Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

311–320 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#311

Post by IshKebab »

ykl wrote: post #298
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

> it's basically not possible to run any kind of outbound VPN connection (even to private servers) from inside of China anymore.

Really? Because the paper you linked says they don't block any TLS connections so you can just run a VPN over TLS:

> TLS connections start with a TLS Client Hello message, and the first three bytes of this message cause the GFW to exempt the connection from blocking.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#313

Post by 77pt77 »

ykl wrote: post #298
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

> it's basically not possible to run any kind of output VPN connection (even to private servers) from inside of China anymore.

What if you run your own HTTPS server that look semi-legitimate and just encapsulate it in that traffic?

Can they still detect it?

What about a VPS in HK? Is this even doable?

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#314

Post by p_j_w »

RansomStark wrote: post #81
hdgvhicv wrote: post #58

Earlier quoted context omitted.

90% of “citizen journalism” is nothing of the sort. Just like “citizen science” researching vaccines.

Preach comrade! Those citizen journalists with their primary sources, disgusting. Thats nothing but propaganda. Remember it doesnt matter what the video shows, it only matters who showed it to you.

> Remember it doesnt matter what the video shows, it only matters who showed it to you.

Both matter.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#315

Post by RajT88 »

Somewhat dated read here:

https://www.reddit.com/r/Tailscale/comments/16zfag4/travelin...

Some good ideas, though. There seems to be OSS alternatives for TailScale control servers which would make it harder to block - I'd go that route. The top recommendation boils down to, "Set up several different methods, and one will always work".

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#316

Post by tracker1 »

ykl wrote: post #298
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

Assuming they don't MITM SSH, you should still be able to use something like wireguard over an SSH tunnel. At least I would think.. it's all SSH traffic as far as any DPI listener is concerned, you'd of course need to ensure the connection signature through another vector though.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#317

Post by redleader55 »

77pt77 wrote: post #307
redleader55 wrote: post #297

Earlier quoted context omitted.

The VM instance is good for setting up a VPN tunnel, but it's not good in terms of bandwidth if it's hosted in. Because of DPI capacity, China has a very limited amount of "real internet" bandwidth. A more capable setup is to have one VM on each side of the firewall on an hosting service with peering between inside and outside - Aliyun (Alibaba Cloud) is an example. The "inside" VM could be just "socat UDP4-RECVFROM:…

How easy is it to get a VPS in China. Could HK work?

HK "outside" the firewall, for now. It's where you would place the outside VM.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#318

Post by 77pt77 »

ailun wrote: post #265
reisse wrote: post #67

You've come to a wrong place to ask. Most people here (judging by recommendations of own VPN instances, Tor, Tailscale/other Wireguard-based VPNs, and Mullvad) don't have any experience with censorship circumvention. Just look for any VPNs that are advertised specifically for China, Russia, or Iran. These are the cutting edge tech, they may not be so privacy-friendly as Mullvad, but they will certainly work.

Mullvad worked okay in China in June for me. I imagine it will be better in Indonesia with their less sophisticated blocking.

This makes no sense.

On the one hand they do DPI with ML.

On the other hand a major player is open!

Something is not right here...

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#320

Post by leshenka »

esosac wrote: post #118
reisse wrote: post #67

You've come to a wrong place to ask. Most people here (judging by recommendations of own VPN instances, Tor, Tailscale/other Wireguard-based VPNs, and Mullvad) don't have any experience with censorship circumvention. Just look for any VPNs that are advertised specifically for China, Russia, or Iran. These are the cutting edge tech, they may not be so privacy-friendly as Mullvad, but they will certainly work.

what's wrong with those solutions?

Wrong threat model. Solutions like mullvad/proton focus on privacy not breaking the blockade. They have well known entry points and therefore easily blocked. You can play cat and mouse game switching servers faster than censorship agency blocks them (e.g. Telegram vs Roskomnadzor circa 2018 [1]) but that gets expensive and not really focus of these companies.

What you need is open protocols and hundreds of thousands of small servers only known to their owners and their family/friends

1: https://archive.is/sxiha

Post reply on HN