Our startup uses a pair of Sonicwall TZ215s to establish a site-to-site tunnel between our China branch office and our U.S. HQ.
It has been quite difficult to get the tunnel stable enough to survive for more than a few hours. We had to use lower security settings and more uncommon modes to fix our constant disconnections. SSL-VPN has always worked well, but that is only an option for our remote workers; site-to-site does not offer that option. Dell support engineers have generally been clueless on the matter.
This is nothing new. They have added more IPs to the VPN blocklist. I have no idea why this is news. This happens several times per year. This cat and mouse game has been going on for years. Every time this happens it is just a pain in the ass to find a new VPN that isn't blocked. If you are technical, it is best to just setup your own VPN on linode or amazon. That way you have less problems with blocked IPs.
Not exactly. They are auto-identifying the IP addresses based on traffic sniffing. So you can do this and work around things, but your new IP will get identified as such and blocked automatically in a few hours.
Here is a real test for Anonymous; take down the worlds most notorious firewall.
The lulz does not seem like a fair reward when the adversary's not even slightly squeamish about abducting you and your family and selling your organs.
This is nothing new. They have added more IPs to the VPN blocklist. I have no idea why this is news. This happens several times per year. This cat and mouse game has been going on for years. Every time this happens it is just a pain in the ass to find a new VPN that isn't blocked. If you are technical, it is best to just setup your own VPN on linode or amazon. That way you have less problems with blocked IPs.
Not exactly. They are auto-identifying the IP addresses based on traffic sniffing. So you can do this and work around things, but your new IP will get identified as such and blocked automatically in a few hours.
This is nothing new. They have added more IPs to the VPN blocklist. I have no idea why this is news. This happens several times per year. This cat and mouse game has been going on for years. Every time this happens it is just a pain in the ass to find a new VPN that isn't blocked. If you are technical, it is best to just setup your own VPN on linode or amazon. That way you have less problems with blocked IPs.
This is what they used to do, but they've gotten more sophisticated - I've been running VPNs for China for my family on EC2 for a while. As far as I can tell, they almost never flat out block an IP. Initially they block a DNS hostname from resolving to a specific IP, then they start filtering out various different ports (including the default VPN ones). You can normally change to a random port and get OpenVPN to start working again, but it appears in the last couple weeks they've been able to identify and block OpenVPN activity on random ports. This happens so quickly, now, that it's pretty futile to try to IP hop unless you can come up with a traffic pattern that is less detectable.
This is nothing new. They have added more IPs to the VPN blocklist. I have no idea why this is news. This happens several times per year. This cat and mouse game has been going on for years. Every time this happens it is just a pain in the ass to find a new VPN that isn't blocked. If you are technical, it is best to just setup your own VPN on linode or amazon. That way you have less problems with blocked IPs.
Not exactly. They are auto-identifying the IP addresses based on traffic sniffing. So you can do this and work around things, but your new IP will get identified as such and blocked automatically in a few hours.
Oh wow, this is not good. Is it possible to evade this sniffing? I have my own Linode VPS, and have learnt to use Tinc VPN software. I'm learning Mandarin and plan to travel to China in a year or few, so this censorship makes me sad and hits my motivation.
I'm in Shanghai where I've lived off and on for 8 years. I've been using an ec2 image with Poptop installed. The problem is the IP addresses of the major vpns become known and blocked. Any suggestions of software that would deploy images to various cloud services on behalf of users? I don't think China would be able to block all of ec2 and Rackspace, though they do sometimes seem to throttle ec2.
OpenVPN has an AMI that you can install on an EC2 Micro instance which works fine as long as OpenVPN in general works -- which unfortunately is no longer the case as of the past few weeks.
I'm in Shanghai where I've lived off and on for 8 years. I've been using an ec2 image with Poptop installed. The problem is the IP addresses of the major vpns become known and blocked. Any suggestions of software that would deploy images to various cloud services on behalf of users? I don't think China would be able to block all of ec2 and Rackspace, though they do sometimes seem to throttle ec2.
I hope you're aware that pptp connections (including via poptop) can be broken easily.
Not exactly. They are auto-identifying the IP addresses based on traffic sniffing. So you can do this and work around things, but your new IP will get identified as such and blocked automatically in a few hours.
Oh wow, this is not good. Is it possible to evade this sniffing? I have my own Linode VPS, and have learnt to use Tinc VPN software. I'm learning Mandarin and plan to travel to China in a year or few, so this censorship makes me sad and hits my motivation.
Many of us on the mainland ("us" being the type of people who would read HN) have switched to SSH proxies over port 443. Sshuttle [1] is highly recommended.
Does anyone know of any work related to automatically making arbitrary "look" like, say, an HTTP session? I'm thinking of something that would automatically encode a VPN session as a valid, renderable HTML document (and not via the trivial way of just gzipping it and making it look like an HTTP compressed document, as I'm sure that would still be easy to block.) It seems like this should be possible, albeit with tons…
Such a technique is called steganography. It's possible but would require lots of bandwidth depending on how secure you need it to be. For example you can hide data in a photo by slightly changing the shades of red in it without changing the appearance of the photo noticeably.
There are a lot of government supported efforts to research (especially finding and cracking) steganography. You can even look up articles in Chinese on the topic