Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

401–410 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#401

Post by rglynn »

ykl wrote: post #298
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

So there's a disconnect between what you're saying and what others and myself have experienced in China even recently. You appear to be saying that it's not possible to use a VPN to bypass the GFW, but I apologise if I have misunderstood.

The comments have multiple examples of people successfully bypassing the firewall. I personally just used Mullvad with wireguard + obfuscation (possibly also DAITA) and it just worked. No issues whatsoever.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#403

Post by khaki54 »

tomaskafka wrote: post #126
reisse wrote: post #67

You've come to a wrong place to ask. Most people here (judging by recommendations of own VPN instances, Tor, Tailscale/other Wireguard-based VPNs, and Mullvad) don't have any experience with censorship circumvention. Just look for any VPNs that are advertised specifically for China, Russia, or Iran. These are the cutting edge tech, they may not be so privacy-friendly as Mullvad, but they will certainly work.

> Just look for any VPNs that are advertised specifically for China, Russia, or Iran. If I was working for a secret service for these countries, I would set up many "VPNs that are advertised specifically for x" as honeypots to gather data about any dissidents.

Just run second VPN inside the honeypotted VPN

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#405

Post by conradev »

ivanstepanovftw wrote: post #306
_verandaguy wrote: post #97

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…

This is no 'nothing special' with Obfs4proxy. DPI sees it as random byte stream, thus your government can decide to block unknown protocols. Instead, you should trick DPI into thinking it sees HTTPS. Unless your government decides to block HTTPS.

WebRTC is another great option: https://snowflake.torproject.org

It's used for a lot of legitimate traffic as well, so a bit harder to block.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#406

Post by Marsymars »

SahAssar wrote: post #351
mfiro wrote: post #292

Earlier quoted context omitted.

The problem is the countries, which censor Internet and block VPNs, also jam shortwave radio signals.

Could I ask for a source on that and how common it is? Seems like it was used way back in the cold war (and even then not blocked/jammed) and I'd guess that current authoritarian regimes would perhaps not bother considering how few could use it.

The USSR had an extensive shortwave radio jamming program!

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#408

Post by rl3 »

gnfargbl wrote: post #160
Daishiman wrote: post #120

Earlier quoted context omitted.

It is absolutely self-evident that VPNs are considered high-value targets and that all spy agencies invest a chunk of resources to go after high-value targets.

I would invite you to read again the two claims made, and consider whether your statement actually addresses the veracity of either. To be a little trite: we all agree that chickens like grain, but it does not follow that a majority of grain producers are secretly controlled by a cabal of poultry.

>... but it does not follow that a majority of grain producers are secretly controlled by a cabal of poultry.

That's precisely what someone who's in on it would say.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#409

Post by Marsymars »

eqvinox wrote: post #324
ykl wrote: post #298

Earlier quoted context omitted.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

This is what IPsec TFS is for [ https://datatracker.ietf.org/doc/rfc9347/ ] > the focus in this document is to enhance IP Traffic Flow Security (IP-TFS) by adding Traffic Flow Confidentiality (TFC) to encrypted IP-encapsulated traffic. TFC is provided by obscuring the size and frequency of IP traffic using a fixed-size, constant-send-rate IPsec tunnel (If they block a constant rate stream, that'll hit a whole ton of…

Aren't many/most audio/video streaming services variable bitrate now?

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#410

Post by tamimio »

dongcarl wrote: post #50

Give Obscura a try, we get around internet restrictions by using QUIC as transport, which looks like HTTP/3 and doesn't suffer from TCP-over-TCP meltdown: https://obscura.net/ Technical details: https://obscura.net/blog/bootstrapping-trust/ Let us know what you think! Disclaimer: I'm the creator of Obscura.

Looks good, just one note: btc was never meant for anonymity, if you would add Monero as a payment option that would be great.
Post reply on HN