Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN services blocked in Sri Lanka as information controls tighten

netblocks.org

Post reply on HN
Print view View original

31–40 of 62 posts

Re: VPN services blocked in Sri Lanka as information controls tighten

#31

Post by npsomaratna »

npsomaratna wrote: post #24
ianlevesque wrote: post #9

Legitimate question: what do they hope to achieve by this?

Sri Lankan here. Historically, the people here have engaged in "knee-jerk" violence following an initial inflammatory incident; see: https://en.wikipedia.org/wiki/Black_July https://en.wikipedia.org/wiki/2018_anti-Muslim_riots_in_Sri_... In the second incident listed above, social media was used both as a vector to spread hate speech and misinformation, and also to help mobs organize. Regarding the current social med…

Update: social media isn't blocked anymore. Six days in total - reasonable enough, I think.

Re: VPN services blocked in Sri Lanka as information controls tighten

#32

Post by TomK32 »

abstractbarista wrote: post #2

Looks like it's mostly DNS-based. Meh. But still, this underscores the importance of operating your own VPN if you want to maintain comms through the silly twitches of a gov't like this. The biggest VPN providers are the first to be targeted. Even just having an SSH host outside the country will do fine. On another note, I recently set up a Tor bridge with pluggable transports to help those in choked areas. It was a…

I have my vpn served via port 443 on a server that also runs a website on that same port. But I think there's better ways to make it hard for attackers to block me.

Re: VPN services blocked in Sri Lanka as information controls tighten

#33

Post by TomK32 »

derekp7 wrote: post #4
fb03 wrote: post #3

Earlier quoted context omitted.

A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

ssh over https, using proxytunnel works really good too. Looks like regular https traffic. And in addition to forwarding individual ports, openssh also has full vpn capability using tun/tap devices.

And you can still serve a regular https website from that same server!

Re: VPN services blocked in Sri Lanka as information controls tighten

#34

Post by bArray »

walrus01 wrote: post #23
gruez wrote: post #14

Earlier quoted context omitted.

>simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile. Sounds like security theater. Using port knocking isn't going to hide the fact there's a SSH connection between you and some server. If anything, having a non standard configuration (non standard…

I think you overestimate the desire, motivation and technical capability of sri lankan ISPs to start doing netflow analysis and DPI on individual subscribers' end user connections. Unless you were to attract the attention of somebody in government, and they forced an ISP to escalate an issue to the 3rd or 4th tier of network engineering running the core of the bigger ASes there, they're not going to be doing that. It…

Not only this, but there's a massive difference between stopping people from accessing the web via VPNs and stopping people from SSH'ing into their servers. You block SSH access and you're probably going to take a financial toll Country wide.

Re: VPN services blocked in Sri Lanka as information controls tighten

#35

Post by nstart »

It's actually infuriating this ban. I'm from SL, currently on Nord VPN which hasn't been blocked by 1 of the major ISPs. Both major ISPs are aggressively blocking standard open vpn traffic however. I'm not entirely sure how since this is not my knowledge domain but a default open vpn setup on digital ocean (even on port 443) results in a timeout when contacting the server

I don't understand why one ISP is still allowing Nord and express vpn through. If anyone is open to debug this and help create a work around I'd love help. Feels like a good time to test things.

In the meantime people are using dubious vpn providers and are opening themselves up as easy targets. I dread what would happen if a malicious party created a vpn with malicious intent and then spent some bucks on targeted advertising in SL on the app stores.

This block is such a shit move really. It's become the gov's default crisis time response in the name of national security.

Re: VPN services blocked in Sri Lanka as information controls tighten

#36

Post by abc-xyz »

emilfihlman wrote: post #13
abc-xyz wrote: post #6

Earlier quoted context omitted.

Speaking of shadowsocks, I really feel sorry for the author.. I believe his final words were "I hope one day I'll live in a country where I have freedom to write any code I like without fearing"

Can you share more on this?

