Live data from Hacker News

VPN services blocked in Sri Lanka as information controls tighten

netblocks.org

61–62 of 62 posts

Re: VPN services blocked in Sri Lanka as information controls tighten

#61
post #57
post #55

Earlier quoted context omitted.

Transforming generic layer 3 datagrams into traffic that looks like something else is the general domain of obfuscation. Making WireGuard traffic look like TCP is one form of such obfuscation. Making it look like TLS or DNS or HTTP are other forms. (Actually putting layer 3 traffic into framing inside a legit TCP stream is inefficient and the wrong way to think about the problem domain.) No promises, but I'm expectin…

Inefficient as it may be, it is something I simply need for my use case - connecting home from a certain network which only allows outgoing connections on a handful of TCP ports.

No. You need your traffic to look like TCP, for your particular network filtering. But you do not need to achieve that by using the naive and inefficient approach of, "stick the packets into a TCP stream prefixed by a length field." Rather, there are more clever tricks for making your traffic look like TCP, which generally fall into the same realm as other obfuscation mechanisms.

Re: VPN services blocked in Sri Lanka as information controls tighten

#62
post #52

Privacy idealist hat on. I believe there's a lot of potential for CDNs and major sites to offer anti-censorship pass through traffic with HTTP/2 via CONNECT. By having a multiplexed protocol with multiple streams that spans "normal" traffic and tunneled traffic, it should be harder to identify. This would allow major sites or CDN providers to provide service to those people behind such bans and possibly require gover…

https://blog.cloudflare.com/1111-warp-better-vpn/ Cloudflare also built and opensourced a rust implementation of wireguard which will likely back the service [0], but unfortunately, they didn't collaborate with upstream. [0] https://github.com/cloudflare/boringtun

Yeah, I'm specifically pointing to the idea of leveraging HTTP/2's multiplexed streams to embed VPNs into the same connection as normal web traffic from CDNs. Things like 1.1.1.1 Warp don't attempt to hide the fact that they're a VPN and thus wouldn't really help with what I'm talking about.
Post reply on HN