You block a site by editing the hosts file on Windows 10. Open Notepad as administrator, load C:\Windows\System32\drivers\etc\hosts, add a line like 127.0.0.1 example.com, save, and the site becomes unreachable on that machine. That's a network block at its simplest. Everything else is just a more sophisticated version of the same trick.
What a Network Block Actually Is
A network block stops your device from talking to a specific server or service on the internet. It happens at one of three layers: the domain name lookup, the IP address connection, or the packet content. Every block works by interfering with how your computer finds or reaches the destination.
Think of it like a locked door. The block is the lock. The method you use to get around it is the key. Some keys work on all doors. Most don't.
The Three Main Reasons You Get Blocked
- Your ISP blocks content — Common in countries with censorship systems like the Great Firewall of China, or for copyright infringement notices. They do this at the DNS or IP level.
- A school or employer blocks distracting sites — They use a proxy or firewall that stops you from loading YouTube or Reddit during work hours. Often DNS-based, sometimes with Deep Packet Inspection.
- A streaming service blocks you by location — Netflix, BBC iPlayer, and Hulu check your IP address against a geolocation database. If your IP says you're outside the allowed region, you see a "content not available" error.
How DNS Blocks Work (and How to Beat Them)
DNS is the phonebook of the internet. When you type google.com, your computer asks a DNS server for the numeric IP address. An ISP block simply returns a wrong or empty answer. Your browser usually shows "server not found."
Beat it with Cloudflare's 1.1.1.1 (free)
Change your DNS server to Cloudflare's 1.1.1.1 and 1.0.0.1. On Windows 10, go to Control Panel > Network and Sharing Center > Change adapter settings > right-click your connection > Properties > Internet Protocol Version 4 (TCP/IPv4) > enter the DNS addresses. It takes 30 seconds. It's completely free. Cloudflare's privacy policy says they log nothing that identifies you.
This only works if the block is at the DNS level. If your ISP blocks the IP address itself, changing DNS does nothing.
NextDNS ($1.99/month) for more control
NextDNS costs $1.99 per month and gives you a customizable blocklist. You can block ads, trackers, and malware at the DNS level. It also supports DNS-over-HTTPS and DNS-over-TLS, which encrypts your DNS queries so your ISP cannot see which sites you are asking about. Set it up on your router, and every device on your network gets protected. The downside: it's a subscription, and the free tier limits you to 300,000 queries per month. A heavy user blows through that in about a week.
How IP Blocks Work (and How to Beat Them)
An IP block stops you from connecting to a specific server's numeric address. Your ISP or firewall simply drops any packets going to that IP. Changing DNS won't help. Even if you know the right IP, the traffic never gets through.
Beat it with a VPN
A VPN (Virtual Private Network) encrypts your entire internet traffic and sends it through a server in another location. Your real IP is hidden. The destination server sees the VPN server's IP, not yours. Two solid options:
- Mullvad ($5/month) — No email required. You pay with cash or Bitcoin. They don't log. They support WireGuard, which is faster than OpenVPN. Their apps work on Windows, macOS, Linux, iOS, and Android. $5/month flat, no tiers. This is the one I use.
- ProtonVPN (free tier) — No data cap, but you only get servers in three countries (usually the US, Netherlands, and Japan). Speeds are throttled. It's fine for casual browsing, but not for streaming HD video.
The trade-off: free is slow and limited. $5/month gets you full speed anywhere. If you can afford it, buy Mullvad.
How Deep Packet Inspection Blocks Work (and How to Beat Them)
Deep Packet Inspection (DPI) is the nastiest block. It doesn't just look at the destination IP or DNS query. It inspects the actual content of your data packets. A firewall with DPI can identify VPN or Tor traffic by its handshake pattern and drop it.
China's firewall is famous for this. So are many corporate networks.
Beat it with obfuscated servers
Both OpenVPN and WireGuard support obfuscation. They scramble the packet headers so they look like normal HTTPS traffic.
