1 When stability begins to require maintenance

The direct reason for writing this article is that a cross-border transit service provider I have long relied on (which I had always considered to be the most technically professional in my mind) finally went down recently, causing the access architecture that had been running stably for years to instantly fail. This change forced me to re-examine the reliability and sustainability of the entire cross-border access solution, and also made me gradually realize that what is truly being shaken may not be any specific solution, but rather the entire game position itself, which is undergoing structural changes.

Speaking of accessing the global internet, I have experienced the entire process from openness to tightening. In the early years when the domestic internet was just taking shape, the “external network” was not a topic that needed to be repeatedly discussed. For many people, the difference between accessing foreign websites and domestic websites was more reflected in speed and experience, rather than “whether it could be opened.” At that time, Google, some technical communities, and foreign media websites basically lay quietly in bookmarks, and you just clicked them when you used them. Few people realized that this was a temporary state.

The change did not happen suddenly, but rather slowly and continuously. The earliest feeling was not “being blocked,” but rather “not very stable”—accessible at certain times, obviously slower at others, and occasionally successful after refreshing a few times. Later on, some websites began to experience long-term unreachability, and “whether it can be opened today” became a result that required a trial to find out.

It was also from that stage that individual users who needed cross-border internet access began to realize: keeping external network access itself might require additional costs.

Most of what these individual users initially came into contact with were still VPNs in the traditional sense. Some tech-savvy people would even tinker with their routers—for example, back then, I did it by flashing DD-WRT firmware and configuring a VPN. Of course, the experience at that time was far from good: complex configuration, average stability, and when problems arose, it was hard to tell whether it was a network, device, or service issue. But at the time, it at least provided a way to “still connect out.”

As more and more people used it, the demand gradually became clear, and solutions also began to evolve. Some lighter tools that appeared later quickly replaced the early, clunky methods. A class of solutions represented by Shadowsocks became almost the default choice for individual users for a long time. It no longer emphasized complete takeover of the entire network environment, but rather leaned toward pragmatism: good enough, stable, and with controllable costs.

That was also the first time many people had an illusion—as if this matter had been “solved.” After installing it, there was no need to worry about it for a long time; the connection was stable, the experience was coherent, and accessing the external network once again became a daily behavior, rather than a technical problem that required deliberate tinkering.

But this stability did not last forever. Later on, changes began to reappear: the connection success rate dropped, the usable cycle shortened, and solutions that could originally be used for a long time gradually became temporary states requiring frequent adjustment and migration. By this stage, the question was no longer just “which tool to choose,” but rather made people vaguely feel that—This logic itself seems to be losing its support.

At that time, it was still hard for me to explain exactly what was happening in one sentence; I just clearly felt that the familiar path was becoming increasingly unsustainable. But without other reference systems, I could only continue forward along the original line of thought, repeatedly looking for a solution that “looked a bit better.”

2 Why stability becomes an illusion

During that relatively stable period, many people did not actually realize they were in a special window of opportunity. The connection was reliable, the experience was coherent, and external network access receded back to the position of “background infrastructure”—it existed, but did not need to be frequently thought about.

This state easily leads people to make an intuitive judgment: the problem has been solved—at least on an individual level, it no longer seems urgent, nor is it worth investing extra energy. As long as the solution still works, there is no reason to care why it works. But looking back, this sense of “stability” itself is instead a signal that warrants vigilance.

Stability did not disappear suddenly, but rather lost its predictability first. The earliest change was not complete unavailability, but rather that the success rate began to become less reliable—the same environment, the same usage pattern, sometimes smooth, sometimes failing without warning. Subsequently, the usable cycle of the solution was significantly shortened, and the state that could originally be maintained for a long time gradually evolved into a process requiring periodic adjustment, migration, or even overall replacement.

