Earlier quoted context omitted.
What's stopping them from just blocking them all and continuing to block new ones?
The long tail is very long
It's not that long. You could probably these servers with an automated process.
Ask HN: The government of my country blocked VPN access. What should I use?
471–480 of 775 posts
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#472- Tor. Pros: Reasonably user friendly and easy to get online, strong anonymity, free. Cons: a common target for censorship, not very fast, exit nodes are basically universally distrusted by websites. - Tailscale with Mullvad exit nodes. Pros: little setup but not more than installing and configuring a program, faster than Got, very versatile. Cons: deep packet inspection can probably identify your traffic is using Mu…
> cost is flexible but probably 20-30$ per month minimum in hosting
Like I've written here.
VPS in EU with 2GB RAM, 40 GB disk and >1TB a month of traffic go for $10 PER YEAR!
https://billing.chunkserve.com/cart.php?a=confproduct&i=0
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#473I live in Indonesia, and I don't find any recent news that mention X (formerly Twittwr) and or Discord being blocked by the government. The only relevant news from a quick Google search I can find is about the government threatened to block X due to pornography content in 2024. You can even check for yourself if a domain is blocked by visiting https://trustpositif.komdigi.go.id/ . Also for your unability to access th…
There was a reported outage of cloudflare in Jakarta, while simultaneously people can't access Twitter and Discord. The worst part is that it coincides with the time when people need the information to find a safe route to go home after the protest.
Yes, this is the most likely explanation I can find, not a nationwide blockade.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#474Earlier quoted context omitted.
This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…
> it's basically not possible to run any kind of outbound VPN connection (even to private servers) from inside of China anymore. Really? Because the paper you linked says they don't block any TLS connections so you can just run a VPN over TLS: > TLS connections start with a TLS Client Hello message, and the first three bytes of this message cause the GFW to exempt the connection from blocking.
Worth noting is that OpenVPN’s TCP TLS mode does not work that way. It’s essentially the UDP protocol messages except wrapped into TCP. The initial handshake is not a normal TLS client hello.
Not sure about other SSL VPNs.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#475I would recommend Psiphon [1,2] most (all?) of their code is open source and their main goal is to get around censorship blocks. They do have some crypto side projects but the main product is very solid. [1] https://psiphon.ca/ [2] https://github.com/Psiphon-Inc
State censorship circumvention is exactly what Psiphon is for! So yes, try it.
(Disclaimer: I work there.)
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#476If you can still get SSH access and can establish an account with a VPS provider with endpoints outside your country of origin, https://github.com/StreisandEffect/streisand is a little long in the tooth but may still be viable.
Tunneling via SSH (ssh -D) is super easy to detect. The government doesn't need any sophisticated analysis to tell SSH connections for tunneling from SSH connections where a human is typing into a terminal. Countries like China have blocked SSH-based tunneling for years. It can also block sessions based on packet sizes: a typical web browsing session involves a short HTTP request and a long HTTP response, during whic…
You could just run links or some text-based browser on the other side.
Perhaps you could also write a script that would mimic typing over the link.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#477Earlier quoted context omitted.
When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.
Which is ridiculous because OpenVPN is trivial to identify, even when over TCP since it's different from "regular" HTTPS/SSL traffic. Why they chose this I have no idea. You can even port share. 443 -> Web server for HTTPS traffic 443 -> OpenVPN for OpenVPN traffic Still trivial to identify and not uncommon for even public WiFi to do so. Since I changed to tailscale+headscale with my own derp server all these issues…
It’s basically the same as the UDP mode, except wrapped into TCP. Presumably because that’s simpler than redesigning it from the ground up for TCP.
So the handshake and such will not look like a normal TLS handshake.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#478Earlier quoted context omitted.
This is no 'nothing special' with Obfs4proxy. DPI sees it as random byte stream, thus your government can decide to block unknown protocols. Instead, you should trick DPI into thinking it sees HTTPS. Unless your government decides to block HTTPS.
> your government can decide to block unknown protocols Has any government ever done that? Seems like it would just break everything (because the world is full of devices that use custom protocols!) at great computational expense.
China blocked https last week:
https://www.tomshardware.com/tech-industry/cyber-security/ch...
Discussion: https://news.ycombinator.com/item?id=44958621
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#479Earlier quoted context omitted.
In my experience, in China as of 2016, "ssh -D" vasn't reliable at all, I wrote more details at https://blog.zorinaq.com/my-experience-with-the-great-firewa... (see "idea 1")
I just spent 3 months in China this summer. The GFW has become much more sophisticated than I remember. I found only one method that reliably worked. That was to use Holafly (an international eSIM provider) and use its built-in VPN. China largely doesn’t care if foreigners get around the GFW, I guess. Another method that usually worked was ProtonVPN with protocol set to Wireguard. Not sure why this worked, it’s defin…
Exclusively use Shadowsocks here in the mainland. Was surprised to see Ngrok to work as well, but prolly not very long/reliable.
Re: Ask HN: The government of my country blocked VPN access. What should I use?
#480IMO, the safest route for an individual with tech competency is to setup a small instance server in the cloud outside your country and use ssh port forwarding and a proxy to get at information you want. For an example of a proxy service https://www.digitalocean.com/community/tutorials/how-to-set-... That will give you a hard to snoop proxy service that should completely circumvent a government blockaid (they likely a…
Advanced enough censors (who have DPI) do block or slow down ssh, e.g.: https://serverfault.com/questions/1122015/ssh-blockedfor-for...
That's a pretty strict censorship that basically locks your digital infrastructure into your country.