser: Settings > Connection > Bridges > Select a Built-In Bridge.
Four choices, and they fail differently:
- obfs4 turns Tor traffic into random noise. Fast, and the default worth trying first. Mobile ISPs in Russia now fingerprint it with DPI.
- Snowflake routes you through volunteers' browser tabs over WebRTC, so your traffic looks like a video call. No fixed IPs to blacklist. Your proxy vanishes when that volunteer closes their tab.
- WebTunnel wraps Tor inside ordinary HTTPS. Hardest to block without breaking the normal web. Newest, so fewer bridges exist.
- meek bounces through a large CDN. Slow enough that it's a last resort.
If every built-in bridge fails, the built-in ones are burned and you need private addresses. Request them from bridges.torproject.org, email bridges@torproject.org with get transport obfs4 in the body, or message @GetBridgesBot on Telegram. Then paste them in:
# Tor Browser: Settings > Connection > Bridges > Add a Bridge Manually
obfs4 192.0.2.10:9443 CERT=<cert> iat-mode=0
Tor has roughly 2,600 bridges against about 10,000 relays, so they're scarce. Don't post working bridge lines publicly; that's how they get discovered and blocked.
Can't install software? Tor Browser runs from a USB stick without admin rights on Windows. That covers most locked-down machines.
Method 4: hosted web unblockers, and what they cost you
A web unblocker fetches the page on its server and renders it back to you. Nothing to install, works from a Chromebook, and the filter only sees you visiting the unblocker's domain.
It also means a stranger's server sits between you and everything you type.
The research here is not reassuring. A 30-month study presented at NDSS MADWeb 2024 collected 640,600 free proxies from 11 providers and tested them daily.
Only 34.5% ever responded. Of the ones that did, 16,923 were actively manipulating the content passing through them.
The same team catalogued 4,452 distinct vulnerabilities on proxy hosts, 1,755 of which allowed remote code execution on the box relaying your traffic.
Christian Haschek reached the same conclusion the manual way back in 2015: 16.6% of the free proxies he tested were injecting ads into pages, and most refused HTTPS entirely.
So if you use one, check three things before you trust it with anything:
- The padlock stays on and the certificate is issued to the unblocker, not to a name you've never heard of.
- No browser extension is required. An extension that requests "read and change all your data" is a far bigger grant than a web page.
- No account, no email, no phone number. There's no reason a page fetcher needs your identity.
<!-- BRAND MENTION 1 of 2: VERIFY BEFORE PUBLISHING -->
Floppyblocks sits in this category: a browser-based unblocker with nothing to install, which is the right shape for a managed laptop where you can't run Tor. Run the three checks above on it the same as you would on anything else.
And regardless of which one you pick: no banking, no email logins, no anything you'd mind a stranger reading. Read-only browsing only.
Method 5: go around the site instead of through it
Sometimes you don't need the site. You need what's on it.
The Wayback Machine at web.archive.org holds a copy of most public pages, on a domain that survives a lot of blocklists. Fine for articles and documentation, useless for anything logged-in or live.
Wikipedia runs official mirrors and a .onion address for exactly this reason. Many news organisations do too, including the BBC and the New York Times, and the Tor Project keeps a list of official mirrors when its own site is blocked in your country.
RSS is the quiet one. A lot of filters block the web host and never touch the feed endpoint or the third-party reader pulling from it. If you want the content and not the interface, that's often the shortest path.
Which method should you use
| Your situation | Start with |
|---|---|
| School or office Wi-Fi, own laptop | Encrypted DNS, then ECH |
| Managed device, no install rights | Web unblocker or Tor from USB |
| ISP-level national block | Tor with WebTunnel or Snowflake |
| Chromebook, no developer mode | A browser-based unblocker such as Floppyblocks |
| Reading an article or a doc | Wayback Machine or the site's mirror |
| Everything else has failed | Tor with private bridges |
If you only do one thing, do encrypted DNS. It's a single toggle and it costs you nothing in speed.
Common errors and what they mean
ERR_NAME_NOT_RESOLVED. DNS is being blocked or poisoned. Method 1. If it persists after enabling DoH, your browser is still falling back; check that network.trr.mode is 3, not 2.
ERR_CONNECTION_RESET partway through loading. The connection opened and something killed it. That's DPI reading your handshake. Method 2, then 3.
ERR_CONNECTION_TIMED_OUT. Packets to that IP are going nowhere. IP-level block. Encrypted DNS won't touch this; you need a relay.
NET::ERR_CERT_AUTHORITY_INVALID, or a certificate issued by your employer. Your network is intercepting TLS with its own root certificate installed on the device. It can read everything, including anything you route through a web unblocker. Nothing in this guide fixes that, and you should know it's happening.
Tor says "Connection failed". The built-in bridges are blocked on your network. Request private ones and add them manually.
Where none of this helps
Honesty section, because the alternative is you wasting an afternoon.
Account-level bans don't care about your network path. Neither do server-side geo-restrictions on streaming services, which check payment method and account region alongside IP, and which actively detect and refuse relay traffic.
A managed device with a corporate root certificate installed sees your plaintext no matter what tunnel you build. If the block is enforced by software running on the laptop rather than by the network, the network layer isn't where the fight is.
And a filter that's been properly configured, with encrypted DNS resolvers blocked at the firewall and Tor bridges enumerated, will beat everything except a private bridge. That configuration is rare on school networks and common on government ones.
A note on responsible use
Reaching lawfully available information that someone else decided you shouldn't see is a reasonable thing to want, and in a lot of the world it's the difference between reading the news and not.
A school or workplace block is a different thing. It's policy, backed by an acceptable-use agreement you probably signed, and getting around it is a disciplinary matter rather than a technical one. The network admin can usually tell. Weigh that before you start.
None of this is a route around copyright, paywalls, or the law where you live. Those are choices you make on your own account, and they have nothing to do with which DNS resolver you picked.
Wrapping up
The whole guide reduces to one habit: run the three diagnostic commands before you try anything. DNS block, encrypt your lookups. SNI block, turn on ECH. IP block, use a relay.
Encrypted DNS alone clears most school and ISP filters, and it takes about a minute.
Tor with a bridge handles whatever's left, slowly but reliably. The tired list of shorteners and cached pages can stay retired.
Written by Admin Team