Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

551–560 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#551
post #401
post #298

Earlier quoted context omitted.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

So there's a disconnect between what you're saying and what others and myself have experienced in China even recently. You appear to be saying that it's not possible to use a VPN to bypass the GFW, but I apologise if I have misunderstood. The comments have multiple examples of people successfully bypassing the firewall. I personally just used Mullvad with wireguard + obfuscation (possibly also DAITA) and it just work…

This changes, not only over time, but also from region to region.

A close friend of mine travels to China often, and they use Mullvad because of my recommendation. Last year it worked great for them, but earlier this year they went back to China, and it really didn't work.

What I found most interesting is that they had different results in different places. Apparently, in the business areas of Shanghai and Beijing, were they had meetings and events, they could get Whatsapp and Slack messages; when they went back to the hotel, in a residential area where there were almost no offices or tourists, it didn't. In Chongqing even less stuff worked.

I was very skeptical of this when they told me, but they could replicate this consistently over a couple of weeks. It wasn't related to hotel Wifi (that's a different can of worms), this was on mobile data.

Everything worked when they switched to using https://letsvpn.world, at the recommendation of some chinese colleagues of them.

This was with a basic Mullvad install on iOS and Mac, they're not technical enough to harden their VPN connection further; may be they could've easily obfuscated it more and it would've worked.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#552
VPN services are just someone else's computers. Any cloud provider with a low performance virtual machine can become a VPN gateway using Linux distribution of your choice for around $4.

OpenVPN or WireGuard are my tools of choice. Professionally, I also use OpenVPN's EasyRSA PKI framework for certificates, but you can just generate your keys using any tutorial out there. "OpenVPN Cookbook" ebook from Packt is my go to source. For performance reasons, WireGuard is better.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#553
post #397

Earlier quoted context omitted.

This is what IPsec TFS is for [ https://datatracker.ietf.org/doc/rfc9347/ ] > the focus in this document is to enhance IP Traffic Flow Security (IP-TFS) by adding Traffic Flow Confidentiality (TFC) to encrypted IP-encapsulated traffic. TFC is provided by obscuring the size and frequency of IP traffic using a fixed-size, constant-send-rate IPsec tunnel (If they block a constant rate stream, that'll hit a whole ton of…

So they'll just block any constant rate stream that isn't containing AV data or a whilelisted streaming service.

I don’t think that’s possible. AV data is behind the TLS layer, all the DPI can see is a CBR stream that matches HTTPS signature. Unless it can do a MitM (Kyrgyzstan-style) they can’t really tell anything about the payload content save from what the TLS handshake may expose. Past it, observability stops at packet sizes and timings.

As I understand it, modern DPIs try to fingerprint TLS traffic through feeding data that passed some pattern matching to ML models that try to predict how likely it’s between a genuine commonplace browser and a “normal” webserver (or a video streaming server or game server - whatever they trained it on). And in turn modern obfuscation software tries to match the behavior and be seen exactly as it’s your Chrome user watching some cat videos or something equally innocuous.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#554
post #450

I also want to add here because a lot of people either mention Tor as a succesful solution, or mention why Tor is not a solution but state completely wrong reasons. And I have a good soapbox to stand once in a while. Number one reason why Tor is dead is Cloudflare. Let me digress here. In my opinion, Cloudflare does a lot more censoring than all state actors combined, because they singlehandedly decide if the IP you…

I understand where you are coming from but there’s a flip side to this. Cloudflare obfuscating such a huge segment of origin servers gives a privacy advantage to anyone using a private DNS, since most of the IPs you can be seen connecting to are just…Cloudflare.

It's funny that the original idea for HTTPS was that there should be private communication between clients and service providers, and it somehow got turned on its head and now its just private communication between you and Cloudflare, and they can see all the traffic.

We talk about end to end encryption all the time, but half the web is hosted by a single company with questionable ethics and everyone is like, we trust them! They write technical blog posts!

Even Signal is hosted on Cloudflare...

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#555

Earlier quoted context omitted.

Could I ask for a source on that and how common it is? Seems like it was used way back in the cold war (and even then not blocked/jammed) and I'd guess that current authoritarian regimes would perhaps not bother considering how few could use it.

The USSR had an extensive shortwave radio jamming program!

... to block BBC and Voice of America, RFE and RL.

But they recently switched to a much cheaper and more effective jamming program: Trump [1].

[1] https://apnews.com/article/voa-radio-trump-media-cuts-5f87df...

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#556
post #450

I also want to add here because a lot of people either mention Tor as a succesful solution, or mention why Tor is not a solution but state completely wrong reasons. And I have a good soapbox to stand once in a while. Number one reason why Tor is dead is Cloudflare. Let me digress here. In my opinion, Cloudflare does a lot more censoring than all state actors combined, because they singlehandedly decide if the IP you…

it depends. I myself have some combination of browser extensions which make me a bad guy in Cloudflare opinion. I don't know exactly which one is the culprit because I added a lot of stuff over the years, but I really don't care: if Cloudflare blocks a website, I simply use another one. The good half of the internet will get my traffic.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#557
post #520

Earlier quoted context omitted.

Wireguard ships with the Linux kernel so you only need to receive ~60 bytes of configuration information.

The user-facing software is not included in the kernel, but you need that to configure wireguard.

Is that true? I thought wg-quick etc were just convenience functions and that it's relatively trivial to use iproute2 to configure a VPN link

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#558
post #24

I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governments just block well known VPN providers and a small individual server is fine. It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use.

Is it the protocol that's blocked as a result of DPI, or just the default 51820 UDP port that's blocked? If the latter, just changing your Wireguard server's port might work.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#559
post #558
post #24

I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governments just block well known VPN providers and a small individual server is fine. It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use.

Is it the protocol that's blocked as a result of DPI, or just the default 51820 UDP port that's blocked? If the latter, just changing your Wireguard server's port might work.

It's DPI, I run on a non standard port.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#560

Earlier quoted context omitted.

There isn't enough bandwidth in HF to transmit data. Digital HF audio is 20 kHz wide so maybe 50kbps. The entire HF band is only 3-30 MHz.

sure there is, you can send files over HF, it may not be FAST, but once you get it into the country, you can just copy the file with a faster method (eg: usb drive), WINLINK supports attachments, so you could absolutely send these files over HF

Or just google drive.
Post reply on HN