Blocked at school or work: what still works

School and office networks are a special case on this site, and the reason is not technical: on a managed device you often cannot reach the settings that would fix the block. System DNS is locked, the extension store is restricted, and installers are blocked by policy.

What is left are fixes the device cannot take away.

Work from the layer you can still reach

The stack runs from resolver to network. Every rung below does its job further down, which is exactly why it is harder to remove - and why the effort, and the visibility, go up.

1. Secure DNS inside the browser. Firefox has DNS over HTTPS as a plain setting in the connection preferences [1], Chrome and Edge offer the same as "secure DNS" with a provider list [2]. It applies to the browser only and ignores the operating system resolver, so a locked system setting does not matter. That clears name-level filtering for the pages you load in that browser - nothing else.

2. A portable tunnel. Tor Browser runs from an unpacked folder without installing [3]; the Psiphon portable build for Windows works the same way [4]. Both are built for exactly this situation. On a Chromebook there is no portable build, so stay on browser DNS there.

3. Mobile data or a hotspot. A phone on its own carrier is outside the school network completely. This is the most dependable route and the most expensive one in data volume - the travel eSIM guide covers the data side if you need it beyond a single session.

Order matters for a second reason: a filter that inspects traffic will throttle a tunnel, while a DNS setting costs nothing to try.

What the network can still see

Being honest about visibility beats a false sense of privacy.

• Plain DNS is readable. The resolver query names the site in clear text unless DoH encrypts it.
• SNI is readable in the TLS handshake on most networks. Encrypted Client Hello closes that, but only where the server supports it and the browser enables it - see the ECH explainer for the state of it.
• A tunnel reveals itself. The traffic volume and the destination port are visible even when the content is not. Deep packet inspection recognises protocol fingerprints; that is what makes obfuscated bridges different from plain WireGuard.
• A proxy certificate on the device means the network can read decrypted content. This is why certificate warnings on managed devices are worth reading instead of clicking away.

The four things that actually go wrong

The filter blocks the DoH provider. Some networks do. Pick a second provider from the browser list; the built-in list exists for that.

The tunnel is throttled to unusability. Deep packet inspection does this to plain WireGuard and OpenVPN. Tor with bridges, Psiphon and connections dressed as ordinary HTTPS traffic survive longer.

The certificate warning. A managed device with a proxy certificate shows warnings for every site once a tunnel changes the path. It is usually the network's certificate, not malware - but check the issuer once before trusting it.

The policy. Using a tunnel can be within the rules or against them. The technical layer cannot settle it; the IT policy page or the people who run the network can.

When it is worth asking instead of fighting

If the site is a work tool that the company needs and blocks anyway, a ticket is faster than a workaround. If it is a personal site you open twice a week, browser DNS is enough and no one will care.

For the general case outside a managed network, the diagnosis ladder is the better starting point - it costs one minute and tells you whether you are even facing the kind of block these fixes can reach. And when the filter is national rather than local, the age-verification and country walls section explains the legal layer behind it. This is information, not legal advice.