XX-Net

XX-Net is a proxy built to get through a national firewall that blocks much of the web. It runs on the computer as a local proxy, the browser is pointed at it, and the traffic leaves disguised as the ordinary encrypted browsing that filters cannot afford to block.

Its approach is stated plainly by its own project. It does not look for holes in the firewall, because holes get patched. It makes the traffic indistinguishable from a normal browser’s, so there is nothing to single out.

A web page on the local machine shows the status of every connection and holds every setting, and the whole thing runs from a folder without installation.

It carries two engines, and knowing the difference is the whole of using it. XX-Net began with a proxy that ran through an app platform’s servers, which the user deploys as their own tiny application and which the project now switches off by default.

It has since centred on X-Tunnel, a hosted tunnel service tied to an account that carries full encryption and needs no setup beyond signing in. The project has run continuously for many years and still releases updates, lately an updated blocklist and new channels for the tunnel.

The sections below cover how the disguise works, the two engines, the local web interface, the per-site rules, and where the trade-offs sit.

Traffic that looks like a browser

Filters block what they can recognise, and XX-Net is built around that fact. Known proxy protocols, known server addresses and traffic with a recognisable fingerprint all get cut.

The program’s answer is to make its connections look exactly like a mainstream browser talking to ordinary web servers over the standard encrypted protocol, down to the handshake. Blocking it would then mean blocking normal browsing. A shifting set of channels and an obfuscation layer keep the fingerprint from settling into something a filter can learn.

That is why the project describes its strategy as blending in rather than breaking through, and why it has outlasted tools that depended on a single trick.

The disguise also has a downside. Traffic shaped to look like browsing is not shaped for speed, so downloads run with a little latency, which the project itself notes.

The two engines

The original XX-Net engine ran through a cloud application platform. The user deployed a small server as their own application there, imported a certificate into the browser, and the proxy fetched pages through that application. It was fast and it was yours, but it needed a deployment, a certificate, and later a working IPv6 connection, and the platform’s operator could see the traffic passing through. The project now disables it by default and treats it as an option for those who already have it set up.

X-Tunnel is the current path. Sign in with an account and the tunnel connects through the project’s own servers over several channels, with end-to-end encryption, no certificate to import and no deployment. It is the engine a new user should expect to use, and the one the recent updates improve.

It is a hosted service, which means trusting the project’s servers with the connection rather than running your own. For a circumvention tool that also runs through its operator’s servers, with no account and a long record, a long-running circumvention tool without accounts is the closest comparison.

The local web interface

Everything in XX-Net is managed from a web page served by the program on the local machine. It shows whether each engine is connected, the channels in use, the traffic passing through and the log, with a status page that reads as a dashboard. Settings for the proxy port, the engines, the account and the rules all live there, so there is no separate control window to find.

The browser points at the local proxy port, which is the one configuration step, and the project’s troubleshooting guide spends most of its length on that step. Closing the program while the browser still points at the port leaves the browser unable to connect, which is the commonest mistake.

For routing a program that has no proxy setting of its own, Proxifier sends its traffic through the local proxy anyway.

Per-site rules and the blocklist

Not everything should go through the XX-Net tunnel. Local sites load faster direct, and some sites misbehave through a proxy, so a rule list decides which domains go through which engine and which bypass it. A blocklist of domains that need the proxy ships with the program and is updated with releases, and rules of your own are added to it.

That split keeps the day-to-day browsing fast and sends only the blocked sites through the tunnel. It also keeps the tunnel’s load down, since traffic that does not need the proxy should not pass through it.

Where the trade-offs sit

The hosted XX-Net engine means trusting the project’s servers rather than your own. The old engine needs a cloud deployment, IPv6 and a certificate, and the platform could see its traffic. Setup is a web page and a proxy setting rather than a one-click app, and the documentation is written first for its home audience, with translations trailing.

Speed trades against the disguise. And a tool of this kind is in a permanent contest with the filters it crosses, so a channel that worked yesterday may not work today until an update arrives.

Against those, it is one of the few projects of its kind still releasing after many years, it is open source, and its blending-in approach has aged better than the tricks. For a simpler one-click tool for the same purpose, Lantern asks less of the user and offers less control.

Conclusion

XX-Net suits people behind a national firewall who want a tool that blends into normal browsing rather than fighting the filter head on. It suits those comfortable with a proxy setting and a web page in place of a one-click app. The disguise, the hosted tunnel and the per-site rules are what have kept it working for years.

It asks for trust in its servers, patience with setup and some tolerance for latency, and it is in a contest that never ends. Use X-Tunnel, keep the rules tight so only blocked sites go through, and update when a channel stops working.