KovraBefore choosing a method, it is worth being precise about two things: how the filter in front of you works, and what it can see either way. Most advice on this topic gets both wrong, which is why it either fails immediately or works while quietly leaving a trail.
How the block is implemented
DNS filtering
The cheapest and most common. The network forces all name lookups through its own resolver, which returns a block page instead of the real address. It is easy to deploy across thousands of devices and easy to bypass with encrypted DNS — which is exactly why the next layer exists.
SNI and IP filtering
Even over HTTPS, the hostname you are requesting travels in clear text in the TLS handshake unless Encrypted Client Hello is in use. A filtering appliance reads it and resets the connection. IP-level blocks add a coarse fallback for well-known destinations.
TLS inspection on managed devices
The layer that changes everything. If the organization installed a root certificate on the device, the appliance can terminate TLS, read the plaintext, and re-encrypt to the destination. Nothing running on that device can hide from it, because the interception happens at the point where your own software does the encryption. On a managed laptop or a phone with an MDM profile, assume this is possible.
Application and protocol blocking
Enterprise firewalls also classify traffic by protocol shape and drop recognizable VPN handshakes. WireGuard and OpenVPN are trivially identified; this is the same fingerprinting problem described in the protocol comparison.
What actually works, and against what
| Method | Beats DNS filter | Beats SNI filter | Beats TLS inspection |
|---|---|---|---|
| Alternative DNS server | Sometimes | No | No |
| DNS over HTTPS in the browser | Yes | No | No |
| Public web proxy | Yes | Until categorized | No |
| VPN, standard protocol | Yes | Yes | No, if managed device |
| VPN with TLS camouflage | Yes | Yes | No, if managed device |
| Mobile data instead of Wi-Fi | Yes | Yes | Yes |
Read the last two columns together. Nothing you install bypasses inspection on a device the organization controls — and the simplest genuine bypass, using your own cellular connection on your own phone, involves no bypass at all.
The visibility question, answered honestly
On a personal device on the organization's Wi-Fi, a VPN hides the destinations and contents of your traffic. What remains visible:
- That an encrypted connection exists, and to which IP address.
- How much data moved, and when.
- On networks that block unknown protocols, the fact that something was blocked or that an unusual connection was attempted.
That last point is the one people underestimate. A filter that logs "VPN attempt from this device" has recorded something interesting even though it learned nothing about the traffic. A camouflaged protocol that presents as normal HTTPS avoids generating that log entry, which is a different property from encryption — the mechanism is in the VLESS Reality guide.
If you decide to do it anyway
- Use your own device. This is the single most important line. Personal phone, personal laptop, no work profile.
- Never install a certificate the organization asks for on a personal device. That is the switch that makes inspection possible.
- Prefer a protocol that does not announce itself, so the attempt is not logged as a policy violation.
- Turn on the kill switch, so a dropped tunnel does not silently resume in clear text.
- Verify DNS resolves inside the tunnel — the checks are in the leak test guide.
- Do not use free proxy sites. On a network that is already logging you, adding an anonymous operator with full visibility into your session is the worst of both worlds; see free proxy lists.
The part that has nothing to do with technology
The real risk here is almost never technical. It is the acceptable-use policy: a document that typically permits monitoring of network use and treats circumvention as misconduct. Filters exist for a mixture of legitimate reasons — bandwidth, malware, legal obligations for minors — and blanket ones. Knowing which category applies to the site you want is usually more useful than any of the methods above, and "this tool is blocked and I need it for work" is a request IT departments grant routinely.
The summary
DNS and SNI filters are bypassable and a camouflaged tunnel does it cleanly. TLS inspection on a managed device is not bypassable by anything you install on that device. And the method with the fewest complications is often the one people skip: your own phone, your own data plan, no policy to violate.