1 When stability begins to require maintenance

---

The immediate reason for writing this article is that a cross-border transit service provider I've relied on for a long time (which I've always considered the most technically professional) recently collapsed, causing my access architecture, which had been running stably for many years, to suddenly fail. This change forced me to re-examine the reliability and sustainability of the entire cross-border access solution, and it also made me gradually realize that what is truly shaken may not be a specific solution, but rather the entire game itself, which is undergoing a structural change.

---

Speaking of accessing the foreign internet, I've witnessed the entire process from liberalization to tightening. In the early years of the Chinese internet, "foreign internet" wasn't a topic that needed repeated discussion. For many, the difference between accessing foreign and domestic websites lay more in speed and user experience than in "whether they could be opened at all." Back then, Google, some technical communities, and foreign media websites were basically just quietly in bookmarks; you just clicked on them when needed, and few people realized that this was a "phase of development."

The changes didn't happen suddenly, but rather slowly and gradually. The earliest feeling wasn't that the site was "blocked," but rather that it was "unstable"—accessible at certain times, noticeably slower at others, and occasionally successful after a few refreshes. Later, some websites began to be unreachable for extended periods, and whether or not it would open today became a matter of trial and error.

It was from that stage that individual users who needed to access the external network across borders began to realize that maintaining access to the external network might actually incur additional costs.

Most individual users initially encountered traditional VPNs, and some tinkerers even modified their routers—for example, I flashed DD-WRT firmware and configured a VPN to connect. Of course, the experience back then wasn't great: complex configuration, mediocre stability, and difficulty determining whether problems stemmed from the network, the device, or the service itself. But at the time, it at least provided a way to "connect to the internet."

As more and more people used it, the needs became clearer, and the solutions began to evolve. Later, lighter-weight tools quickly replaced the earlier, cumbersome methods. Solutions like Shadowsocks, for a considerable period, became almost the default choice for individual users. They no longer emphasized complete control over the entire network environment, but rather leaned towards pragmatism: sufficient, stable, and cost-effective.

That was also the first time many people had the illusion that the problem had been "solved." After installation, they didn't need to worry about it for a long time. The connection was stable, the experience was consistent, and accessing the external network became a daily routine again, rather than a technical issue that required deliberate tweaking.

But this stability didn't last. Later, changes began to reappear: connection success rates declined, availability shortened, and what was once a long-term solution gradually became a temporary state requiring frequent adjustments and migrations. At this stage, the question was no longer just "which tool to choose," but rather, a growing sense emerged—This logic itself seems to be losing its support.

At the time, I couldn't quite put my finger on what was happening; I just clearly sensed that the familiar path was becoming increasingly unsustainable. Without any other point of reference, I could only continue along the existing lines of thought, repeatedly searching for a solution that "looked a little better."

2. Why stability becomes an illusion

During that relatively stable period, many people were unaware that they were in a special window of opportunity. Connections were reliable, the experience was consistent, and external internet access reverted to a "background facility" role—it existed, but didn't require frequent consideration.

This state easily leads to an intuitive judgment: the problem has been solved—at least on a personal level, it no longer seems urgent, nor is it worth investing extra effort in. As long as the solution still works, there's no reason to care why it works. But in hindsight, this very sense of "stability" is actually a warning sign.

Stability doesn't disappear suddenly; rather, it first loses predictability. The earliest change isn't complete unavailability, but rather that the success rate becomes less reliable—the same environment, the same usage, sometimes works smoothly, and sometimes fails without warning. Subsequently, the availability period of the solution shortens significantly, and what could have been maintained long-term gradually evolves into a process requiring periodic adjustments, migrations, or even complete replacements.

At this stage, technology itself is no longer the biggest variable. What has truly changed is the relationship between individuals and the system (in this text, 'system' refers to network assessment and control mechanisms).relative position.

You'll find that regardless of the type of solution used, their performance follows a highly consistent trajectory: initially usable, stable in the middle, and then entering a period of decline. The differences between different solutions lie more in "whether the decline comes early or late" rather than "whether it will decline at all."

At this point, a previously overlooked problem began to emerge—If every generation of solutions ultimately leads to the same outcome, then is the problem really with the technology itself?

When you need to constantly invest time to maintain a "state that should be stable," it's no longer just a simple technological choice, but a continuous game of strategy. For individual users, the cost of this game isn't just money, but also includes energy, judgment, and the ability to withstand future uncertainties.

It was during this process that I gradually realized that instead of repeatedly comparing which solution was "more advanced" or "more covert," it would be better to look at it from a different angle—where exactly these solutions were placed in the "game with the system."

