How I got through Docker's censorship

I'll take my best shot at guessing his answers. The Great Firewall employs many techniques for censorship. The simplest block sites and poison your dns cache. Http packets are inspected to deterministically decide whether are block a connection.

Https is an improvement, but they still use machine learning to make estimates on encrypted contents of packets. If packets going to and from a location (i.e. Your vpn server) meet some criteria with some confidence, they perform attacks on that connection and subsequent connections To the same endpoint. I'm not sure on the specifics, but these attacks will cause ~90% of that connection's traffic to drop. The system is dynamic, so your countermeasures have to be as well.

I'm guessing HK because it's physically and politically close. It's considered Chinese territory, but not under China's GFW. I've heard from friends that GFW censorship is more aggressive around sensitive times (i.e. Tiananmen square anniversary) and news.

If any of this is wrong or inaccurate, someone please correct me. I'd love to have a better mental model of the GFW so that I could better work remotely from there.

I have read that the GFW will also try to fingerprint a server if packet analysis shows that it might be a VPN.

VyperVPN has a stealth protocol (Chameleon) which tries to obfuscate the VPN connection to make it look like other types of connections. Other VPN providers might be doing the same thing.

When I first came to China about 3 years ago, I tried using a VPN service but it wasn't reliable and connecting was always slow. So I tried running my own OpenVPN server on a VPS in HK (different provider [0]).

What I found at that time was that the GFW seemed to detect the VPNS's TLS connection and delay some packets which caused the connection setup to timeout. I even created my own obfuscating TCP tunnel (written in Lua) and tunneled OpenVPN through that. The obfuscation made OpenVPN work much better.

I still had latency issue when doing a long download. I later found out that the latency issue was caused by my VPS provider having a 2Mbit bandwidth cap on traffic to China from the server (they don't say anything about this limit or how much it would cost raise the limit on their website [0]). Also I found that if I apply the 2Mbit rate limit on the VPS server, then latency didn't go sky high (slowly growing to 10 or 12 second ping times before dropping again). It has only been in the last 3-4 months that I have known about this issue and moved to a new provider.

I started using ShadowSocks because it uses a protocol that doesn't have any easy to detect fingerprints (all of the data in the protocol is encrypted), so it doesn't really need obfuscation to hide the connection from the GFW. Also ShadowSocks creates many connections (one for each proxied connection), so even if the GFW delays some of the packets, it will not cause a stall of all connections.

But I think the biggest thing that I like about ShadowSocks is that it doesn't need time to setup a VPN connection, the tun0 device and routing rules. So when my laptop connects to a different WiFi network, everything just works (except I sometimes need to reset the DNS tunnels, but I could automate the reset).

0. http://www.vpshosting.com.hk/