VPN services blocked in Sri Lanka as information controls tighten

Post by nstart » Sat, Apr 27, 2019, 8:17 AM UTC

walrus01 wrote: post #22

fb03 wrote: post #3

Earlier quoted context omitted.

A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

Assuming that nobody in Sri Lanka is implementing DPI on ISPs' edge interfaces, the safer solution would be to run your own vpn endpoint hosted in the USA or Europe, as openvpn in tcp mode, or wireguard, on port 443. Without pwning your client device, they're technically incapable of properly MITMing TLS1.2 and can't break the internet so thoroughly by blocking https/port 443 traffic (which would also break gmail, al…

Post by fegul » Sat, Apr 27, 2019, 10:17 AM UTC

FredFS456 wrote: post #39

obtino wrote: post #21

Earlier quoted context omitted.

The easiest way to roll your own, securely: https://github.com/StreisandEffect/streisand

Algo is better than Streisand. https://github.com/trailofbits/algo

Post by darkhorn » Sat, Apr 27, 2019, 10:47 AM UTC

toast0 wrote: post #29

darkhorn wrote: post #20

Earlier quoted context omitted.

> DNS-based Firefox has build-in DNS over HTTPS. That will help.

Until they block the DoH ips bundled in Firefox

Post by blattimwind » Sat, Apr 27, 2019, 11:31 AM UTC

ArchD wrote: post #37

nstart wrote: post #35

It's actually infuriating this ban. I'm from SL, currently on Nord VPN which hasn't been blocked by 1 of the major ISPs. Both major ISPs are aggressively blocking standard open vpn traffic however. I'm not entirely sure how since this is not my knowledge domain but a default open vpn setup on digital ocean (even on port 443) results in a timeout when contacting the server I don't understand why one ISP is still allow…

OpenVPN, like many other VPN protocols, does not have censorship resistance as part of its design goals. So, I'm guessing that its traffic patterns are quite easy to detect. You should have better luck with something like Shadowsocks, or even better, Shadowsocks over a SSH tunnel. There are probably better and more potent alternatives that I'm not familiar with. If you just want to do regular web browsing, a simple t…

Post by pferde » Sat, Apr 27, 2019, 11:51 AM UTC

sjy wrote: post #46

nstart wrote: post #40

Earlier quoted context omitted.

Thanks. I'll be taking a look at tunelling soon. The material around it is difficult to read and put together to be honest. I'm right now using Nord via their ovpn files. Somehow it made its way through one ISP ruleset. For my digital ocean box, I asked someone else to use tunnelblick with the ovpn file I provided them to see if it worked (they were in another country) and it worked. This makes me believe it's most l…

I suggest looking into WireGuard [1]. I found it easier to use than OpenVPN, and I think it will displace it as the de facto standard when it eventually gets merged into the Linux kernel. You'll have to use lower-level configuration tools to get started with it, which I am finding helpful to pursue the same goal of learning about networking more thoroughly. [1]: https://news.ycombinator.com/item?id=17659983