TLS connections begin with a Client Hello. That first handshake packet contains the hostname the browser intends to reach—the SNI, or Server Name Indication. Servers that host many domains need this name before encryption starts, so SNI travels in plaintext. Browsers include it even when the server does not require it. A firewall with a blacklist can therefore match the visible hostname and cut the TLS connection before any encrypted traffic begins.
No single fix works everywhere. The closest general approach is domain fronting. In a fronted connection, the TLS handshake names one domain—often one outside the blacklist—while the later HTTP request asks for another. Some servers also ignore SNI entirely. In either case, a blocked site can sometimes be reached by sending a permitted SNI or no SNI at all. The catch is that this depends on server behavior, so each site may need a different choice.
Diagnosing the block
Before changing anything, determine whether SNI is actually the problem. Open a new tab, press F12, and watch the Network panel while loading the HTTPS site. If a failed request has no response headers, SNI blocking is a likely cause. Ping the hostname to rule out DNS poisoning or IP blocking: a reply points toward SNI filtering, while no reply suggests one of the other two. Next, try connecting without SNI; if the server falls back to a default certificate and that certificate matches, the connection can succeed. If not, try IPv6 where available. Another option is to use a different subdomain of the same domain, such as img.palemoon.org for .palemoon.org, or another unblocked hostname on the same server, such as graph.cdninstagram.com for www.instagram.com. An arbitrary SNI may also work. The exception is a blocked site sharing an IP with other sites, as on a free CDN: then SNI must still be sent and the main domain must remain unchanged.
Domain fronting is not officially supported by every provider. Google and Amazon actively reject it across their services, and a site is free to refuse such connections. Where it works, the behavior is often a quirk of the server. Pixiv, for example, does not inspect SNI, so a TLS connection without SNI can still proceed. Chinese Wikipedia is blocked at zh.wikipedia.org, but www.wikipedia.org is not; using www.wikipedia.org as the SNI can still carry an HTTP request for zh.wikipedia.org.
Sites reported to be reachable through domain fronting include E-Hentai, Pixiv, Wikipedia, Syosetu, Reddit, and Quora. Accesser's author maintains a longer list of supported sites.
Tools that alter or avoid SNI
Escape
Escape is a Firefox extension from the Madynes team at the French national institute for computer science and automation. It lets the user set a custom SNI. The team published Efficiently bypassing SNI-based HTTPS filtering in 2015, describing both the technique and the extension. The practical limit is Firefox 32, released in 2014. Old as it is, that browser can still handle much of the modern web, and the extension can be tested on sites such as ExHentai, Pixiv, and Syosetu.
revolter-firefox
revolter-firefox moves the same idea to Firefox 68, released in 2019. It also allows a custom SNI. The original project by Xmader was deleted after its author was visited by authorities; the repository now on GitHub is a backup kept by enthusiasts.
Accesser
Accesser by URenko runs from an executable; on first use, the certificate must be trusted. Development has stalled, and connections to E-Hentai and Pixiv have known problems. It works as a proxy, so it should not be run alongside another circumvention tool. A repackaged build based on the project's source also circulates, but the same proxy caveat applies.
GotoX
GotoX by SeaHOH has more features than Accesser, receives updates more regularly, and ships with more detailed documentation. For this topic, its relevant feature is SNI bypass.
Pixiv-Nginx
Pixiv-Nginx by mashirozx is one of the more widely circulated approaches. Its setup has been described extensively elsewhere, so there is little to add here.
bypass
The bypass project addresses the same problem, but this overview does not go into its configuration.
v2ray
v2ray is a powerful and widely used circumvention tool. Domain fronting can be configured on it, though the setup is more cumbersome than with dedicated SNI tools.
Chromium startup parameters
Chromium-based browsers can apply a host rule at startup. The parameter --host-rules="MAP *.a.com b.com[,MAP...]" makes any subdomain of a.com open a TLS connection to b.com and use b.com as the SNI. A related parameter, --host-resolver-rules, can map a hostname to a specific IP. This avoids the compatibility problems of old Firefox builds. Sheas-Cealer, a WPF/.NET 5 SNI spoofing tool for Windows 10 and later, implements the same general idea.
TCPioneer and phantomsocks
TCPioneer and phantomsocks take a different route. Instead of changing SNI, they modify TCP packets so that stateful inspection by the GFW fails to track the connection correctly. The approach resembles the earlier Xixiang project. Because SNI is left alone, these tools can even direct-connect sites behind a CDN. They are arguably the strongest entries here, and they are simple to use.
Direct connections are still subject to network conditions. If the route to the target is good, pages may load smoothly; if it is poor, images can stall halfway through. A useful sign of success is that the site's title appears. These are third-party tools with their own security and maintenance risks, so it is worth checking their status before relying on them.