11–20 of 21 posts
You can tunnel TCP / IP / GRE, reasonably even Ethernet itself over UDP. This is actually really interesting for cases where you want layer 2 bridging over the internet without all the complexity and overhead of a VPN.
Reminds me of Iodine (IP over DNS): http://code.kryo.se/iodine/ Of course, it only works if DNS resolution is allowed without auth, which can vary a lot.
Nonetheless, it's an awesome tool to help you get that beachhead and upgrade your connection from there.
Reminds me of Iodine (IP over DNS): http://code.kryo.se/iodine/ Of course, it only works if DNS resolution is allowed without auth, which can vary a lot.
iodine is awesome, but is usually very slow, in real-life tests I've rarely gotten anywhere close to the benchmarks cited in the README. Nonetheless, it's an awesome tool to help you get that beachhead and upgrade your connection from there.
Earlier quoted context omitted.
> It's useful to avoid Internet restrictions It's used to bypass DPI where known VPN softwares are already filtered.
How many providers have DPI filtering for select apps on unauthenticated connections ? Exactly zero.
How is this different from a VPN over UDP, like OpenVPN or Cisco Anyconnect?
Exactly, that was my first thought. I have an OpenVPN endpoint on different ports over UDP and TCP available. My experience is, that UDP is also blocked like TCP. The only possible work around is then IP over DNS, which works but with very very limited bandwidth.
It turns out this is kind of already in the Linux Kernel. See here: https://lwn.net/Articles/614348/ You can tunnel TCP / IP / GRE, reasonably even Ethernet itself over UDP. This is actually really interesting for cases where you want layer 2 bridging over the internet without all the complexity and overhead of a VPN.
With an extra iptables rule should work though:
iptables -t nat -A PREROUTING -s my.server -p udp --sport 53 -d DNAT --to 127.0.0.1:5555
ip fou add port 5555 ipproto 4How is this different from a VPN over UDP, like OpenVPN or Cisco Anyconnect?
Exactly, that was my first thought. I have an OpenVPN endpoint on different ports over UDP and TCP available. My experience is, that UDP is also blocked like TCP. The only possible work around is then IP over DNS, which works but with very very limited bandwidth.
What about tunnel over HTTP? That can be much better obfuscated. Tunnel over DNS can be easily filtered out by just checking for the traffic amount (for example to block VoIP the ISP should just degrade DNS if traffic amount is above a treshold for a user)
How is this different from a VPN over UDP, like OpenVPN or Cisco Anyconnect?
These kind of tunnels allows custom, obfuscated protocols.
It turns out this is kind of already in the Linux Kernel. See here: https://lwn.net/Articles/614348/ You can tunnel TCP / IP / GRE, reasonably even Ethernet itself over UDP. This is actually really interesting for cases where you want layer 2 bridging over the internet without all the complexity and overhead of a VPN.