Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

321–330 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#321

Post by sebastiennight »

refulgentis wrote: post #155
tomaskafka wrote: post #126

Earlier quoted context omitted.

> Just look for any VPNs that are advertised specifically for China, Russia, or Iran. If I was working for a secret service for these countries, I would set up many "VPNs that are advertised specifically for x" as honeypots to gather data about any dissidents.

Mr. Kafka, suspicion is healthy. However, abstraction provides no way forward when faced with practicalities instead of theory. Creates a Kafka-esque situation - anything suitable is by definition unsuitable. Better to focus on practical technical advice.

I think you might want to read about the Anom phone [0], supposedly encrypting messages for drug dealers to avoid law enforcement, which was actually sold by... the FBI.

[0]: https://www.inc.com/jennifer-conrad/the-fbi-created-its-own-...

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#322

Post by bekicot »

joshryandavis wrote: post #272

I lived in China for a while and there were several waves of VPN blocks. Also very few VPN services even try to actively support VPN-blocking nations anymore. Any commercial offering will be blocked eventually. What I settled on for decent reliability and speeds was a free-tier EC2 hosted in an international region. I then setup a SOCKS5 server and connected my devices to it. You mentioned Cloudflare so whatever thei…

GitHub was briefly blocked a couple of years ago in Indonesia. SSH was also blocked briefly by one of the largest mobile providers.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#323

Post by wulfstan »

ykl wrote: post #298
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

That is impressive. Beyond bonkers, but impressive.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#324

Post by eqvinox »

ykl wrote: post #298
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

This is what IPsec TFS is for [https://datatracker.ietf.org/doc/rfc9347/]

> the focus in this document is to enhance IP Traffic Flow Security (IP-TFS) by adding Traffic Flow Confidentiality (TFC) to encrypted IP-encapsulated traffic. TFC is provided by obscuring the size and frequency of IP traffic using a fixed-size, constant-send-rate IPsec tunnel

(If they block a constant rate stream, that'll hit a whole ton of audio/video streaming setups)

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#325

Post by mrb »

77pt77 wrote: post #303
_verandaguy wrote: post #97

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…

Obfs4proxy and Shapeshifter are an absolute PITA to install. Get your own VPS server (VPS in EU/US with 2GB of ram, 40GB of disk space and TBs/month of traffic go for $10 a year, it's that cheap). Never get anything in the UK and even USA is weird. I'd stick with EU. Install your software (wireguard + obsfuscation or even tailscale with your own DERP server) Another simpler alternative is just `ssh -D port` and use i…

In my experience, in China as of 2016, "ssh -D" vasn't reliable at all, I wrote more details at https://blog.zorinaq.com/my-experience-with-the-great-firewa... (see "idea 1")

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#326

Post by lifeisstillgood »

I’m not sure this is the right conversation right now, but is this thread heading towards “how do we make totalitarian governments become liberal democracies?”

It’s a nice technical question on how to run a VPN but the ultimate goal is not the best technical solution but the ability to avoid detection by the state. And that’s not a technical problem but an opsec one

If someone is participating in online discussions (discord and twitter) to spread local news - then it’s hard to know who is who, and who to trust - and that’s kind of the why Arab spring did not spring “hey wear a red carnation and meet me by the corner” can become a death sentence

The answer to opsec is avoid all digital comms - but at this point you are seriously into “regieme change”, or just as Eastern Europe did, keep your heads down for forty years and hope those who leave you economically behind will half bankrupt them selves bringing you back.

I think in the end, a thriving middle class with a sufficient amount of land reform, wealth taxes which can over a generation push for liberalisation sounds a good idea.

Our job in the very lucky liberal West is to keep what our forefathers won, and then push it further to show why our values are worth the sacrifice in copying

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#327

Post by akho »

atmosx wrote: post #192
doix wrote: post #24

I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governments just block well known VPN providers and a small individual server is fine. It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use.

Cloak + wireguard should work fine on the server side. The problem is that I didn't find any clients for Android and I doubt there are clients for iOs that can (a) open a cloak tunnel and then (b) allow wireguard to connect to localhost...

AmneziaWG is obfuscated, wireguard-based, and has clients for whatever.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#328

Post by incrediblesulk »

shawa_a_a wrote: post #190
_verandaguy wrote: post #175

Earlier quoted context omitted.

A country can and absolutely will block known VPN ingress points. There are two tricks that we can use to circumvent this: - Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). Bonus points if you can leverage something like ECH (ex-ESNI) to make it harder to identify a single bucket or subdomain. - Keep spawning…

I've heard of domain fronting, where you host something on a subdomain of a large provider like Azure or Amazon. Is this what you're talking about when you say > - Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). How can one bounce VPN traffic through S3? Or are you just talking about hosting client software, i…

I thought a lot of the domain-fronting approaches have largely been closed from policy changes at major CDNs (e.g. https://techcommunity.microsoft.com/blog/azurenetworkingblog...) . Or is it still possible through other approaches?

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#329

Post by akho »

dmantis wrote: post #138
doix wrote: post #24

I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governments just block well known VPN providers and a small individual server is fine. It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use.

XRay protocol based VPN worked for me in Uzbekistan when I were travelling there. Wireguard is indeed blocked.

xray is a proxy. They may have needed an actual VPN.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#330

Post by gck1 »

nine_k wrote: post #187

XRay / XTLS-Reality / VLESS work rather fine, and is said to be very hard to detect, even in China. I followed [1] to set up my own proxy, which works pretty fine. More config examples may be helpful, e.g. [2]. [1]: https://cscot.pages.dev/2023/03/02/Xray-REALITY-tutorial/ [2]: https://github.com/XTLS/Xray-examples/blob/main/VLESS-TCP-XT...

Also sing-box [1]. I don't use it for its primary use case of censorship circumvention, but rather for some highly complex routing configurations it supports.

My use case consists of passing some apps on my Android through interface A (e.g. banking apps through my 5G modem), some apps through US residential proxy (for US banks that don't like me visiting from abroad), and all the rest through VPN. And no root required!

It's wild that GFW triggered creation of this and nothing like it existed / exists.

[1]: https://github.com/SagerNet/sing-box

Post reply on HN