Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoodbyeDPI: Deep Packet Inspection circumvention utility

github.com

Post reply on HN
Print view View original

31–40 of 124 posts

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#31

Post by tambourine_man »

5e92cb50239222b wrote: post #26
patrakov wrote: post #18

Earlier quoted context omitted.

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (th…

I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally co…

Thank you, I do too. I though it was only me.

SSH is very simple and there’s almost nothing a SSH tunnel can’t do.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#32

Post by erebe__ »

mmwelt wrote: post #11

Doesn't work in China, though: https://github.com/ValdikSS/GoodbyeDPI/issues/123

Websocket tunneling is known to work against the GFW. Many people reported me that they managed to use wstunnel to bypass

https://github.com/erebe/wstunnel (linux + mac + windows)

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#35

Post by pyinstallwoes »

liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

What VPN service did you choose, and what were the contenders if any?

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#36

Post by 5e92cb50239222b »

userbinator wrote: post #30
5e92cb50239222b wrote: post #26

Earlier quoted context omitted.

I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally co…

point your applications to That's the problem. Not all of them will implement tunneling their own traffic through SOCKS, and there's still other things like DNS that you might also want to go through the tunnel, but can't easily do so. A VPN sits at a lower layer, just looking like a regular network connection, so applications don't need to be aware.

Well, yeah, that's the problem (or the main advantage depending on your viewpoint). The post I was replying to mentioned how painful it is to avoid routing through VPN where it's not needed (although it's pretty easy to do on Linux with network namespaces, and IIRC policy routing, which I've never tried).

I just want to point out the simplest solution which for some reason doesn't seem to be very popular, although it covers most users' use-cases better than a VPN connection does (IMHO).

Don't know about other browsers, but Firefox is able to send DNS requests through socks, whether you're using DNS-over-HTTPS or not.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#37

Post by progbits »

rixrax wrote: post #33

Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?

Censorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#38

Post by nnx »

progbits wrote: post #37
rixrax wrote: post #33

Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?

Censorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.

Or perhaps some good talent somehow ending up working there made sure the system is full of plausibly deniable holes.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#39

Post by vore »

5e92cb50239222b wrote: post #26
patrakov wrote: post #18

Earlier quoted context omitted.

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (th…

I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally co…

In China at least, the GFW can detect tunneled SSH traffic and cut it off.
Post reply on HN