Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

391–400 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#391

Post by ykl »

IshKebab wrote: post #311
ykl wrote: post #298

Earlier quoted context omitted.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

> it's basically not possible to run any kind of outbound VPN connection (even to private servers) from inside of China anymore. Really? Because the paper you linked says they don't block any TLS connections so you can just run a VPN over TLS: > TLS connections start with a TLS Client Hello message, and the first three bytes of this message cause the GFW to exempt the connection from blocking.

Give it a try if you want; it doesn't work. For TLS traffic they track what the connection looks like over time; a TLS connection for normal web traffic versus a VPN connection tunneling through TLS apparently look different enough that they can detect and cut it off.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#392

Post by danielhep »

extraduder_ire wrote: post #352
77pt77 wrote: post #303

Earlier quoted context omitted.

Obfs4proxy and Shapeshifter are an absolute PITA to install. Get your own VPS server (VPS in EU/US with 2GB of ram, 40GB of disk space and TBs/month of traffic go for $10 a year, it's that cheap). Never get anything in the UK and even USA is weird. I'd stick with EU. Install your software (wireguard + obsfuscation or even tailscale with your own DERP server) Another simpler alternative is just `ssh -D port` and use i…

Where are you finding a VPS in the EU for $10/year? Any I've seen are about 5-6 times that much.

Check LowEndTalk and LowEndBox

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#393

Post by dannyobrien »

danielhep wrote: post #392
extraduder_ire wrote: post #352

Earlier quoted context omitted.

Where are you finding a VPS in the EU for $10/year? Any I've seen are about 5-6 times that much.

Check LowEndTalk and LowEndBox

https://lowendtalk.com/

Can recommend. Always a little crazy, always insanely cheap. If it doesn't work out, you can just switch to another provider.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#395

Post by jongjong »

Easy, you can just create any generic Linux Amazon EC2 instance (or just about any cloud provider of your choice; in fact, the smaller the provider, the better) and use it as a SOCKS5 proxy via SSH tunnel with -D flag... Then set one of your browsers (e.g. Firefox) to connect via that proxy.

Indistinguishable from any other server on the internet.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#396

Post by jart »

_verandaguy wrote: post #200
shawa_a_a wrote: post #190

Earlier quoted context omitted.

I've heard of domain fronting, where you host something on a subdomain of a large provider like Azure or Amazon. Is this what you're talking about when you say > - Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). How can one bounce VPN traffic through S3? Or are you just talking about hosting client software, i…

That's generally for distribution, but yeah, it's a form of domain fronting. There are some more niche techniques that are _really_ cool but haven't gained widespread adoption, too, like refractive routing. The logistics of getting that working are particularly challenging since you need a willing partner who'll undermine some of their trustworthiness with some actors to support (what is, normally, to them) your proj…

If I understand correctly, refractive routing basically just gets big trustworthy cloud providers to host the VPNs so that third world governments can't block them without blocking the cloud too. It's an unfortunate solution since tech platforms are international entities that should be neutral. When America asks them to take sides and prevent other countries from implementing their desired policies, America is spending the political capital and trust that tech companies worked hard to earn. It's also really foolish of those countries to just block things outright. They could probably achieve their policy goals simply by slowing down access to VPN endpoints.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#397

Post by kimixa »

eqvinox wrote: post #324
ykl wrote: post #298

Earlier quoted context omitted.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

This is what IPsec TFS is for [ https://datatracker.ietf.org/doc/rfc9347/ ] > the focus in this document is to enhance IP Traffic Flow Security (IP-TFS) by adding Traffic Flow Confidentiality (TFC) to encrypted IP-encapsulated traffic. TFC is provided by obscuring the size and frequency of IP traffic using a fixed-size, constant-send-rate IPsec tunnel (If they block a constant rate stream, that'll hit a whole ton of…

So they'll just block any constant rate stream that isn't containing AV data or a whilelisted streaming service.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#398

Post by wiredpancake »

seany wrote: post #373

Shadowsocks used to be the thing that _really_ worked in CN. Not sure what's current there. AWS ap-southeast-3 should still be up, and isn't in a different partition like CN, govcloud, iso etc. So a VM there and a vpc peer in the US should get you around a lot of stuff.

Shadowsocks isn't a viable method in 2025 it seems. Not by itself apparently. Shadowsocks generates high-entropy noise via packet analysis, which typically is easy to spot out as it looks irregular.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#399

Post by wiredpancake »

teaga wrote: post #191

Launch an EC2 instance in the US region (Ubuntu, open ports 22 and 1194), then connect via SSH and run the OpenVPN install script. Generate the .ovpn profile with the script and download it to your local machine. Finally, import the file into the OpenVPN client and connect to route traffic through the US server.

Doesn't work in China, this is a method for last decades censorship.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#400

Post by bragr »

SahAssar wrote: post #351
mfiro wrote: post #292

Earlier quoted context omitted.

The problem is the countries, which censor Internet and block VPNs, also jam shortwave radio signals.

Could I ask for a source on that and how common it is? Seems like it was used way back in the cold war (and even then not blocked/jammed) and I'd guess that current authoritarian regimes would perhaps not bother considering how few could use it.

Source: trust me bro, but you can find HF jamming pretty easily on Internet connected SDRs, especially near "sensitive" countries.
Post reply on HN