Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

741–750 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#741

Post by ranger_danger »

ykl wrote: post #298
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

This doesn't work anymore; the GFW no longer detects VPN connections by port but instead by performing deep packet inspection to characterize the type of traffic going over every connection. Using this technique in combination with some advanced ML systems, they're able to detect any encrypted VPN connection and cut it off; it's basically not possible to run any kind of outbound VPN connection (even to private server…

> it's basically not possible to run any kind of outbound VPN connection (even to private servers) from inside of China anymore

This is not true anymore, and your own link says so:

> all circumvention strategies adopted by these tools are reportedly still effective in China

And while this paper is not the most up to date, there are actually many new kinds of obfuscating VPN/proxy/tunnel technologies out now, and they are currently not blocked. Some methods can even disguise themselves as unencrypted, plaintext legitimate-looking HTML and still tunnel traffic (slowly) through it.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#742

Post by ranger_danger »

77pt77 wrote: post #310
wulfstan wrote: post #286

Earlier quoted context omitted.

When I worked in China (not for long periods but frequently enough that the Great Firewall became an irritant) I hosted an OpenVPN server on port 443 and/or port 22 of a server I owned. That worked sufficiently well most of the time.

Which is ridiculous because OpenVPN is trivial to identify, even when over TCP since it's different from "regular" HTTPS/SSL traffic. Why they chose this I have no idea. You can even port share. 443 -> Web server for HTTPS traffic 443 -> OpenVPN for OpenVPN traffic Still trivial to identify and not uncommon for even public WiFi to do so. Since I changed to tailscale+headscale with my own derp server all these issues…

SoftEther works over "regular" TLS at least, you can even reverse-proxy it.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#743

Post by ranger_danger »

nomilk wrote: post #43

Australia and UK might soon go down this path. Something quite depressing is if we (HN crowd) find workarounds, most regular folks won't have the budget/expertise to do so, so citizen journalism will have been successfully muted by government / big media.

> most regular folks won't have the budget/expertise to do so

I think this (incorrectly) assumes that nobody will ever capitalize on easy (and free/cheap) access to workarounds and advertise it far and wide.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#744

Post by immibis »

jchook wrote: post #557
teiferer wrote: post #528

Earlier quoted context omitted.

The user-facing software is not included in the kernel, but you need that to configure wireguard.

Is that true? I thought wg-quick etc were just convenience functions and that it's relatively trivial to use iproute2 to configure a VPN link

You don't need wg-quick. You do need the "wg" command.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#745

Post by immibis »

GoblinSlayer wrote: post #560
zack6849 wrote: post #424

Earlier quoted context omitted.

sure there is, you can send files over HF, it may not be FAST, but once you get it into the country, you can just copy the file with a faster method (eg: usb drive), WINLINK supports attachments, so you could absolutely send these files over HF

Or just google drive.

Banned in places that ban VPNs.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#746

Post by majorchord »

nisegami wrote: post #16
Humorist2290 wrote: post #14

- Tor. Pros: Reasonably user friendly and easy to get online, strong anonymity, free. Cons: a common target for censorship, not very fast, exit nodes are basically universally distrusted by websites. - Tailscale with Mullvad exit nodes. Pros: little setup but not more than installing and configuring a program, faster than Got, very versatile. Cons: deep packet inspection can probably identify your traffic is using Mu…

Minimums for a VPS should be closer to $5-10 a month, no?

The cheapest AWS EC2 instance is $3/mo

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#747

Post by majorchord »

77pt77 wrote: post #472
Humorist2290 wrote: post #14

- Tor. Pros: Reasonably user friendly and easy to get online, strong anonymity, free. Cons: a common target for censorship, not very fast, exit nodes are basically universally distrusted by websites. - Tailscale with Mullvad exit nodes. Pros: little setup but not more than installing and configuring a program, faster than Got, very versatile. Cons: deep packet inspection can probably identify your traffic is using Mu…

> cost is flexible but probably 20-30$ per month minimum in hosting Like I've written here. VPS in EU with 2GB RAM, 40 GB disk and >1TB a month of traffic go for $10 PER YEAR! https://billing.chunkserve.com/cart.php?a=confproduct&i=0 https://my.servitro.com/cart.php?a=view https://manager.ouiheberg.com/cart.php?a=confproduct&i=0

In my experience, not only do a lot of sites block access from datacenter/cloud IPs, but you will routinely encounter captcha loops.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#748

Post by atmosx »

akho wrote: post #327
atmosx wrote: post #192

Earlier quoted context omitted.

Cloak + wireguard should work fine on the server side. The problem is that I didn't find any clients for Android and I doubt there are clients for iOs that can (a) open a cloak tunnel and then (b) allow wireguard to connect to localhost...

AmneziaWG is obfuscated, wireguard-based, and has clients for whatever.

I'll give it a shot, thanks!

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#750

Post by akho »

rieslingspecial wrote: post #133

This might not be the case for Indonesia currently, but for countries like Russia, China, Iran most of the mentioned solutions will not work. I've had to evade Russian censorship for years now - the censors (Roskomnadzor) use DPI and other means of classifying network traffic, and currently the following things are outright blocked: - Tor - Wireguard and derivatives (incl. Mullvad, Tailscale, ProtonVPN) - OpenVPN - S…

Shadowsocks still works. It can be detected through active probing, but blocking it automatically is a bit above their current capabilities.

No reason not to use the *rays anyway.

Post reply on HN