By this stage, technology itself is no longer the biggest variable. What has truly changed is the relationship between the individual and the system (where ‘system" is used in the text to refer to the network evaluation and control mechanism)relative position。

You will find that no matter which type of solution is adopted, their performance shows a highly consistent trajectory: usable in the early stage, stable in the middle stage, and then entering a decay period. The difference between different solutions is more reflected in “whether the decay comes early or late,” rather than “whether it will decay.”

At this point, an originally ignored question begins to surface—If every generation of solutions eventually leads to the same end, is the problem really with the technology itself?

When you need to constantly invest time to maintain a “state that should have been stable,” this matter is no longer a simple technical choice, but rather a continuous game. For individual users, the cost of this game is not just money, but also includes energy, judgment, and the ability to bear future uncertainty.

It was also during this process that I gradually realized: instead of repeatedly comparing which solution is “more advanced” or “more stealthy,” it is better to look at it from another perspective—where exactly are these solutions placed in the ”game with the system.”

When the question begins to shift from “can I still connect” to “how much extra cost do I need to pay to maintain this connection,” the answer itself is actually already changing. What is truly worth thinking about is no longer whether the next technology will be better, but rather:how much sustainable space individual users actually have left in this game.

It is also from here that I try to re-understand this issue in a more abstract way—no longer obsessing over specific solutions, but rather observing the game levels they are in, and how these levels themselves are changing.

3 How the game shifts upward layer by layer

1 From connection to subject: A three-layer game model

If we only look at the surface, the changes over the past decade or so can easily be understood as round after round of “technical upgrades”: one solution gradually fails, and another solution appears, looking like tools are constantly being updated. But looking at a longer timeline, this explanation seems insufficient.

What has truly changed is not that a certain technology suddenly became smart or fragile, but ratherthe position where the system judges “anomalies” is constantly shifting upwardThe focus of judgment is no longer limited to “whether this connection looks like normal traffic,” but rather extends to “whether a certain bearing subject continuously undertakes abnormal use in the time dimension.” In other words, the evolution over the past decade is essentially not that “protocols fail faster and faster,” but rather that the center of gravity in the three-layer game is constantly shifting upward.

To give readers a more intuitive understanding of this hierarchical relationship, a simple schematic diagram is used below to represent the three-layer game model:

2 Protocol-layer game: When the judgment standard is “whether it looks like”

In the earliest stage, the circumvention game occurred almost entirely at the protocol layer. Whether it was early traditional VPNs, such as IPsec, PPTP, OpenVPN, SSH Tunnel, or a series of solutions represented by Shadowsocks and SSR later on, the core goal was highly consistent:To make cross-border communication formally look unlike a “special channel.”

During this period, the structure of cross-border communication for individual users was very direct—The user side and the overseas service node establish a one-to-one connectionAs long as the system has not blocked the overseas node, individual users can complete almost all cross-border access needs through it.

Precisely because the structure was simple enough, the system's judgment of “whether it is abnormal” focused almost entirely on the connection itself: whether the protocol form was too fixed; whether the handshake process had obvious fingerprints; whether the encrypted data distribution deviated from common applications; and whether the traffic rhythm differed significantly from mainstream business. Once these characteristics appeared statistically “unnatural,” the entire communication could easily be identified individually.

The identification logic of this stage is essentially rule-driven: as long as these known, explicit rules can be avoided, it is difficult to be directly hit. This is also why protocols like Shadowsocks could once be used stably for quite a long period of time, even calculating their life cycle in units of “years”.

An intuitive experience that many early users have had is:As long as you switch to a protocol that “looks more natural”, connections that originally could not be established often become smooth again. This experience is precisely a true reflection of the effectiveness of the protocol-level game—what the judgment criteria focus on is “whether it looks like it”, rather than “who is using it”.

But the protocol-level game has an unavoidable upper limit—As long as features exist stably, they can definitely be summarized. When identification methods no longer rely primarily on manually maintained rules, but instead begin to use statistical methods and models to extract “anomaly patterns” from a large number of samples, the underlying logic of judgment undergoes a fundamental change.

