China Tells Carriers to Block Access to Personal VPNs by February
1–10 of 141 posts
Re: China Tells Carriers to Block Access to Personal VPNs by February
#2not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
Re: China Tells Carriers to Block Access to Personal VPNs by February
#3not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
Yes, deep packet inspection with ML, read for example here [1]
[1] http://blog.zorinaq.com/my-experience-with-the-great-firewal...
Re: China Tells Carriers to Block Access to Personal VPNs by February
#4not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
[deleted]
Re: China Tells Carriers to Block Access to Personal VPNs by February
#5not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it.
I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you), but fortunately didn't firewall outgoing port 22 so I could use sshuttle to route 0.0.0.0/0 via an SSH connection to my personal server. This works with pretty much any server you can run Python on, so I don't know of a good way to stop it unless you're willing to block anyone from SSHing outside of the country (thus preventing e. g. Chinese companies with a global market from running servers in other countries).
Re: China Tells Carriers to Block Access to Personal VPNs by February
#6Time to get funds for 443 port vpn startups. ;)
Hint: TLS encrypted traffic following an appropriate browser-style handshake cannot be distinguished from "legitimate" https.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#7not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewal...
DPS will give you nice and beautifully encrypted payloads. Now what?
Emulating a standard browser TLS handshake is a no-brainer.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#8This is a sure sign that China is one black swan event away from an economic collapse and possible Arab spring. Between the 300%+ gdp/debt ratio, stalled stock market, complete frozen capital control, second real estate bubble bursting in shanghai/tier1 cities, huge spike in shadow lending, Trump's 100 day ultimatum to China regarding trade deficit, demographics crisis, NK situation, south asia island situation, Foreign Direct Investments leaving China, protectionisms against China in europe/US/Japan, etc. The authoritarian Chinese government is starting to have some sense of fear now.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#9not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it. I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you ), but fortunately didn't firewal…
China could simply require business that use ssh to register and/or ssh through one of their firewall servers.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#10With China, there is a big difference between what is said, what is law and what is actually enforced.
What's likely to happen is that there will be a crack down, some satisfying numbers will be shown to officials, and then everything will become back to normal soon after.
There has been this kind of talk about cracking down on VPN before, and it's still available, so wait and see