In China, Meek-azure and Meek-amazon can not be used, the following is the log, how can we use Meek?

Question

2017/2/25 15:31:20.300 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:31:30.600 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:31:30.600 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:31:30.600 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:31:30.600 [NOTICE] Opening Socks listener on 127.0.0.1:9150 
2017/2/25 15:31:35.000 [NOTICE] Bootstrapped 5%: Connecting to directory server 
2017/2/25 15:31:35.000 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server 
2017/2/25 15:31:40.000 [WARN] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server. (DONE; DONE; count 1; recommendation warn; host A2C13B7DFCAB1CBF3A884B6EB99A98067AB6EF44 at 0.0.2.0:3) 
2017/2/25 15:31:40.000 [WARN] 1 connections have failed: 
2017/2/25 15:31:40.000 [WARN]  1 connections died in state handshaking (TLS) with SSL state SSLv2/v3 read server hello A in HANDSHAKE 
2017/2/25 15:31:41.700 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 
2017/2/25 15:31:41.700 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:31:41.700 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 
2017/2/25 15:37:46.700 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:37:46.700 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:37:46.700 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:37:46.700 [NOTICE] Opening Socks listener on 127.0.0.1:9150 
2017/2/25 15:38:01.600 [WARN] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server. (DONE; DONE; count 2; recommendation warn; host A2C13B7DFCAB1CBF3A884B6EB99A98067AB6EF44 at 0.0.2.0:3) 
2017/2/25 15:38:01.600 [WARN] 2 connections have failed: 
2017/2/25 15:38:01.600 [WARN]  2 connections died in state handshaking (TLS) with SSL state SSLv2/v3 read server hello A in HANDSHAKE 
2017/2/25 15:38:03.000 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 
2017/2/25 15:38:03.000 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
2017/2/25 15:38:03.000 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 

Answer 1

What do when meek is blocked https://lists.torproject.org/pipermail/tor-talk/2015-January/036410.html

But suppose a censor makes that call, and blocks Google/Amazon/whatever. What then?

The first thing you should try is a different backend. If you use meek-google, try meek-amazon or meek-azure. Maybe your censor has blocked one but not all of them. This is already the case for users in China, where meek-google is blocked because Google is blocked, but the others are not.

You can also try using a different DNS server. The most common way to block a domain name is by DNS poisoning; i.e., the IP address behind the name is accessible, but the local DNS server gives you a false address. Try a public DNS server such as 8.8.8.8. But if that works, be aware that's it's probably only a temporary fix, as censors have historically figured out the alternate-DNS trick pretty fast.

What you really want to do, if the easy things don't work, is choose a different front domain. The "domain fronting" trick is meek's core idea. It lets you talk to one domain while appearing to talk to another. Tor Browser comes with some built-in front domains, but you can also configure your own. The current list of front domains is at

meek 0.0.2.0:2 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com
meek 0.0.2.0:3 url=https://az668014.vo.msecnd.net/ front=ajax.aspnetcdn.com

You can also find it in Browser/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js inside the Tor Browser distribution . These are the default bridge lines you get when you select meek-google, meek-amazon, or meek-azure from the bridge configuration screen. But you can also enter them manually (under "Enter custom bridges"), and then you can change the front domain. I attached a screenshot that shows how.

Let's take a closer look at what this means:

meek 0.0.2.0:1 url=https://meek-reflect.appspot.com/ front=www.google.com

The first part "meek" is the transport name; don't forget that. The address "0.0.2.0:1" is ignored. You can set it to anything (just don't use 0.0.0.X or port 0 because those are used internally by tor). The next part, url=https://meek-reflect.appspot.com/, says where your traffic is really going--to a Tor bridge. You can't change the "url=" part unless you set up your own CDN account. The last part, "front=www.google.com", is the domain that you hide behind--where the censor sees you going. The "front=" part is what you can change.

With meek-amazon, you can use front domains that are on Amazon CloudFront. The default a0.awsstatic.com is one of them, but you can find others with some research. Here's a short list of some *.cloudfront.net domains: http://www.alexa.com/siteinfo/cloudfront.net ("Where do visitors go on cloudfront.net?"). You can use any of them (remember to change the "front=" part, not the "url=" part):

meek 0.0.2.0:2 url=https://d2zfqthxsdq309.cloudfront.net/ front=d1xjir8ff9s1sc.cloudfront.net

A lot of sites use their own domain name (CNAME) that aliases a cloudfront.net domain. If you can find one of them, it will work too.

The situation with meek-azure is similar. The default front domain, ajax.aspnetcdn.com, is used by many web sites to host JavaScript files, so we think it will be hard to block. You can also use subdomains of vo.msecnd.net, which belong to the Azure CDN. You can find some with a web search. This one seems to be related to Microsoft Office:

meek 0.0.2.0:3 url=https://az668014.vo.msecnd.net/ front=officeimg.vo.msecnd.net

It's important to understand that even if you change the front domain, you're not sticking some random person with a bandwidth bill. It's the owner of the "url=" that gets charged, not the owner of the "front=", and the "url=" has to be specially set up to accept meek connections. The "url="s in this email are set up for public use (i.e., they are what's getting paid for in the "Summary of meek's costs" emails I send to tor-dev).

Be aware that you may increase your exposure if you choose an unpopular front domain. If you're the only one using it, a censor may easily see that and block you.