To put it in a simpler way: the early stage was more like “checking rules,” while the later stage was asking—Amidst a vast amount of normal communication, which small handful of behaviors appear unnaturalEven if a single connection is completely reasonable in form, as long as it exhibits a stable yet rare pattern over the long term in dimensions such as time distribution, connection rhythm, and data exchange ratio.

By this stage, whether the protocol layer “looks like a good disguise” is no longer the deciding factor. Consequently,any method of cross-border communication under a direct connection structure that relies on protocol disguise will inevitably hit the ceiling of the protocol-layer game.

The ultimate result, naturally, is that overseas service nodes are identified and blocked.

In addition to Shadowsocks/SSR/Trojan, schemes like REALITY also aim to try different combinations of protocol features, all with the goal of attempting to reduce the risk of rule-based identification by changing the form of communication. However, their ultimate fate is the same, because: the protocol alone cannot determine long-term viability.

3 Path-layer game: Burying anomalies into a larger structure

As the room for maneuvering at the protocol layer is gradually compressed, the “scientific” solutions for individual users“ cross-border communication also change—the change is not reflected in ”switching to a newer protocol," but ratherthe entire connection structure begins to be redesignedThe focus of the game begins to shift upward from the protocol layer, entering the path layer.

In the previous stage, the form of cross-border communication was actually very straightforward: the client directly connected to the overseas node. The protocol was both the communication method and the primary object of evaluation for the system; once this form of communication appeared unnatural in a statistical sense, it was easily restricted.

After entering the path layer, the focus of the game clearly shifted upward—solutions no longer obsessed over whether a single connection “looked like normal traffic,” but instead tried to embed cross-border behavior into a larger network structureThe most typical change is the introduction of transit nodes: for example, individual users can use a VPS from a major domestic cloud provider as the starting point for cross-border traffic. When initiating cross-border access, the traffic that needs to cross the border is first sent to the VPS (this segment is domestic access), and then forwarded by that node to the overseas service node.

By splitting the ingress and egress, the cross-border behavior of direct connection via home broadband, which was originally “obvious at a glance,” is dispersed into multiple segments (home broadband -> domestic VPS, domestic VPS -> overseas service node, or even domestic VPS1 -> domestic VPS2 -> ... -> overseas service node) that look like more reasonable links.

Under this structure, compared to home broadband directly initiating cross-border connections, traffic routed through a VPS is closer to the common usage patterns of cloud services, and therefore appears more conventional and less likely to be singled out for scrutiny (previously, the system's tolerance for cross-border access initiated by cloud provider VPSs was much higher than that initiated directly by home broadband users).

At the time, I tried using a domestic VPS as a springboard to connect to a self-built overseas website. The result was that this line was more stable than the direct connection node from home broadband: even if the original direct connection node failed frequently, this transit line could remain online for several days without dropping. This made me intuitively realize for the first time that the sustainability of cross-border connections depends not only on the protocol itself, but also on what kind of network structure you embed it in.

It needs to be emphasized that this stage does not mean that the ”protocol” itself, which was relied upon in the direct connection mode, has lost its function. On the contrary,those protocols originally used to directly connect to overseas nodes did not disappear, but were “sunk” to the segment connecting to the domestic transit ingress, becoming an integral part of the entire communication structure.

The reason why path-layer solutions could survive for a fairly long time is not because the technology is so “advanced,” but because it touches upon a realistic constraint that the system must consider—the cost of collateral damageWhen cross-border traffic is only a part of a large network structure, simply cutting off a certain node or link may affect a large amount of normal business that should be allowed (cloud providers inherently have a lot of normal cross-border traffic). Because of this, in practice, such solutions have a larger survival space than direct connection methods that rely solely on protocol disguise (the transit "airports" that were widely used later are, in essence, a concrete manifestation of this very idea.).