When the question shifts from "Can I still connect?" to "How much extra cost do I need to incur to maintain this connection?", the answer itself has already changed. The real question is no longer whether the next technology will be better, but rather:How much room for sustainability does individual user have in this game?

It was from here that I began to try to understand this problem in a more abstract way—no longer focusing on specific solutions, but observing the game hierarchy in which they exist, and how these hierarchy themselves are changing.

3. How does the game move up layer by layer?

3.1 From Connection to Subject: A Three-Layer Game Model

On the surface, the changes over the past decade or so can easily be understood as a series of "technological upgrades": one solution gradually becomes ineffective, and another emerges, seemingly like tools are constantly being updated and replaced. However, when viewed over a longer time frame, this explanation falls short.

What has truly changed is not that a technology has suddenly become smarter or more vulnerable, but rather...The system's "abnormal" position is constantly moving upwards.The focus of the judgment is no longer limited to "whether this connection resembles normal traffic," but has expanded to "whether a certain carrier continues to undertake abnormal uses over time." In other words, the evolution over the past decade or so is not essentially about "protocols failing faster," but rather the center of gravity in the three-layer game is constantly shifting upwards.

To help readers understand this hierarchical relationship more intuitively, a simple diagram is used below to represent the three-level game model:

With the overall perspective of the three-layer game model, we can delve deeper layer by layer to examine the game characteristics and trajectories of each layer.

3.2 Protocol Layer Game Theory: When the Judgment Criterion is "Similarity"“

In the earliest stages, the scientific competition almost entirely occurred at the protocol layer. Whether it was early traditional VPNs such as IPsec, PPTP, OpenVPN, and SSH Tunnel, or later solutions represented by Shadowsocks and SSR, their core objectives were highly consistent:Make cross-border communications look like they don't belong to a "special channel".

During this period, the structure of cross-border communication for individual users was very straightforward—A one-to-one connection is established between the user and overseas service nodes.As long as the system has not blocked this overseas node, individual users can use it to fulfill almost all cross-border access needs.

Because of its simple structure, the system's judgment on "whether it is abnormal" focuses almost entirely on the connection itself: whether the protocol format is too fixed; whether the handshake process has a clear fingerprint; whether the distribution of encrypted data deviates from common applications; and whether the traffic rhythm differs significantly from mainstream business. Once these characteristics appear statistically unnatural, the entire communication can be easily identified individually.

The identification logic at this stage is essentially rule-driven: as long as these known and explicit rules can be avoided, it is difficult to be directly hit. This is why protocols like Shadowsocks were able to be used stably for a considerable period of time, even with a lifespan measured in "years".

A common experience among many early users is:By simply switching to a protocol that "looks more natural," connections that were previously impossible to establish can often become smooth again. This experience is a true reflection of the effectiveness of protocol-level game theory—the judgment criterion focuses on "similarity" rather than "who is using it".

However, there is an unavoidable upper limit to the game theory at the protocol level—If a feature is stable, it can definitely be summarized. When the identification method no longer relies primarily on manually maintained rules, but instead begins to use statistical methods and models to extract "abnormal patterns" from a large number of samples, the judgment logic undergoes a fundamental change.

To put it more simply: the early stages were more like "checking the rules," while the later stages were more like asking questions.In a large amount of normal communication, which small group of behaviors seems less natural?Even if a single connection is perfectly reasonable in form, as long as it exhibits a stable but rare pattern in terms of time distribution, connection rhythm, and data exchange ratio over a long period of time, it will still be effective.

At this point, how well the protocol layer is "disguised" is no longer the decisive factor. Therefore,Any method that relies on protocol masquerading to complete cross-border communication under a direct connection structure will inevitably reach the upper limit of protocol-level game theory.

The end result, naturally, is that overseas service nodes are identified and blocked.

---

Besides Shadowsocks/SSR/Trojan, solutions like Reality also aim to offer different combinations of protocol features, all attempting to reduce the risk of being identified by rule-based mechanisms by altering communication methods. However, their fates ultimately align because: long-term survivability cannot be determined solely by the protocol itself.

---

3.3 Path-layer game theory: embedding anomalies within a larger structure

As the bargaining space at the protocol layer gradually shrinks, the "scientific" solutions for cross-border communication for individual users also change—the change is not reflected in "switching to a newer protocol," but rather...The entire connection structure began to be redesigned.The focus of the game is shifting upwards from the protocol layer to the path layer.

In the previous stage, cross-border communication took a very straightforward form: the client directly connected to an overseas node. The protocol was both the communication method and the main object of system evaluation; once this form of communication appeared statistically unnatural, it was easily subject to restrictions.

