If I understand correctly, there is no way for them to differentiate traffic using this vs legitimate HTTPS traffic. In other words, if a large, legitimate website was also serving a webtunnel behind their reverse proxy, the censoring regime would have to block all traffic to that domain, legitimate or not.
Doubt it would happen but I'd love to see CloudFlare support this for all their domains. Blocking them is blocking 1/3rd of the internet.
Cloudflare used to support domain fronting but they stopped doing that. Last i heard fastly still did
Welp, not surprised given it's bad for their business. Guess hence the timing of this webtunnel thing - afaik tor was using fastly at least for their snowflake thing.
You can run a webtunnel bridge behind Cloudflare. It also works behind AWS Cloudfront but that's just way too expensive if you don't get a reasonable rate from them like 99% reduction.
Yes they can block the domain if they find out it's used by a webtunnel bridge. Bridges aren't public that's the whole point of bridges. They are basically unlisted relays.