Under this line of thinking, some more “non-direct connection” practices have gradually emerged: cross-border communication is no longer explicitly aimed at “accessing a certain overseas service,” but is instead embedded in more general network structures whose purposes are harder to distinguish. For example, with the help of large international content delivery networks (CDNs) or proxy-based infrastructure, the real communication egress is hidden behind highly general, widely used services. In this mode, cross-border behavior almost no longer presents itself as an “independent object” with a clear direction, but rather resembles a part of some legitimate network service.

Here, a special example must be mentioned—WARP. For a fairly long period of time (though it is now dead, of course), WARP carried a large amount of personal cross-border traffic, but it was not just a simple VPN tool. Its communication was embedded in the widely used infrastructure of Cloudflare (a globally renowned domain name resolution, CDN service, and security service provider), mixed with a vast amount of normal traffic, making it almost impossible to identify its cross-border behavior individually. For the system, this type of traffic is both common and reasonable—it is neither conspicuous nor easily distinguished using traditional rules.

This model perfectly embodies the ultimate strategy of the path-layer game: instead of relying on technology itself to “hide,” it reduces the risk of identification from the ground up by integrating behavior intolarge-scale, recognized network structures, fundamentally reducing the risk of being identified. In terms of personal experience, this means users do not need to frequently switch protocols or nodes, connections are more stable, and the lifecycle is longer; for system evaluators, however, the difficulty of judgment is significantly increased.

As long as these infrastructures themselves still carry a large amount of normal, irreplaceable business, path-layer solutions will continue to have practical room for survival.

However, many friends should have also noticed that even though the protocol layer is constantly being updated—from SS, SSR, Trojan, VLESS to SS2022—the pressure on the path layer continues to increase. For example, the availability cycle of domestic entry points for transit airports has gradually shortened from being measured in “months” or ”quarters” in the past to requiring frequent changes (“weeks” or even ”days”) recently. This is not because the protocols suddenly became “not stealthy enough,” but becausethe game space of the path layer itself is also being rapidly compressed。

When more and more cross-border behaviors attach themselves to the same type of entry structure over the long term and stably, the judgment problem faced by the system is no longer just “whether this path is abnormal,” but begins to point to higher-level evaluation objects. This shift is precisely the prerequisite for the emergence of the next stage of the game.

4 From path to subject: When the evaluation target is no longer just based on “links”

After path-layer solutions are used in large quantities, over the long term, and stably, the focus of the system begins to change once again.

Initially, what was judged was “whether this path is abnormal”; but when more and more cross-border behaviors are successfully embedded into reasonable network structures, it becomes very difficult to distinguish abnormal from normal solely by starting from the path itself. Consequently, the system's perspective of judgment begins to shift upward—no longer just looking atwhether the path looks like normal traffic, but starting to focus on: which entities are continuously using these paths (it should be noted that at this stage, the evaluated objects are not specific individual users, but rather thoseentities providing access capabilities. For example, users of nodes, network environments, or infrastructure that intensively use domestic resources over the long term and provide stable cross-border entry points to the domestic market (such as the familiar ”transit” service providers).

The system begins to observe the overall behavior of these entities over time: whether they carry highly homogenized cross-border traffic over the long term; whether their usage patterns are overly concentrated and stable, yet difficult to explain with common business logic; whether they exhibit obvious statistical characteristics of “serving a specific purpose”; and whether such usage patterns can still be reasonably classified as some acceptable form of infrastructure utilization.

When the object of judgment shifts from a “single connection” to a “persistently existing behavioral entity,” the significance of the first two layers of the game begins to decline rapidly.

A typical misconception is still trying to extend the game space of the path layer by constructing “proxy chains.” For example, the practice mentioned in the previous section: using a domestic VPS as the first hop of the proxy chain, where residential broadband cross-border traffic is first sent to the VPS, and then a cross-border connection is initiated by that node, attempting to reduce the risk of direct exposure in this way.