This is the HN thread from the time: https://news.ycombinator.com/item?id=10101469

His GitHub went quiet after that, but as wiremaus points out, he seems to be alive and well based on his twitter posts.

Re: VPN services blocked in Sri Lanka as information controls tighten

#37

Post by ArchD »

nstart wrote: post #35

It's actually infuriating this ban. I'm from SL, currently on Nord VPN which hasn't been blocked by 1 of the major ISPs. Both major ISPs are aggressively blocking standard open vpn traffic however. I'm not entirely sure how since this is not my knowledge domain but a default open vpn setup on digital ocean (even on port 443) results in a timeout when contacting the server I don't understand why one ISP is still allow…

OpenVPN, like many other VPN protocols, does not have censorship resistance as part of its design goals. So, I'm guessing that its traffic patterns are quite easy to detect.

You should have better luck with something like Shadowsocks, or even better, Shadowsocks over a SSH tunnel. There are probably better and more potent alternatives that I'm not familiar with. If you just want to do regular web browsing, a simple thing to try is to just use "ssh -D" for a SOCKS5 proxy and configure your browser to use the proxy.

Also, a possible first step in debugging is to run the same server setup in the same country as the client and see whether it allows you to connect to a domestic server. If it doesn't, it's probably a problem with your client/server setup as the state's firewall probably doesn't need to block domestic VPN connections.

Re: VPN services blocked in Sri Lanka as information controls tighten

#38

Post by [deleted] »

sjy wrote: post #18
ianlevesque wrote: post #9

Legitimate question: what do they hope to achieve by this?

I'm guessing this is just an attempt to make the social media blocks more effective. And I suppose the purpose of blocking social media is to suppress public discussion and criticism, which is intended to prevent social unrest like protesting, riots or a sudden change in government? I'm not too sure; it's hard to understand from within a society where it's considered a fundamental right to criticise the government.

[deleted]

Re: VPN services blocked in Sri Lanka as information controls tighten

#39

Post by FredFS456 »

obtino wrote: post #21
abstractbarista wrote: post #2

Looks like it's mostly DNS-based. Meh. But still, this underscores the importance of operating your own VPN if you want to maintain comms through the silly twitches of a gov't like this. The biggest VPN providers are the first to be targeted. Even just having an SSH host outside the country will do fine. On another note, I recently set up a Tor bridge with pluggable transports to help those in choked areas. It was a…

The easiest way to roll your own, securely: https://github.com/StreisandEffect/streisand

Algo is better than Streisand. https://github.com/trailofbits/algo

Re: VPN services blocked in Sri Lanka as information controls tighten

#40

Post by nstart »

ArchD wrote: post #37
nstart wrote: post #35

It's actually infuriating this ban. I'm from SL, currently on Nord VPN which hasn't been blocked by 1 of the major ISPs. Both major ISPs are aggressively blocking standard open vpn traffic however. I'm not entirely sure how since this is not my knowledge domain but a default open vpn setup on digital ocean (even on port 443) results in a timeout when contacting the server I don't understand why one ISP is still allow…

OpenVPN, like many other VPN protocols, does not have censorship resistance as part of its design goals. So, I'm guessing that its traffic patterns are quite easy to detect. You should have better luck with something like Shadowsocks, or even better, Shadowsocks over a SSH tunnel. There are probably better and more potent alternatives that I'm not familiar with. If you just want to do regular web browsing, a simple t…

Thanks. I'll be taking a look at tunelling soon. The material around it is difficult to read and put together to be honest.

I'm right now using Nord via their ovpn files. Somehow it made its way through one ISP ruleset.

For my digital ocean box, I asked someone else to use tunnelblick with the ovpn file I provided them to see if it worked (they were in another country) and it worked. This makes me believe it's most likely a country level issue.

In general though I'd like to learn about networking more thoroughly and set up a censorship resistant option which I can help others to setup and share as well later on. Any primers/pointers are appreciated too. I'll start with all the things you mentioned though.

Post reply on HN