Once you enter the path layer, the focus of the game clearly shifts upwards—The solution no longer focuses on making a single connection "look like normal traffic," but instead attempts to embed cross-border behavior into a larger network structure.The most typical change is the introduction of transit nodes: for example, individual users can use a VPS from a large domestic cloud provider as the origin of cross-border traffic. When initiating cross-border access, the traffic that needs to cross borders is first sent to the VPS (this part is domestic access), and then forwarded to the overseas service node by that node.

By splitting the entry and exit points, the originally "obvious" direct cross-border connection of home broadband is dispersed into multiple segments (home broadband -> domestic VPS, domestic VPS -> overseas service nodes, or even domestic VPS1 -> domestic VPS2 -> ... -> overseas service nodes), which looks more reasonable.

In this structure, compared to home broadband users initiating cross-border connections directly, traffic relayed through VPS is closer to the common usage pattern of cloud services, and therefore appears more conventional and less likely to be singled out for scrutiny (previously, the system had a much higher tolerance for cross-border access initiated by cloud provider VPS than that initiated directly by home broadband users).

I tried using a domestic VPS as a jump server to connect to my self-hosted website overseas. The result was that this line was more stable than a direct connection from my home broadband connection: even if the original direct connection failed frequently, this relay line could maintain its connection for several days without dropping. This gave me my first intuitive understanding that the sustainability of cross-border connections depends not only on the protocol itself, but also on the network structure in which you embed it.

---

It is important to emphasize that this stage does not mean that the "protocol" relied upon in the direct connection mode becomes ineffective. On the contrary,The protocols originally used for direct connections to overseas nodes have not disappeared; instead, they have been "sinking" to the segment connecting to domestic transit gateways.It has become an integral part of the entire communication structure.

---

The reason why path-layer solutions have survived for a considerable period of time is not because their technology is particularly "advanced," but because they address a real-world constraint that the system must consider—Cost of accidental injuryWhen cross-border traffic is only a part of a large network structure, simply cutting off a node or link can affect a large amount of normal business that should be allowed (cloud providers already have a lot of normal cross-border traffic). For this reason, in practice, this type of solution has a greater chance of survival than direct connection methods that simply rely on protocol spoofing (the widely used transit airports are essentially a concrete manifestation of this idea).

Following this line of thought, some more "non-direct connection" practices have gradually emerged: cross-border communication is no longer explicitly aimed at "accessing a specific overseas service," but is instead embedded in more general and less purpose-specific network structures. For example, by leveraging large international content delivery networks (CDNs) or proxy infrastructure, the actual communication exit is hidden behind highly general and widely used services. In this model, cross-border behavior almost no longer presents itself as a clearly targeted "independent object," but rather as part of a legitimate network service.

Here we must mention a special case—WARPFor a considerable period (though it's no longer operational), WARP carried a significant amount of personal cross-border traffic, but it wasn't just a simple VPN tool. Its communications were embedded within the infrastructure widely used by Cloudflare (a globally renowned provider of DNS, CDN, and security services), mixing with a large amount of normal traffic, making it virtually impossible to identify its cross-border activity independently. To the system, this type of traffic was both ubiquitous and plausible—it was neither conspicuous nor easily distinguishable using traditional rules.

This model perfectly embodies the ultimate strategy of path-layer game theory: it doesn't rely on technology itself to "hide," but rather by integrating behavior into the game.Large-scale, recognized network structureThis fundamentally reduces the risk of being identified. In terms of personal experience, this means users don't need to frequently switch protocols or nodes, the connection is more stable, and the lifespan is longer; however, for system evaluators, the difficulty of judgment is significantly increased.

As long as these infrastructures themselves continue to support a large number of normal and irreplaceable businesses, path layer solutions will still have a realistic space to exist.

However, many readers may have noticed that even with continuous updates to the protocol layer—from SS, SSR, Trojan, VLESS to SS2022—the pressure on the path layer is constantly increasing. For example, the availability period for domestic entry points at transit airports, which used to be calculated monthly or quarterly, has gradually shortened to the point where it now requires frequent changes (weekly or even daily). This isn't because the protocol has suddenly become less "covert," but rather because...The game space within the path layer itself is also being rapidly compressed..

As more and more cross-border activities become long-term and stable, relying on the same type of entry structure, the judgment problem faced by the system is no longer just "whether this path is abnormal," but begins to point to a higher-level evaluation object. This change is also the premise for the emergence of the next stage of the game.

