When Tor Exits Are Blocked: Bridges, Snowflake, VPN
Snowflake bootstrapped in 8.4 and 14.4 seconds tonight and cost 18–34 KB/s — but its exits were ordinary Tor relays, so bridges never fix exit-IP blocking.
"Tor is blocked" is four different failures (Is Tor safe for swaps?)
When someone says Tor is blocked, they usually mean one of four things, and the fix differs for each. The local network stops you reaching the directory authorities and guards, so the client never reaches one hundred percent. Deep packet inspection lets a handshake start and then strangles it. The website you want refuses Tor exit addresses. Or the exit you land on sits in a country the site geo-fences. Bridges — obfs4, Snowflake, meek — address the first two only. Everything below was measured on one machine, a Hong Kong VPS in AS138997, between 18:00 and 18:20 UTC on 30 October 2026, with Tor 0.4.9.11 and snowflake-client 2.5.1. (Is Tor safe for swaps?)
Three paths, measured side by side
Clearnet first, as a floor: source address 64.118.134.27, AS138997 Eons Data; the blog page answered with a time to first byte of 0.06 to 0.71 seconds, and a one-megabyte download took 2.46 to 2.79 seconds. Direct Tor, no bridges, cold start from the system service: bootstrapping took 42.9 seconds, the circuit landed on 45.9.156.238 in Bulgaria (AS211619 MAXKO) and stayed sticky across all four samples; an earlier session used 171.25.193.35 in Sweden (AS198093, DFRI). Time to first byte to the same page: 1.67 to 2.17 seconds. One megabyte: 8.7 to 9.9 seconds, which is 104 to 120 KB/s. Snowflake: exits were 147.90.235.227 (US, AS27284 Fourplex Telecom), 192.42.116.112 and 192.42.116.44 (NL, AS215125 Church of Cyberology), 185.150.28.13 (CH, AS59891 FSIT AG), plus 89.127.232.224 (IS, AS44925 1984 ehf) and 185.243.218.226 (NO, AS56655 Gigahost) on an earlier circuit. Time to first byte: 3.13 to 4.18 seconds. One megabyte: 30.6 seconds and 57.0 seconds, so 18 to 34 KB/s. (Is Tor safe for swaps?)
A bridge changes the doorway, never the exit
Look at that Snowflake exit list again. Every hop it handed us was an ordinary Tor exit relay in a hosting ASN, and every one is published in the public consensus. That is by design: Snowflake obfuscates how you get into the network, not where you come out. Your traffic reaches a volunteer's browser over WebRTC, that browser relays it into Tor, and a normal exit relay finishes the journey. The practical consequence is the part people get wrong. If a site blocks Tor by refusing exit addresses, Snowflake does not help at all; it may even hurt, because you paid thirty seconds of transfer time to arrive at the same sort of address. What Snowflake does buy is that your ISP or hotel network sees WebRTC to a residential peer instead of a TLS connection to a known guard. (Is Tor safe for swaps?)
The config that actually bootstrapped
Six lines and nothing exotic: a SocksPort on 9060, a DataDirectory, UseBridges 1, a ClientTransportPlugin line running /usr/bin/snowflake-client with the broker URL and a STUN server, and one Bridge line — snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72, where 192.0.2.3 is a documentation placeholder the transport ignores. Two cold starts gave 14.4 seconds and 8.4 seconds. The log shows where the slower one went: 0.4 seconds to publish an offer to the broker, 2 seconds to obtain a rendezvous peer, 4 seconds for the transport to connect, 14 percent at 4.7 seconds, 50 percent at 10.4, 100 percent at 14.4. The direct path on the same server needed 42.9 seconds, most of it directory work, which is why an entry that bootstraps in ten seconds feels like a different product. (how Monero fees work)
What the extra hop costs
The API is where Snowflake surprised me. Ten sequential 100 USDT to XMR quote requests through Snowflake returned 200 ten times, mean 1.75 seconds, range 1.21 to 2.22. Through direct Tor the same ten requests also returned 200 ten times, mean 2.34 seconds, range 2.02 to 2.73. For small JSON the circuit is not the bottleneck at all. Bulk is: 30.6 and 57.0 seconds per megabyte against 8.7 to 9.9 on direct Tor. A swap page is about 141 KB of HTML, so at 18 to 34 KB/s expect four to eight seconds of transfer on top of the handshake — fine for one visit, miserable if you reload four times because nothing seemed to happen. (Is Tor safe for swaps?)
