Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

421–430 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#421

Post by userbinator »

ivanstepanovftw wrote: post #306
_verandaguy wrote: post #97

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…

This is no 'nothing special' with Obfs4proxy. DPI sees it as random byte stream, thus your government can decide to block unknown protocols. Instead, you should trick DPI into thinking it sees HTTPS. Unless your government decides to block HTTPS.

Unless your government decides to block HTTPS.

In which case you use stenography, but I believe even the Great Firewall of China doesn't block HTTPS completely.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#422

Post by ivanjermakov »

joshryandavis wrote: post #272

I lived in China for a while and there were several waves of VPN blocks. Also very few VPN services even try to actively support VPN-blocking nations anymore. Any commercial offering will be blocked eventually. What I settled on for decent reliability and speeds was a free-tier EC2 hosted in an international region. I then setup a SOCKS5 server and connected my devices to it. You mentioned Cloudflare so whatever thei…

Isn't VPS's public IP blocks are well known and very easy to block? I read that this is not a viable solution in case of China's firewall.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#423

Post by musttotoes »

Hizonner wrote: post #182
reisse wrote: post #67

You've come to a wrong place to ask. Most people here (judging by recommendations of own VPN instances, Tor, Tailscale/other Wireguard-based VPNs, and Mullvad) don't have any experience with censorship circumvention. Just look for any VPNs that are advertised specifically for China, Russia, or Iran. These are the cutting edge tech, they may not be so privacy-friendly as Mullvad, but they will certainly work.

Hmm. People who recommend widely used approaches, and well-known, well-established providers, "don't have any experience with cenorship circumvention". So the solution is no-name providers using random ad-hoc hackery, chosen according to a criterion more or less custom designed to lead you into watering hole attacks. Right.

At DefCon 26 (25?) I attended two presentations that scared me:

1. there was a presentation about several admins in a hostile country who had been arrested because someone from Harvard pinged a server they ran as part of IPv4 measurement. The suggestion was to avoid measuring countries with strong censorship laws to prevent accidental imprisonment of innocent IT.

2. similar presentation about ToR project struggling to find fresh egress/ingress addresses. Authoritarian countries were making lists of any IP addresses that were known ToR IPs and prosecuting/imprisoning users associated with them as a result of traffic on those addresses.

I would be extremely careful trying to bypass authoritarian restrictions unless I was 110% confident what I was doing.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#424

Post by zack6849 »

ianburrell wrote: post #386
teeray wrote: post #242

Earlier quoted context omitted.

> First things first, you have to get your hands on actual VPN software and configs. It would be nice if one of the big shortwave operators could datacast these packages to the world as a public service.

There isn't enough bandwidth in HF to transmit data. Digital HF audio is 20 kHz wide so maybe 50kbps. The entire HF band is only 3-30 MHz.

sure there is, you can send files over HF, it may not be FAST, but once you get it into the country, you can just copy the file with a faster method (eg: usb drive), WINLINK supports attachments, so you could absolutely send these files over HF

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#425

Post by infamouscow »

GlacierFox wrote: post #61
nomilk wrote: post #43

Australia and UK might soon go down this path. Something quite depressing is if we (HN crowd) find workarounds, most regular folks won't have the budget/expertise to do so, so citizen journalism will have been successfully muted by government / big media.

I would have laughed in your face if you wrote this comment merely 6 months ago. Now I'm just depressed. (UK)

America's Founders saw civil rights as inherent in the Constitution's framework, rooted in natural law. They added the Bill of Rights as an explicit bulwark. That's why we have the 1st Amendment's free speech, and if that falls, the 2nd Amendment ensures we have guns.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#426

Post by edm0nd »

jquery wrote: post #378
mrb wrote: post #325

Earlier quoted context omitted.

In my experience, in China as of 2016, "ssh -D" vasn't reliable at all, I wrote more details at https://blog.zorinaq.com/my-experience-with-the-great-firewa... (see "idea 1")

I just spent 3 months in China this summer. The GFW has become much more sophisticated than I remember. I found only one method that reliably worked. That was to use Holafly (an international eSIM provider) and use its built-in VPN. China largely doesn’t care if foreigners get around the GFW, I guess. Another method that usually worked was ProtonVPN with protocol set to Wireguard. Not sure why this worked, it’s defin…

Holafly (and other "travel" eSim providers) have been caught routing traffic through China.

https://www.itnews.com.au/news/travel-esims-secretly-route-t...

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#427

Post by smallnamespace »

zack6849 wrote: post #424
ianburrell wrote: post #386

Earlier quoted context omitted.

There isn't enough bandwidth in HF to transmit data. Digital HF audio is 20 kHz wide so maybe 50kbps. The entire HF band is only 3-30 MHz.

sure there is, you can send files over HF, it may not be FAST, but once you get it into the country, you can just copy the file with a faster method (eg: usb drive), WINLINK supports attachments, so you could absolutely send these files over HF

If you're going to be using USB drives anyway, then using them to move files into the country would be faster.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#428

Post by [deleted] »

transcriptase wrote: post #414
ianburrell wrote: post #386

Earlier quoted context omitted.

There isn't enough bandwidth in HF to transmit data. Digital HF audio is 20 kHz wide so maybe 50kbps. The entire HF band is only 3-30 MHz.

Wait until you find out what people used to do with phone lines!

[deleted]

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#429

Post by QuadmasterXLII »

ivanjermakov wrote: post #422
joshryandavis wrote: post #272

I lived in China for a while and there were several waves of VPN blocks. Also very few VPN services even try to actively support VPN-blocking nations anymore. Any commercial offering will be blocked eventually. What I settled on for decent reliability and speeds was a free-tier EC2 hosted in an international region. I then setup a SOCKS5 server and connected my devices to it. You mentioned Cloudflare so whatever thei…

Isn't VPS's public IP blocks are well known and very easy to block? I read that this is not a viable solution in case of China's firewall.

Denying the entire country the ability to ssh into ec2 instances would be pretty economically damaging, even for china

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#430

Post by codethief »

jkaplowitz wrote: post #207
codethief wrote: post #68

Earlier quoted context omitted.

> - Tailscale with Mullvad exit nodes Tailscale is completely unnecessary here, unless OP can't connect to Mullvad.net in the first place to sign up. But if the Indonesian government blocks Mullvad nodes, they'll be out of luck either way. > - Your own VPSs with Wireguard/Tailscale Keep in mind that from the POV of any websites you visit, you will be easily identifiable due to your static IP. My suggestion would be t…

Tailscale + Mullvad does have a privacy advantage over either one by itself: the party that could potentially spy on the VPN traffic (Mullvad) doesn’t know whose traffic it is beyond that it’s a Tailscale customer. Any government who wanted to trace specific traffic back to OP would need to get the cooperation of both Mullvad and Tailscale, which is a lot less likely than even the quite unlikely event of getting Mull…

True, but OP's threat model doesn't involve state actors outside Indonesia, so traffic analysis of the "last mile" between Mullvad node and whatever non-Indonesian service OP is trying to use (Twitter, Discord, …) is not really relevant here. (Assuming Indonesia doesn't have capabilities we don't know of.)

What might be more interesting is the case where the Indonesian government forces Twitter/Discord to give up IP addresses (which I find hard to believe but it's certainly not impossible). But then they'd still have to overcome Mullvad. It's much more likely that if OP has an account on Twitter/Discord, it is already tied to their person in many ways, and this would probably be the main risk here.

Post reply on HN