Switching source IP via VPN, Tor, or HTTP proxy is the primary victim-side mitigation because residual censorship is tuple-keyed; however, if the proxy entry node's path also crosses the censor, the attacker can redirect the attack at the proxy itself. On the censor side, null-routing middleboxes could eliminate the vulnerability by validating TCP sequence/acknowledgment numbers before dropping traffic, or by replacing null routing with an explicit block-page response.
From 2021-bock-your — Your Censor is My Censor: Weaponizing Censorship Infrastructure for Availability Attacks
· §VII
· 2021
· Workshop on Offensive Technologies
Implications
Proxy ingress nodes should be selected or deployed so their network path does not cross the target censor's border; geographically diverse entry points force the attacker to independently trigger residual censorship at each ingress, multiplying attack cost.
Circumvention clients should silently rotate proxies on first blocking detection rather than surfacing an error; rapid rotation stays ahead of an attacker who must re-trigger the 4-tuple block for every new source IP or port the client adopts.