You can route around VPN blocks by using something like Ghostbear which uses obfsroxy and is similar to Tor's meek pluggable transport https://help.tunnelbear.com/hc/en-us/articles/360007243291-G...
VPN services blocked in Sri Lanka as information controls tighten
51–60 of 62 posts
Re: VPN services blocked in Sri Lanka as information controls tighten
#52Privacy idealist hat on.
I believe there's a lot of potential for CDNs and major sites to offer anti-censorship pass through traffic with HTTP/2 via CONNECT. By having a multiplexed protocol with multiple streams that spans "normal" traffic and tunneled traffic, it should be harder to identify. This would allow major sites or CDN providers to provide service to those people behind such bans and possibly require governments to break a significant portion of the web in order to institute those blocks. I think it's valuable to increase the damage done by government blocking so we can ensure that mainstream persons are sufficiently upset by this conduct. I also think CloudFlare and other major CDN providers should be the ones to provide this type of VPN access either as a product or as a special case offering for people in countries who censor the web.
I realize there are many businesses who wouldn't damage their primary offerings to provide such a secondary service. But it only takes one or two companies to increase the collateral damage of the bans, and thus make them much more costly for the governments imposing them.
Re: VPN services blocked in Sri Lanka as information controls tighten
#53Earlier quoted context omitted.
I have a feeling theyve done some form of traffic analysis. My default open vpn setup on a digital ocean box with the port changed to 443 is blocked somehow with both major ISPs here.
are you using openvpn in tcp or udp mode? the default udp is pretty easy to block even if it's on 443, the tcp requires somewhat more DPI.
Tried tcp too. Weirdly it refused to work. Haven't been able to fully check for configuration errors on my end here but i can't think of anything I did wrong either :)
Re: VPN services blocked in Sri Lanka as information controls tighten
#54Earlier quoted context omitted.
OpenVPN, like many other VPN protocols, does not have censorship resistance as part of its design goals. So, I'm guessing that its traffic patterns are quite easy to detect. You should have better luck with something like Shadowsocks, or even better, Shadowsocks over a SSH tunnel. There are probably better and more potent alternatives that I'm not familiar with. If you just want to do regular web browsing, a simple t…
Thanks. I'll be taking a look at tunelling soon. The material around it is difficult to read and put together to be honest. I'm right now using Nord via their ovpn files. Somehow it made its way through one ISP ruleset. For my digital ocean box, I asked someone else to use tunnelblick with the ovpn file I provided them to see if it worked (they were in another country) and it worked. This makes me believe it's most l…
ssh -D1234 remotehost gives you a local SOCKS proxy at port 1234 that goes through remotehost.
Other than that, do investigate DNS on HTTPS and DNS on TLS. I recommend setting up something like dnscrypt-proxy to serve as the DNS resolver for your LAN.
Re: VPN services blocked in Sri Lanka as information controls tighten
#55Earlier quoted context omitted.
I suggest looking into WireGuard [1]. I found it easier to use than OpenVPN, and I think it will displace it as the de facto standard when it eventually gets merged into the Linux kernel. You'll have to use lower-level configuration tools to get started with it, which I am finding helpful to pursue the same goal of learning about networking more thoroughly. [1]: https://news.ycombinator.com/item?id=17659983
While like Wireguard a lot, it won't displace Openvpn completely, for the simple reason that it only works over UDP, and cannot work over TCP, unlike Openvpn.
Transforming generic layer 3 datagrams into traffic that looks like something else is the general domain of obfuscation. Making WireGuard traffic look like TCP is one form of such obfuscation. Making it look like TLS or DNS or HTTP are other forms. (Actually putting layer 3 traffic into framing inside a legit TCP stream is inefficient and the wrong way to think about the problem domain.) No promises, but I'm expecting some nice things to come in this domain of generic obfuscation mechanisms to punch through various forms of filtering.
Re: VPN services blocked in Sri Lanka as information controls tighten
#56Privacy idealist hat on. I believe there's a lot of potential for CDNs and major sites to offer anti-censorship pass through traffic with HTTP/2 via CONNECT. By having a multiplexed protocol with multiple streams that spans "normal" traffic and tunneled traffic, it should be harder to identify. This would allow major sites or CDN providers to provide service to those people behind such bans and possibly require gover…
https://blog.cloudflare.com/1111-warp-better-vpn/
Cloudflare also built and opensourced a rust implementation of wireguard which will likely back the service [0], but unfortunately, they didn't collaborate with upstream.
Re: VPN services blocked in Sri Lanka as information controls tighten
#57Earlier quoted context omitted.
While like Wireguard a lot, it won't displace Openvpn completely, for the simple reason that it only works over UDP, and cannot work over TCP, unlike Openvpn.
Transforming generic layer 3 datagrams into traffic that looks like something else is the general domain of obfuscation. Making WireGuard traffic look like TCP is one form of such obfuscation. Making it look like TLS or DNS or HTTP are other forms. (Actually putting layer 3 traffic into framing inside a legit TCP stream is inefficient and the wrong way to think about the problem domain.) No promises, but I'm expectin…
Inefficient as it may be, it is something I simply need for my use case - connecting home from a certain network which only allows outgoing connections on a handful of TCP ports.
Re: VPN services blocked in Sri Lanka as information controls tighten
#58Earlier quoted context omitted.
Algo is better than Streisand. https://github.com/trailofbits/algo
How?
From what I can see, it's only for setting up a VPN provider, nothing else like Tor etc. (that may attract unwanted attention). It supports IKEv2 which isn't blocked by a lot of firewalls and supports far more VPS providers than Streisand.
Re: VPN services blocked in Sri Lanka as information controls tighten
#59Earlier quoted context omitted.
are you using openvpn in tcp or udp mode? the default udp is pretty easy to block even if it's on 443, the tcp requires somewhat more DPI.
Tried tcp too. Weirdly it refused to work. Haven't been able to fully check for configuration errors on my end here but i can't think of anything I did wrong either :)
It's also very much possible that the entire digitalocean /22, /20 or even /18 sized chunk of ipv4 space it's in has just been null routed, due to the documented presence of other VPN endpoints in it.
Re: VPN services blocked in Sri Lanka as information controls tighten
#60It's actually infuriating this ban. I'm from SL, currently on Nord VPN which hasn't been blocked by 1 of the major ISPs. Both major ISPs are aggressively blocking standard open vpn traffic however. I'm not entirely sure how since this is not my knowledge domain but a default open vpn setup on digital ocean (even on port 443) results in a timeout when contacting the server I don't understand why one ISP is still allow…
OpenVPN, like many other VPN protocols, does not have censorship resistance as part of its design goals. So, I'm guessing that its traffic patterns are quite easy to detect. You should have better luck with something like Shadowsocks, or even better, Shadowsocks over a SSH tunnel. There are probably better and more potent alternatives that I'm not familiar with. If you just want to do regular web browsing, a simple t…
In China, most of the solution would be cut down after days/weeks/months. Although the connection was encrypted, GFW would still try to guess if the connection behaviors match some VPN features according to some algorithms, then cut it down.
Currently, I'm using Algo[0] setting up VPN and use Wireguard[1] connect to it, both of them are working perfectly than other solutions I have used.
[0] https://github.com/trailofbits/algo [1] https://www.wireguard.com/