https://www.ietf.org/mail-archive/web/perpass/current/msg019...
and that is one part of what the gfw does.
google 'how does the gfw work' if you want a broad overview. there was a really in-depth explanation on HN not that long ago. sadly, i'm unable to find it at the moment.
You could probably do it on on 0.1% of the NSA's yearly budget. (Which, after some Googling, turns out to be 10M USD. That's even more than I expected.)
The roaming packages of foreign mobile users also don't get filtered.
If you are a Chinese citizen you most likely will be filtered, I've been to China multiple times companies will usually have a dedicated work station with HK internet the rest will be filtered hotels usually also get internet through HK not sure if this is only for foreign guests or not, on normal internet connecions Wikipedia and the likes were definitely blocked at least as recently as February 2015(last time I visited main land China£
Fun fact #1: That's believed to be why the Chinese government orchestrated the attacks against github in April 2015 using the great firewall to distribute infected javascripts via Baidu. They were trying to force github to take two projects offline that were being used to get around the great firewall and gain access to the unedited NY times online. The Chinese government can't selectively block those projects because github enforces https sitewide.
* Fun fact # 2: An intermediary of China Internet Network Information Center (CNNIC) issued several fake certificates for Google-owned domains in March of 2015. Google untrusted the certificates in Chrome and Android and Mozilla did the same in Firefox.