Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

241–250 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#241

Post by mxie-ca »

gudzpoz wrote: post #212

As someone based in China, it's a bit surprising that techniques used by Chinese people get very few mentions here, while I do think they are quite effective against access blocking, especially after coevolving with GFW for the past decade. While I do hope blocking in Indonesia won't get to GFW level, I will leave this here in case it helps. I found this article [0] summarizing the history of censorship and anti-cens…

Thanks for the link!

Is there any good DoT/DoH DNS resolver that works well in China? I know I can build one myself, but forwarding all DNS requests to my home server in NA slows down all connections...

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#242

Post by teeray »

_verandaguy wrote: post #97

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…

> First things first, you have to get your hands on actual VPN software and configs.

It would be nice if one of the big shortwave operators could datacast these packages to the world as a public service.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#244

Post by logicchains »

hinkley wrote: post #102
reisse wrote: post #67

You've come to a wrong place to ask. Most people here (judging by recommendations of own VPN instances, Tor, Tailscale/other Wireguard-based VPNs, and Mullvad) don't have any experience with censorship circumvention. Just look for any VPNs that are advertised specifically for China, Russia, or Iran. These are the cutting edge tech, they may not be so privacy-friendly as Mullvad, but they will certainly work.

I have a little, maybe enough to be dangerous. SSH won’t be sufficient to avoid all traffic analysis. Everyone can see how much traffic and the pattern of that traffic, which can leak info about the sort of things you’re doing. If you’re worried about ending up on a list, using things that look like VPNs while the VPNs are locked down is likely to do so. Also… your neighbors in Myanmar didn’t do a lockdown during the…

>Also… your neighbors in Myanmar didn’t do a lockdown during the genocide and things got pretty fucking dire as a result

The genocide in Myanmar was incited _by_ the government there; giving it more power to censor it's citizens' communications would have done absolutely nothing to help the people being genocided. Genocides don't just suddenly happen; the vast majority of genocide over the past century (including Indonesian genocides against ethnically Chinese Indonesians) had the support of the state.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#246

Post by cogman10 »

IMO, the safest route for an individual with tech competency is to setup a small instance server in the cloud outside your country and use ssh port forwarding and a proxy to get at information you want.

For an example of a proxy service https://www.digitalocean.com/community/tutorials/how-to-set-...

That will give you a hard to snoop proxy service that should completely circumvent a government blockaid (they likely aren't going to be watching or blocking ssh traffic).

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#247

Post by akho »

more_corn wrote: post #224
akho wrote: post #205

Earlier quoted context omitted.

Wireguard is not censorship-resistant, and most VPN-averse countries block cross-border Wireguard. Why reply a practical question in an area in which you have no experience?

Because Indonesia is new to the game and might still be catching up. They’re probably playing whackamole with the most common public VPN providers and might not be doing deep packet inspection yet. I worked with someone getting traffic out of Hong Kong a year ago and there was a lot trial and error figuring out what was blocked and what was not. Wireguard was one that worked.

They recommend Tailscale in particular. Tailscale control plane and DERPs (which are functionally required on mobile) will be among the first to go.

Outline (shadowsocks-based) and amnezia (obfuscated wg and xray) both offer few-click install on your own VPS, which is easier than setting up headscale or static wg infrastructure, and will last you longer.

Also, you did not answer my "why" question. I'm not sure what question you were answering.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#248

Post by teraflop »

myshoemouth wrote: post #236
_verandaguy wrote: post #97

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…

I'm curious. How does a state actor do actual DPI without pushing certs to end user devices?

The "inspection" part of DPI isn't limited to encrypted payloads. It's straightforward enough to look at application-level protocol headers and identify e.g. a Wireguard or OpenVPN or SSH connection, even if you can't decrypt the payload. That could be used as sufficient grounds to either block the traffic or punish the user.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#249

Post by princevegeta89 »

teekert wrote: post #194
princevegeta89 wrote: post #103

OP, you can rent a VPS from a reputable and cheap provider within the NA region - OVH, Vultr, Linode etc. are decent. Also check out lowendtalk.com Then, setup Tailscale on the server. You can VPN into it and essentially browse the internet as someone from NA.

From some of the comments here I get why you are downvoted. But tbh I would also have gone that route. So are we just inexperienced? I read here indeed that wireguard is very easily blocked. It was at the company I worked for but then I just set port 23 (who uses ftp anyways??). And it worked. But why is this still bad then? Obviously I have 0 real experience with this.

Well, I mean, Tailscale is pretty easy overall. When client apps get blocked, you can literally hook up your router into Tailscale if needed, or you can run a headless version of Tailscale on your home server or the very machine you are on.

It should also be possible to use a tunnel to get around the blocking of WireGuard, for example.

You can then use it as an exit node if needed. It should work in theory, I have never tried this though. I just speak as a very frequent user of Tailscale with a bunch of nodes that are geographically located in different cities around me.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#250

Post by oasisbob »

myshoemouth wrote: post #236
_verandaguy wrote: post #97

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…

I'm curious. How does a state actor do actual DPI without pushing certs to end user devices?

DPI refers to a broad class of products which attempt to find signals and categorize traffic according to a ruleset, either to block it or throttle the speeds, etc.

While access to plaintext is useful, it's not required for other rules which are eg looking at the timing and frequency of packets.

Post reply on HN