Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN services blocked in Sri Lanka as information controls tighten

netblocks.org

Post reply on HN
Print view View original

21–30 of 62 posts

Re: VPN services blocked in Sri Lanka as information controls tighten

#21

Post by obtino »

abstractbarista wrote: post #2

Looks like it's mostly DNS-based. Meh. But still, this underscores the importance of operating your own VPN if you want to maintain comms through the silly twitches of a gov't like this. The biggest VPN providers are the first to be targeted. Even just having an SSH host outside the country will do fine. On another note, I recently set up a Tor bridge with pluggable transports to help those in choked areas. It was a…

The easiest way to roll your own, securely: https://github.com/StreisandEffect/streisand

Re: VPN services blocked in Sri Lanka as information controls tighten

#22

Post by walrus01 »

fb03 wrote: post #3
abstractbarista wrote: post #2

Looks like it's mostly DNS-based. Meh. But still, this underscores the importance of operating your own VPN if you want to maintain comms through the silly twitches of a gov't like this. The biggest VPN providers are the first to be targeted. Even just having an SSH host outside the country will do fine. On another note, I recently set up a Tor bridge with pluggable transports to help those in choked areas. It was a…

A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

Assuming that nobody in Sri Lanka is implementing DPI on ISPs' edge interfaces, the safer solution would be to run your own vpn endpoint hosted in the USA or Europe, as openvpn in tcp mode, or wireguard, on port 443. Without pwning your client device, they're technically incapable of properly MITMing TLS1.2 and can't break the internet so thoroughly by blocking https/port 443 traffic (which would also break gmail, all other popular webmail, and a huge chunk of everything else with hugely popular public websites where port 80 is redirected to 443 for TLS end-to-end).

So unless somebody cares to inspect your traffic flow in particular and notices that it's openvpn traffic on 443 and not normal TLS1.2 traffic, it's likely to work.

Re: VPN services blocked in Sri Lanka as information controls tighten

#23

Post by walrus01 »

gruez wrote: post #14
fb03 wrote: post #3

Earlier quoted context omitted.

A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

>simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile. Sounds like security theater. Using port knocking isn't going to hide the fact there's a SSH connection between you and some server. If anything, having a non standard configuration (non standard…

I think you overestimate the desire, motivation and technical capability of sri lankan ISPs to start doing netflow analysis and DPI on individual subscribers' end user connections.

Unless you were to attract the attention of somebody in government, and they forced an ISP to escalate an issue to the 3rd or 4th tier of network engineering running the core of the bigger ASes there, they're not going to be doing that. It's not the chinese GFW.

Re: VPN services blocked in Sri Lanka as information controls tighten

#24

Post by npsomaratna »

ianlevesque wrote: post #9

Legitimate question: what do they hope to achieve by this?

Sri Lankan here.

Historically, the people here have engaged in "knee-jerk" violence following an initial inflammatory incident; see:

https://en.wikipedia.org/wiki/Black_July

https://en.wikipedia.org/wiki/2018_anti-Muslim_riots_in_Sri_...

In the second incident listed above, social media was used both as a vector to spread hate speech and misinformation, and also to help mobs organize.

Regarding the current social media block: at the start, I felt this to be reasonable, as it made sense to slow the spread of misinformation/hate speech for a couple of days, until people's emotions cool down. However, the blocks still continue - and I see no clear justification for continuing them for so long.

Re: VPN services blocked in Sri Lanka as information controls tighten

#25

Post by deependra »

npsomaratna wrote: post #24
ianlevesque wrote: post #9

Legitimate question: what do they hope to achieve by this?

Sri Lankan here. Historically, the people here have engaged in "knee-jerk" violence following an initial inflammatory incident; see: https://en.wikipedia.org/wiki/Black_July https://en.wikipedia.org/wiki/2018_anti-Muslim_riots_in_Sri_... In the second incident listed above, social media was used both as a vector to spread hate speech and misinformation, and also to help mobs organize. Regarding the current social med…

"I felt this to be reasonable" haha ....

Re: VPN services blocked in Sri Lanka as information controls tighten

#28

Post by nine_k »

sjy wrote: post #18
ianlevesque wrote: post #9

Legitimate question: what do they hope to achieve by this?

I'm guessing this is just an attempt to make the social media blocks more effective. And I suppose the purpose of blocking social media is to suppress public discussion and criticism, which is intended to prevent social unrest like protesting, riots or a sudden change in government? I'm not too sure; it's hard to understand from within a society where it's considered a fundamental right to criticise the government.

Sometimes people just don't like each other, due to prejudice, differences in religion, some old beef between clans / ethnic groups / regional groups. This may have no relation to the government being oppressive or liberal.

Shutting down communication channels rarely helps defuse such situations, though. It leads to more isolation, more rumors, more enmity.

Re: VPN services blocked in Sri Lanka as information controls tighten

#29

Post by toast0 »

darkhorn wrote: post #20
abstractbarista wrote: post #2

Looks like it's mostly DNS-based. Meh. But still, this underscores the importance of operating your own VPN if you want to maintain comms through the silly twitches of a gov't like this. The biggest VPN providers are the first to be targeted. Even just having an SSH host outside the country will do fine. On another note, I recently set up a Tor bridge with pluggable transports to help those in choked areas. It was a…

> DNS-based Firefox has build-in DNS over HTTPS. That will help.

Until they block the DoH ips bundled in Firefox

Re: VPN services blocked in Sri Lanka as information controls tighten

#30

Post by salawat »

jessedhillon wrote: post #12
ianlevesque wrote: post #9

Legitimate question: what do they hope to achieve by this?

Legitimately curious response: have you tried thinking through the answer to this question, and if so, what seems like the likely answer in your view? If not, why not?

So I'm not sure what question you're asking if someone has put thought into, but assuming it was "What do they hope to achieve by this?"

shakes Magic 8 ball

My guess is it's a combination of what the Sri Lankan poster above mentioned combined with a reaction to further technical escalation by the citizenry.

Unfortunately, there are too many unknowns w.r.t. Sri Lanka's government/cultural values for me to even hazard a guess as to what the endgame is beyond minimizing net driven attempts to organize.

What I do see potentially transpiring, however, is someone figuring out how to host basic net based communication within the country; odds are though, the government feel themselves sufficiently equipped to take down in country rabble rousing, and possibly aim to keep outside influences from inflaming things further.

Best thing you can do if you want to get out, is find the IP addresses for your particular of site, and use that. DNS based blocking does squat if you're maintaining your own registry of IP->Domain Name bindings. If they catch on and start trying to IP block, well, welcome back to the pre/early internet days. Hopefully you know someone willing to host you a forwarding proxy.

Stay safe Sri Lanka folks.

Post reply on HN