The real answer to an exit block is to skip the exit
If the block sits at the destination, the only robust fix is a path with no exit node. VeilSwap publishes an onion mirror at 4jyoxqdyx7dh3xfjctihpld7fgliowhimajfszcgypxash5rjqhas3yd.onion. Measured tonight it returned 200 with 69,210 bytes, 3.52 and 8.30 seconds to first byte over direct Tor, and 5.20 seconds end to end through the Snowflake circuit. Onion services are reached inside the network, so no exit relay ever touches the request and no exit-IP list can match it. The trade is latency: a first visit must build a rendezvous circuit, and a page that is already slow is slower. (Is Tor safe for swaps?)
If you add a VPN, the order decides what you hide
Two chains, two different promises, and neither one is anonymity. VPN then Tor: your ISP sees a VPN, the VPN sees that you use Tor, and the exit is still a Tor exit, so a site that blocks exits still blocks you. Tor then VPN: the site sees the VPN's address, which is usually a datacenter range that appears on the same commercial blocklists the site already bought, while the VPN now sees your destination in clear text and your entry guard sees your real address — a correlation pair you created yourself. A VPN alone is one static IP with a billing identity attached to it. I did not test VPN chains here, because I have no account to test with, and I would rather write that sentence than invent a latency figure. (Is Tor safe for swaps?)
obfs4 and meek, honestly
obfs4 needs bridge lines, and getting them now means solving a CAPTCHA on bridges.torproject.org, asking @GetBridgesBot on Telegram, or emailing [email protected] from a Gmail or Riseup account. Tor Browser ships a few built-in obfs4 bridges, which is the fastest route if you already have the browser. Tonight I could not test obfs4: the moat request endpoint returned 404 and the builtin endpoint returned zero bridges, so this article carries Snowflake numbers only. obfs4 makes a connection look like random bytes rather than TLS, which is what you want against DPI that fingerprints handshakes; Snowflake is stronger when the block is IP-based, because its rendezvous addresses rotate. meek still depends on CDN fronting, which most large CDNs have closed, so treat it as a last resort rather than a plan. (Is Tor safe for swaps?)
Doing the swap over any of these paths
Three operational details decide whether the swap succeeds. The quote lives for 120 seconds — in tonight's test a quote issued at 18:11:53 expired at 18:13:53 — so do not fetch a quote and then go hunting for your wallet. The order window is 30 minutes from creation, and at 18 to 34 KB/s every reload costs real time; open the order page once and leave it. The order URL is the only handle on the order, because there is no account and no email, so a closed tab is a lost order. Keep one circuit per purpose: Tor isolates per SocksPort and per authentication, not per tab, so browsing on clearnet in the same browser does not give you a fresh circuit. And never paste a seed phrase into a page that asked you to verify it; no leg of a swap needs one. (seed backup guide)
Five mistakes worth naming
Believing a bridge fixes exit blocking, which tonight's exit list disproves. Running Snowflake on a network that drops UDP, where obfs4 is the better bet. Setting ExitNodes to one country and expecting it to hold without StrictNodes 1, and without accepting that a small country set means fewer circuits. Assuming every request shares one circuit. And treating any of this as anonymity: Tor hides your address from the site, not the fact that a specific amount moved between two addresses at a specific minute. (Is Tor safe for swaps?)
The numbers, as of writing
At 18:13 UTC on 30 October 2026 the site quoted 100 USDT-TRC20 at 0.14756749 XMR, which implies 677.66 USDT per XMR; 1,000 at 1.6374011 (610.72); 0.05 BTC at 6.38307053 XMR (127.66141 XMR per BTC); and one XMR out at 576.964076 USDT. Those gaps are the fixed per-order deduction, not a Tor surcharge — nothing in the route knows or cares that you arrived through a bridge. The catalog at the same moment held 514 asset and network pairs across 75 networks, 414 distinct tickers, 60 stablecoins and 7 assets that need a tag. Live quotes will differ, as always; the page is the authority. (Is Tor safe for swaps?)
The short version
Bridges fix the entrance. Snowflake bootstrapped in 8.4 and 14.4 seconds and cost 18 to 34 KB/s, with small API calls unaffected. It does not change the exit, so it cannot defeat exit-IP blocking; an onion mirror can, because it has no exit at all. Measure your own path before a large swap, keep the 120-second quote and the 30-minute window in mind, and treat a VPN chain as trading one observer for another.