3.4 From Path to Subject: When the Evaluation Object is No Longer Based on Just the "Link"“

Once the path layer scheme has been used extensively, over a long period of time, and stably, the focus of the system begins to change again.

Initially, the assessment focused on whether the path was abnormal. However, as more and more cross-border activities were successfully embedded into legitimate network structures, simply examining the path itself became insufficient to distinguish between abnormal and normal paths. Therefore, the system's assessment perspective shifted upwards—no longer solely based on...Does the path resemble normal traffic?Instead of focusing on specific individual users, the focus shifted to identifying which entities were consistently using these pathways. (It should be noted that at this stage, the evaluation targets were not individual users, but rather those...)Entities providing access capabilitiesFor example, nodes, network environments, or infrastructure users that have long concentrated on using domestic resources and provide stable cross-border entry points to the domestic market (such as well-known "transit" service providers).

The system begins to observe the overall behavior of these entities over time: whether they carry highly homogeneous cross-border traffic for a long period of time; whether their usage patterns are too concentrated and stable, yet difficult to explain using common business logic; whether they exhibit obvious statistical characteristics of "serving a specific purpose"; and whether such usage can still be reasonably classified as a certain acceptable form of infrastructure usage.

When the object of judgment shifts from "single connection" to "a persistent actor", the significance of the first two layers of the game begins to decline rapidly.

---

A typical misconception is that people still try to extend the game space at the path layer by constructing a "proxy chain." For example, the approach mentioned in the previous section: using a domestic VPS as the first hop in the proxy chain, sending cross-border traffic from home broadband to the VPS first, and then having that node initiate the cross-border connection, in an attempt to reduce the risk of direct exposure.

However, from the perspective of the main layer, the VPS in this structure did not truly serve to conceal home broadband users. On the contrary, domestic VPS itself became a...Entities with clear identities, singular purposes, highly concentrated behaviors, and extremely low cost of accidental harm.The system no longer needs to analyze whether a specific link "looks like normal traffic," but only needs to answer a simpler question:In terms of time, is this VPS consistently used to provide cross-border access capabilities for a specific purpose?

Under this logic, whether the next hop of the proxy chain is a transit airport entrance or a self-controlled overseas node, it cannot fundamentally change the conclusion—the path has been split, but the main body has not changed.

Therefore, in the game at the main layer, domestic VPS as the proxy chain entry point no longer necessarily has a greater structural advantage than direct connection to home broadband.

---

At this stage, the sophistication of the protocol is no longer the decisive factor; nor is the introduction of transit points a sufficient condition. What is truly being evaluated is...As an access provider, the interpretability of its overall behavior over time..

This is precisely the root of a very typical but easily misunderstood phenomenon in recent years: the agreement has not "completely failed" (at least SS2022 is still in effect), but the entry resources that transit airports rely on are being consumed more rapidly.

The sharp shortening of the entry point lifecycle is not because the technology has suddenly become "less concealed," but because these entry points have, over a long period of operation, exhibited sufficiently clear and concentrated behavioral characteristics, enabling them to be stably identified and categorized by the system.

The problem has therefore fundamentally changed—it is no longer "Does this connection look like normal traffic?", but rather:Can this kind of persistent access behavior still be considered a reasonable and acceptable way of using infrastructure?

When the game reaches this level, individual users are not the direct evaluation targets, but they are inevitably affected—because once the entry point is redefined, all users attached to it will be included in the outcome.

3.5 A clear, but not optimistic, trajectory

Looking back over the past decade or so, the entire process has not been chaotic, nor has it been a simple case of one generation of technology replacing another. More accurately, it presents a clear and highly consistent trajectory—The judgment criteria are constantly shifting upwards.From the lowest level of single-protocol identification, to the path layer of long-term traffic assessment, and then to the subject layer of overall behavior identification.

Initially, the game was focused on the protocol layer, concentrating on "whether a connection could be established." At that time, as long as the communication method was sufficiently covert and a single connection did not appear abnormal, the problem seemed to be solvable. Subsequently, the judgment began to shift to the path layer, with the focus no longer just on individual connections, but on observing the long-term paths that traffic takes through the network, and how cross-border behavior is embedded in more complex structures. By introducing relays and splitting ingress and egress points, the time to detection could be delayed, gaining a relatively stable window of opportunity.

When the game theory moves further up to the subject level, its nature fundamentally changes. The system no longer simply asks "Does it resemble normal traffic?" or merely observes "Where did it originate?", but begins to evaluate:Is this persistent access behavior inherently allowed to persist indefinitely?At this level, the marginal returns of any strategy that relies solely on technological complexity are rapidly declining. Even with continuous protocol updates and path restructuring, if the overall behavior is clear and focused enough, the outcome is usually only a matter of time.