- Mullvad offers "Bridges" in their app. Enable it, and the VPN connection uses TLS on port 443, exactly like a regular secure website. Your firewall cannot tell the difference.
- ProtonVPN also has a "stealth" protocol in their paid plan ($9.99/month for the Plus tier). It wraps VPN traffic in a second layer of encryption that mimics regular HTTP.
- OpenVPN can use "obfsproxy" on custom ports. You'll need to configure it manually, but guides exist for Windows and Linux.
This is the hardest block to beat. If DPI fails, you move to a more advanced tool.
What About a VPN? Which One Actually Works?
Not all VPNs work equally. Free VPNs are often blocked by streaming services and DPI-heavy firewalls. Here is a quick comparison as of early 2026:
- Mullvad ($5/month) — Works in most countries. Blocks DPI with Bridges. No logs. Fast. No streaming geo-unlock support. Netflix will block it.
- ProtonVPN Plus ($9.99/month) — Works in China sometimes (their stealth protocol is decent). Unlocks Netflix US, UK, and Japan. Includes ad blocking and malware filtering. Five simultaneous connections.
- ExpressVPN ($10.99/month) — Expensive but has "Lightway" obfuscation and dedicated IPs. Best for streaming. Works in China, but they have been known to comply with government takedown requests in the past.
If you need to bypass DPI and unblock Netflix, pay $9.99/month for ProtonVPN Plus. If you just want privacy and a working connection, Mullvad for $5/month is the better value.
The Smart DNS Alternative (and When to Use It)
Smart DNS is not a VPN. It doesn't encrypt your traffic. Instead, it intercepts DNS requests and reroutes only those that need to appear in a different location, like Netflix's domain lookup. Everything else uses your normal ISP connection.
This makes it much faster than a VPN for streaming. Your video data doesn't take a detour through a remote server.
Smart DNS Proxy ($4.95/month)
Sign up at smartdnsproxy.com. They give you a set of DNS server addresses. Change your router's DNS to those, or configure it per device. It unblocks Netflix, BBC iPlayer, Hulu, Disney+, and Amazon Prime Video. You can also use it on a game console or smart TV. Those devices often have no VPN client.
Use it when you only need to watch region-locked streaming content. Don't use it when you need privacy or want to hide your browsing from your ISP.
What to Do When Your ISP Blocks VPNs
Some ISPs block known VPN server IP addresses. You try to connect, and the handshake times out. If that happens, you need a tool that looks nothing like a VPN.
Shadowsocks or V2Ray
These are not VPNs. They are proxying tools that package your traffic inside a standard SOCKS5 or HTTPS tunnel. To a DPI firewall, it looks like normal web traffic.
- Shadowsocks — Lightweight. You run a server on a cheap VPS (DigitalOcean $6/month) and a client on your device. Configure it as a SOCKS5 proxy in your browser. Very hard to detect.
- V2Ray — More advanced. Supports multiple protocols (VMess, VLESS) and can disguise traffic as a CDN request to Cloudflare. Steep learning curve, but nearly impossible to block.
If your ISP blocks all VPNs, Shadowsocks is your best first try. Set it up on a $6 DigitalOcean droplet. Total cost: $6/month. It's more work than a VPN, but it works when everything else fails.
A Quick Decision Tree: Pick Your Method
If you are at home and your ISP blocks a specific site, start with changing DNS to 1.1.1.1 (free). If that fails, try a VPN like Mullvad ($5/month). If your ISP blocks the VPN, try Shadowsocks ($6/month for a VPS). If you just want to watch Netflix from another country, use Smart DNS Proxy ($4.95/month).
If you are on a school or work network and DPI blocks everything, the only reliable method is a SOCKS5 proxy over a non-standard port. V2Ray with WebSocket transport on port 443 is your nuclear option. It costs time to set up, but it will get through any firewall I know of.
Start with the free solution. Pay only if the block persists. The internet is designed to route around damage. Network blocks are just one more obstacle to navigate.
