Live data from Hacker News

VPN access being disabled in China

rendezvous.blogs.nytimes.com

11–20 of 62 posts

Re: VPN access being disabled in China

#11
post #7
post #4

How is Cisco IPSec affected by this blockage? Any business or foreign mission conducting transactions in China should be very wary if they start targeting IPSec in any way.

...and by "Cisco IPSec" you mean "IPSec", right? I would assume, based on the various anecdotal reports I've read, that IPSec tunnels are blocked under this new program, along with PPTP and L2TP. They're using machine learning packet classifiers to identify the traffic running over tcp and udp, as well.

I'm using IPSec now without any problems. OpenVPN is blocked.

China has the power to be more selective about what it blocks. For example, Wikipedia is not blocked here (yet). But trying to access an article within Wikipedia on Tiananmen results in a dropped connection. Why China completely blocks entire blocks of ip addresses (like YouTube, Blogger, Wordpress) is not clear to me. There are a number of easy heuristics you could use to block most of what you don't want.

It is ironic to me that a government that preaches a belief in rationality (eg I received a text message last week urging citizens to believe in science and not the end of the world reports) would use censorship instead of rational debate/discussion to counter viewpoints it doesn't agree with.

Re: VPN access being disabled in China

#12
Does anyone know of any work related to automatically making arbitrary "look" like, say, an HTTP session? I'm thinking of something that would automatically encode a VPN session as a valid, renderable HTML document (and not via the trivial way of just gzipping it and making it look like an HTTP compressed document, as I'm sure that would still be easy to block.) It seems like this should be possible, albeit with tons of performance decrease, but I can't find anything.

Re: VPN access being disabled in China

#13
This sucks for travelers and ex-pats, but for China's future this is a very, very, very big deal.

I lived in Shanghai last year, and Chinese Internet surveillance is unreal. I could use gmail chat to talk about tiananman square, but as soon as I did all of my Google apps would suddenly be unavailable. I can only assume that when i used certain keywords my every chat was being monitored. A VPN was the only way I could access YouTube, Twitter, Facebook, and even some Google searches.

But reality is 90% of the young population of Shanghai didn't really care what the "great firewall" did, because EVERYONE used a VPN. I saw more people watching YouTube in China than I do in the states, even though Chinese versions of these platforms exist. Some platforms, like RenRen (Facebook-like but more similar to Russia's VKontakte) were popular, but most just used the US-built versions. Now most of them won't be able to.

This absolutely terrifies me. I was literally minutes away from being on a bullet train from Shanghai to Beijing that killed "x" people. Chinese authorities cite incredibly low numbers for a train traveling at 300 km/h. Most non-state observers cited hundreds of deaths. China slowly grew its number from 20-40.

It's illegal for foreigners to talk about the "Three Ts" with Chinese nationals - Tibet, Taiwan, and Tiananman Square. But previously the youth learned through their VPNs letting them access the outside world. With that shut down, the government might as well be burning books.

Re: VPN access being disabled in China

#14
I'm in Shanghai where I've lived off and on for 8 years. I've been using an ec2 image with Poptop installed. The problem is the IP addresses of the major vpns become known and blocked.

Any suggestions of software that would deploy images to various cloud services on behalf of users? I don't think China would be able to block all of ec2 and Rackspace, though they do sometimes seem to throttle ec2.

Re: VPN access being disabled in China

#15
I'm wondering how this effects corporate outsourcing. The company I work has a Chinese development and as center. This has to be behind the corporate firewall so I'm thinking we will just close that down and move to a country that wants to be part of the future.

Re: VPN access being disabled in China

#17
This is nothing new. They have added more IPs to the VPN blocklist. I have no idea why this is news. This happens several times per year. This cat and mouse game has been going on for years.

Every time this happens it is just a pain in the ass to find a new VPN that isn't blocked.

If you are technical, it is best to just setup your own VPN on linode or amazon. That way you have less problems with blocked IPs.

Re: VPN access being disabled in China

#18
post #11
post #7

Earlier quoted context omitted.

...and by "Cisco IPSec" you mean "IPSec", right? I would assume, based on the various anecdotal reports I've read, that IPSec tunnels are blocked under this new program, along with PPTP and L2TP. They're using machine learning packet classifiers to identify the traffic running over tcp and udp, as well.

I'm using IPSec now without any problems. OpenVPN is blocked. China has the power to be more selective about what it blocks. For example, Wikipedia is not blocked here (yet). But trying to access an article within Wikipedia on Tiananmen results in a dropped connection. Why China completely blocks entire blocks of ip addresses (like YouTube, Blogger, Wordpress) is not clear to me. There are a number of easy heuristics…

  > OpenVPN is blocked.
Are just the standard ports blocked? Or are they doing some type of traffic analysis to differentiate openvpn traffic over any port, be it tcp or udp (as openvpn can of course be configured for any port over tcp or udp)?

Re: VPN access being disabled in China

#19
I used to run a relatively successful internet-oriented startup in mainland China. Having spent most of a decade there since 2001, in fact the majority of my adult life, I considered it home. Unfortunately, the government - who initially woeed me to return to China with a reasonably lucrative scholarship - keeps making shitty decisions that just make it less and less attractive to live in. Increasing levels of internet censorship is one of them, making visas ridiculously hard to acquire (the Chinese consulate in a neighbouring country actually just flat out refused to even discuss issuing a tourist visa, earlier this year) is another.

I really hope the next generation of the communist party sort their shit out. Otherwise, China's basically going to continue breeding vast generations of uneducated, inward looking nationalists and stifling anything remotely like innovation that somehow manages to occur between the cracks. Foreign business professionals and overseas Chinese will continue to view time in China as a non-negotiable sentence of rice wine banquets, pollution, a complete vacuum in the upper-eschelons of conversationalism, a constant redoubling of cigarette smoke, spit, and bad Chinglish.

Re: VPN access being disabled in China

#20

This sucks for travelers and ex-pats, but for China's future this is a very, very, very big deal. I lived in Shanghai last year, and Chinese Internet surveillance is unreal. I could use gmail chat to talk about tiananman square, but as soon as I did all of my Google apps would suddenly be unavailable. I can only assume that when i used certain keywords my every chat was being monitored. A VPN was the only way I could…

While knowledge of VPNs is huge, their use is not as large as you posit. I would argue instead that the real reason many young Chinese don't really care what the "great firewall" does is that they're almost exclusively using the domestic Chinese internet. Browsing in simplified Chinese, there's rarely a need to access the outside internet.
Post reply on HN