More importantly, this trajectory reflects not only a technological evolution but also a shift in the system's judgment logic: as the focus of judgment shifts upwards, the space for individual action gradually narrows, and the system's requirements for "rationality" and "explainability" become increasingly stringent. In other words, individual users' strategy choices are increasingly constrained by their overall understanding of behavioral patterns, rather than solely by the protocol or path itself.

Therefore, what is truly worth considering is no longer how far technology can go, but rather:In a systemic game where judgment standards are constantly rising, how much sustainable space do individual users have left, and how can they make rational decisions within that limited space?Understanding this is a skill in itself—it allows us to more clearly identify boundaries, rationally plan resources and investments, and avoid getting caught in endless short-term adjustments and pursuits.

4. When whitelists become the norm: the boundaries of individual capabilities are being redefined.

Looking back at the previous chapters, we see a clear trajectory of the interplay between the protocol layer, path layer, and subject layer. Each change is not an isolated technological upgrade, but rather an inevitable result of the system's continuously shifting position. Now, the logic of the entire ecosystem has fundamentally changed: it's no longer about whether a single connection is abnormal, nor is it about whether the path can be hidden, but rather...Can a certain type of behavior be allowed to exist in the long term?.

The widespread adoption of whitelist mechanisms is an outward manifestation of this trend.

Many people, upon hearing the term "whitelist," instinctively assume a clear list specifying who can and cannot access the site. However, in reality, whitelists often don't exist in this form. They are more like a reversal of default rules: instead of "all connections are allowed, only abnormal ones are blocked," they gradually become—only behavioral patterns consistently identified as "legitimate" are allowed by default. In this model, the importance of whether something "looks like normal traffic" decreases, while the weight of whether it "belongs to a certain accepted role" increases. You may not see explicit prohibition prompts, but you will clearly feel that certain capabilities are naturally becoming difficult to maintain and difficult to sustain in the long term.

It is crucial to emphasize that the whitelist mechanism is not truly aimed at individual users. The system consistently evaluates categorizable and interpretable actors, such as corporate networks, cross-border business systems, international services, or users of large infrastructure. These actors are "allowed to exist long-term" not because their technology is more covert, but because their existence aligns with the system's understanding of "legitimate use." Individual users, on the other hand, are in a very awkward position: they may possess the technical capabilities, but lack a long-term, recognizable identity at the role level. This explains why, even when the game reaches the actor level, individuals are no longer directly confronted, yet they are still constantly affected.

Technology hasn't disappeared, nor has it stopped evolving. Protocols are still being updated, paths are still changing, and tools are still being developed. It's just that what they can determine has changed. In the early stages, technology determined whether a connection could be established; in the mid-stages, it influenced how long it could be maintained. And as the whitelist logic gradually took shape, technology more often determined how "smoothly" you would be included or excluded, but it could no longer determine the core issue of "whether you are allowed to exist long-term." This shift, while not dramatic in itself, is remarkably thorough.

The impact of this change is particularly pronounced for users heavily reliant on cross-border communications. The lifespan of gateway resources has become extremely short, and maintenance costs are rising rapidly. Any attempt to rely on short-term technological advantages is unlikely to fundamentally alter this situation. The system's judgment logic has transcended the technology itself and shifted towards...Long-term behavior, centralized patterns and infrastructure usage structureThe overall assessment is as follows. This not only puts continued pressure on previously effective path-layer solutions, but also further compresses the game space at the main body layer. In other words, the continued accumulation of technological complexity can no longer significantly change the boundaries of individual users. The real core variable is the user's position within the system.

If we had to summarize future trends in one sentence, the result might not be pleasant: individual users won't be targeted individually, but individual identity itself is gradually losing its structural position in supporting long-term cross-border capabilities. This isn't a problem with a particular solution, nor is it the result of a single technological upgrade; rather, it's an almost inevitable conclusion that has emerged after years of continuous shifts in its position. As systems become increasingly accustomed to understanding the world through "roles" and "subjects," individuals become precisely the most difficult to categorize and the most difficult to accommodate in the long term.

In this long-term game, we cannot control the system's rules or change the logic of judgment, but we can choose how to allocate our energy and resources. Identifying limitations, acknowledging uncertainty, and rationally allocating strategies—this is the only way for an individual to maintain sustainability in an uncertain environment. Technology will continue to iterate, paths will continue to change, but what truly belongs to you is always the control over your own actions and choices.