Technical Analysis of the Geedge Networks Firewall Source Code Leak

In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks' flagship product, the Tiangou Secure Gateway (TSG) firewall. Working across multiple repositories, we successfully build and run a local copy of TSG---revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other resources. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China. This is the first time that the source code of a commercial DPI has been leaked, and our work is the first code analysis of a core firewall component used in national censorship infrastructure. This unprecedented investigation offers insights that can assist circumvention developers and Internet security researchers in further understanding the capabilities and limitations of modern censorship technology.