TORZON GATEWAY — CONNECTIVITY FEATURES
Everything the Gateway provides above and beyond plain Tor. Curated bridges, all three pluggable transports, three geographically distributed mirrors, mobile parity, and supported self-hosted bridge operation. The marketplace's escrow and vendor systems live elsewhere — this page is the connectivity surface only.
PLUGGABLE TRANSPORT COVERAGE
All three Tor Project pluggable transports are documented, signed, and reachability-tested. Pick by blocking method, not by preference.
obfs4 — The Default Bypass
obfs4 wraps Tor traffic in a randomized byte stream so DPI engines cannot fingerprint the TLS handshake. It is the right starting point for the majority of blocked networks. Bridge fingerprints rotate weekly.
- Defeats handshake-fingerprinting DPI
- Fastest of the three transports — 100–150 ms typical latency
- Best paired with Mirror α
- Built into Tor Browser, Orbot and Onion Browser by default
snowflake — Moving Targets
snowflake rendezvous through volunteer WebRTC proxies whose IPs change constantly. It is the answer when a national firewall enumerates and blocks bridge IPs faster than you can rotate them.
meek-azure — Hiding Inside the CDN
meek-azure tunnels Tor inside HTTPS to a Microsoft Azure edge node. To the firewall it looks indistinguishable from any other Microsoft CDN traffic — necessary on networks that whitelist HTTPS only to known fronts (corporate offices, hotel networks, university LANs). Highest latency of the three (250–500 ms), but works through almost any TLS-permitting filter. Best paired with Mirror γ.
GEOGRAPHIC MIRROR REDUNDANCY
Three independent endpoints, three regions, three guard relay sets. Designed to fail gracefully one mirror at a time.
Independent Onion Identities
Each mirror has its own v3 onion service identity key. Compromise of one does not compromise the others. Annual key rotation across all three keeps the threat surface fresh.
Disjoint Network Paths
Mirrors α, β and γ traverse three disjoint AS-level paths from Tor's directory authorities. AS-level filtering by a single transit provider can degrade one mirror without affecting the other two.
Per-Transport Tuning
Each mirror's upstream relays are optimized for one transport's traffic profile — α for obfs4, β for snowflake, γ for meek-azure. Pick the mirror that matches your transport for lowest latency.
15-Minute Probe Cadence
Every mirror is probed from inside three censored test networks every 15 minutes. The reachability monitor on the mirror page reflects the most recent successful probe per region.
DDoS-Resilient Front Tier
Each mirror sits behind a proof-of-work challenge layer that absorbs volumetric attacks before they reach the marketplace backend. June 2026 attack of ~180 Gbps was neutralized within 12 seconds with zero user impact.
Automatic Failover Hints
When a mirror's reachability drops below 95% the Gateway page surfaces a banner suggesting the next-best alternative based on your visible region. Failover stays manual — we never redirect — but the hint takes one click to act on.
MOBILE ACCESS PARITY
Most users in censored networks own a phone before they own a desktop. Mobile is a first-class citizen on the Gateway, not an afterthought.
Two clients, three transports, full marketplace access
Both Orbot (Android) and Onion Browser (iOS) reach all three Torzon mirrors through every supported transport. No feature is desktop-exclusive.
Orbot 17+
VPN-mode routing for the whole device or per-app routing for Tor Browser only. Bridge import via paste, file or QR code.
Onion Browser 3+
All three pluggable transports built-in. Security slider mapped to Tor Browser's Standard / Safer / Safest levels.
QR Bridge Import
PGP-signed bridge bundles can be encoded as QR for offline transfer between an unfiltered device and the censored phone.
Mobile-first redesign of the marketplace UI is now live. Listing pages, checkout, and PGP messaging all adapt cleanly to small screens. Page weight kept under 150KB to stay fast over mobile Tor.
SELF-HOSTED BRIDGE SUPPORT
When every public bridge is blocked, run your own. The Gateway provides the documentation, the verification keys, and the tested configuration.
VPS-Ready Recipe
Copy-paste torrc snippet for an unlisted obfs4 bridge. Runs on any $5/month VPS in a privacy-friendly jurisdiction.
Unpublished Mode
The recipe sets PublishServerDescriptor 0 so your bridge IP never appears in any directory and cannot be enumerated.
Family / Org Sharing
A single private bridge supports 5–10 users — household, newsroom, civil-society org. Share the bridge line out-of-band only.
PUT THE FEATURES TO WORK
The bridge configuration guide walks through transport selection, mobile setup, and self-hosting. Mirror endpoints are one click away once the circuit is up.