However, from the perspective of the entity layer, the VPS in this structure does not truly serve to mask the residential broadband user. On the contrary, the domestic VPS itself becomes anentity with a clear identity, a single purpose, highly concentrated behavior, and extremely low collateral damage cost. The system also no longer needs to analyze whether a specific link “looks like normal traffic,” but only needs to answer a simpler question:Whether this VPS, in the dimension of time, has been stably used to provide cross-border access capabilities for specific purposes.

Under this reasoning logic, whether the next hop of the proxy chain is a transit airport entry point or a self-controlled overseas node, it cannot fundamentally change the conclusion—the path is split, but the subject remains unchanged.

Therefore, in the game at the subject layer, domestic VPS as an entry point for proxy chains no longer necessarily possesses a higher structural advantage than residential broadband direct connection.

At this stage, whether the protocol is advanced is no longer the deciding factor; whether transit is introduced no longer constitutes a sufficient condition. What is truly being evaluated isthe explainability of its overall behavior over the time dimension as an entry provider。

This is also the root cause of a very typical but easily misunderstood phenomenon in recent years: protocols have not “completely failed” (at least SS2022 is still left for now~~), but the entry resources that transit airports rely on are being consumed at a much faster rate.

The sharp shortening of the entry lifecycle is not because technology suddenly became “not stealthy enough”, but because these entries, in their long-term operation, have already exhibited sufficiently clear and concentrated behavioral characteristics, allowing them to be stably identified and categorized by the system.

The question has therefore undergone a fundamental change—it is no longer “does this connection look like normal traffic”, but has instead become:Can this type of persistently existing access behavior still be regarded as a reasonable and acceptable way of using infrastructure?

When the game reaches this layer, individual users are not the direct objects of evaluation, but they are inevitably affected—because once the entry side is redefined, all users attached to it will be included in the outcome.

5 A clear, but not optimistic trajectory

Looking back over the past decade or so, the entire process has not been chaotic, nor has it been a simple replacement of one generation of technology by another. More accurately, it presents a clear and highly consistent trajectory—The criteria for judgment are constantly shifting upward, from the lowest-level single protocol identification, to the long-term traffic evaluation at the path layer, and then to the overall determination of behavior at the subject layer.

Initially, the game was concentrated at the protocol layer, focusing on “whether it can connect.” At that time, as long as the communication form was sufficiently stealthy and a single connection did not appear abnormal, the problem seemed solvable. Subsequently, judgment began to shift upward to the path layer, where the focus was no longer just on a single connection, but on observing the path that traffic takes through the network over the long term, and how cross-border behavior is embedded into more complex structures. By introducing transit and splitting entry and exit points, the time to discovery could be delayed in exchange for a relatively stable window period.

When the game further shifts upward to the subject layer, the nature undergoes a fundamental change. The system no longer just asks “does it look like normal traffic”, nor does it no longer just observe “where it goes”, but instead begins to evaluate:whether this persistently existing access behavior is itself allowed to exist in the long term. At this layer, the marginal return of any strategy relying solely on technological complexity is rapidly declining. Even if protocols are constantly updated and paths are constantly reconstructed, if the overall behavior is sufficiently clear and concentrated, the outcome is usually just a matter of time.

What is more noteworthy is that this trajectory is not just an evolution at the technological level, but rather reflects the evolutionary trend of the system's judgment logic: as the focus of judgment shifts upward, the space for individual operation gradually narrows, and the system's requirements for “rationality” and “explainability” become higher and higher. In other words, individual users' strategic choices are increasingly constrained by the overall perception of behavioral patterns, rather than just the protocol or path itself.

Therefore, what is truly worth reflecting on is no longer how far technology can go, but rather:in the system game where judgment standards are constantly shifting upward, how much sustainable space is actually left for individual users, and how to make rational decisions within that limited space. Understanding this is itself a capability—it allows us to identify boundaries more clearly, plan resources and investments rationally, and avoid falling into endless short-term adjustments and pursuits.

