Hi, not well educated on the details of VPNs and network security so this may be a basic question, but - VPNs are used regularly by corporates to enable secure intranet access to people offsite, etc - surely completely blocking VPNs or detecting and punishing VPN users is severely detrimental to business and not something countries would want to do carte blanche? How does this work?
Ask HN: The government of my country blocked VPN access. What should I use?
461–470 of 775 posts
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#462Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…
Obfs4proxy and Shapeshifter are an absolute PITA to install. Get your own VPS server (VPS in EU/US with 2GB of ram, 40GB of disk space and TBs/month of traffic go for $10 a year, it's that cheap). Never get anything in the UK and even USA is weird. I'd stick with EU. Install your software (wireguard + obsfuscation or even tailscale with your own DERP server) Another simpler alternative is just `ssh -D port` and use i…
Which countries you need to avoid depends on your threat model. For example, there is need to avoid the USA if all you're trying to do is bypass the Chinese firewall. There might even be a legitimate use case for pretending to have a UK IP address.
Since OP is in Southeast Asia, a VPS in JP or SG will probably hit a decent balance between latency and censorship avoidance.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#463Re: Ask HN: The government of my country blocked VPN access. What should I use?
#464[dead]
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#465Earlier quoted context omitted.
This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…
So there's a disconnect between what you're saying and what others and myself have experienced in China even recently. You appear to be saying that it's not possible to use a VPN to bypass the GFW, but I apologise if I have misunderstood. The comments have multiple examples of people successfully bypassing the firewall. I personally just used Mullvad with wireguard + obfuscation (possibly also DAITA) and it just work…
It's possible it worked in the past and doesn't work any more.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#466I also want to add here because a lot of people either mention Tor as a succesful solution, or mention why Tor is not a solution but state completely wrong reasons. And I have a good soapbox to stand once in a while. Number one reason why Tor is dead is Cloudflare. Let me digress here. In my opinion, Cloudflare does a lot more censoring than all state actors combined, because they singlehandedly decide if the IP you…
I understand where you are coming from but there’s a flip side to this.
Cloudflare obfuscating such a huge segment of origin servers gives a privacy advantage to anyone using a private DNS, since most of the IPs you can be seen connecting to are just…Cloudflare.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#467Earlier quoted context omitted.
50 kb/s x 1000 bits/kb x 3600 s/hr x 24 hr/day x 1 byte/8 bits x 1 MB / 1000000 bytes = 540 MB/day. That's enough to download VPN software and a Linux distribution to run it on in a day. If you've already got a Linux system, the Debian openvpn package is under 1 MB and at 50 kb/s would take under 3 minutes to download. I don't know if openvpn in particular is suitable for people who are trying to evade their governme…
You never used dialup did you?
zmodem to the rescue!
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#468I’m not sure this is the right conversation right now, but is this thread heading towards “how do we make totalitarian governments become liberal democracies?” It’s a nice technical question on how to run a VPN but the ultimate goal is not the best technical solution but the ability to avoid detection by the state. And that’s not a technical problem but an opsec one If someone is participating in online discussions (…
> Our job in the very lucky liberal West is to keep what our forefathers won, and then push it further to show why our values are worth the sacrifice in copying
It was the liberal West who helped China build the Great Firewall – Cisco, Sun Microsystems, Nortel, Siemens and others.
As long as a lucrative commercial opportunity was there, they seized upon it shoving the liberal values up the orifice where the sun does not shine.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#469Earlier quoted context omitted.
I'm curious. How does a state actor do actual DPI without pushing certs to end user devices?
There are a couple of ways. The main one is called an Eclipse Attack in cyber circles, and it can be done at any entity operating at the ASN layer so long as they can position themselves to relay your traffic. The adversary can invisibly (to victim PoV) modify traffic if they have a cooperating rootPKI cert (anywhere in the ecosystem) that isn't the originating content provider, so long as they recognize the network…
[deleted]
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#470Earlier quoted context omitted.
Obfs4proxy and Shapeshifter are an absolute PITA to install. Get your own VPS server (VPS in EU/US with 2GB of ram, 40GB of disk space and TBs/month of traffic go for $10 a year, it's that cheap). Never get anything in the UK and even USA is weird. I'd stick with EU. Install your software (wireguard + obsfuscation or even tailscale with your own DERP server) Another simpler alternative is just `ssh -D port` and use i…
Where are you finding a VPS in the EU for $10/year? Any I've seen are about 5-6 times that much.
https://billing.chunkserve.com/cart.php?a=confproduct&i=0
https://my.servitro.com/cart.php?a=view
https://manager.ouiheberg.com/cart.php?a=confproduct&i=0
1GB or even 512MB and 10GB of storage is very easy and completely doable to use for a VPN + HTTPS server
Traffic is super cheap nowadays.
Your real issue will be IP reputation.
https://lowendtalk.com/categories/offers
Is a good source.