4 When whitelisting becomes the norm: The boundaries of individual capabilities are being redefined

Looking back at the previous chapters, we see that the game trajectories of the protocol layer, path layer, and subject layer are clearly visible. Every change is not an isolated technological upgrade, but rather the inevitable result of the system's judgment position constantly shifting upward. By now, the logic of the entire ecosystem has undergone a fundamental shift: it is no longer about whether a single connection is abnormal, nor is it about whether the path can be hidden, but ratherwhether a certain type of behavior can be allowed to exist in the long term。

The popularization of the whitelist mechanism is the external manifestation of this trend.

When many people hear “whitelist”, they subconsciously understand it as an explicit list stating who can access and who cannot. But whitelists in reality often do not exist in this form. It is more like a reversal of default rules: it is no longer “all connections are allowed, only block anomalies”, but instead gradually becomes—only behavioral patterns identified as “reasonably existing” over the long term are allowed by default. In this mode, the importance of whether it “looks like normal traffic” decreases, while the weight of whether it “belongs to an accepted role” increases. You won't necessarily see explicit block prompts, but you will clearly feel that certain capabilities are naturally becoming difficult to maintain and difficult to stably exist in the long term.

What needs to be specially emphasized is that the true target of the whitelist mechanism is not individual users. What the system evaluates is always behavioral subjects that can be categorized and explained, such as corporate networks, cross-border business systems, internationalized services, or large-scale infrastructure callers. The reason these subjects are “allowed to exist in the long term” is not because their technology is more stealthy, but because their existence conforms to the “reasonable use” understood by the system. Yet individual users happen to be in a very awkward position: they may possess the capability technologically, but at the role level, they lack an identity explanation that can be recognized in the long term. This also explains why, after the game enters the subject layer, individuals are almost no longer a party to direct confrontation, yet they still continue to be affected.

Technology has not disappeared, nor has it stopped evolving. Protocols are still updating, paths are still changing, and tools are still developing. It is just that what they can decide has changed. In the early stage, technology decided whether you could connect; in the middle stage, technology affected how long you could maintain it. And after the whitelist logic gradually takes shape, technology mostly just decides how “smoothly” you will be included or excluded, but it can hardly decide the core question of “whether you are allowed to exist in the long term” anymore. This shift is not dramatic in itself, but it is very thorough.

For users who highly rely on cross-border communication, the impact of this change is particularly obvious. The lifecycle of entry resources has become extremely short, and maintenance costs are rising rapidly. Any attempt relying on short-term technological advantages can hardly fundamentally change this situation. The system's judgment logic has transcended technology itself, turning toward the overall evaluation oflong-term behavior, concentrated patterns, and infrastructure usage structures. This not only keeps past effective path-layer solutions under continuous pressure, but also further compresses the game space at the subject layer. In other words, the continued stacking of technological complexity can no longer significantly change the boundaries of individual users. The true core variable is the system position where the user is located.

If the future trend must be summarized in one sentence, the result may not be pleasant: individual users will not be targeted individually, but the individual identity itself is gradually losing the structural position to carry long-term cross-border capabilities. This is not a problem of a certain solution, nor is it the result of a certain technological upgrade, but rather a conclusion that is almost inevitable after years of continuous upward shifting of positions. As the system becomes more and more accustomed to understanding the world through “roles” and “subjects”, individuals happen to be the type of object that is hardest to categorize and hardest to accommodate in the long term.

In this long-term game, we cannot control system rules, nor can we change judgment logic, but we can choose how to allocate our energy and investment. Identifying limitations, acknowledging uncertainty, and arranging strategies rationally—this is the only means for individuals to maintain sustainability in an uncertain environment. Technology will continue to iterate, paths will continue to change, while what truly belongs to you is always the control over your own behavior and choices.