Ask HN: How would you tunnel through GFW?

#1

Post by juvenn » Fri, Oct 02, 2009, 6:26 AM UTC

I think there would be thousands of hackers who're working from Mainland China. So, I'm wondering how could you get through GFW?

I've known that GFW has been upgraded recently, and it becomes more sophisticated in filtering the web. Tor nodes, lots of vpn networks, as well as SSH don't work around now.

I (or we) appreciate if someone here could come up a good and reliable solution.

Re: Ask HN: How would you tunnel through GFW?

#2

Post by smanek » Fri, Oct 02, 2009, 6:56 AM UTC

My brother was in Beijing for the summer, and he said the SSH tunnel I set up for him worked fine. It's possible that things have changed in the couple months since he's left, but I'd be surprised ...

If you want to go really overboard, tunnel IP over DNS, ICMP, or some other common protocol ;-) (e.g. http://thomer.com/howtos/nstx.html)

Re: Ask HN: How would you tunnel through GFW?

#3

Post by BR » Fri, Oct 02, 2009, 6:57 AM UTC

Once a new method is found, people will flood to it, then it will be noticed, and banned. Since GFW was created, this process happened repeatedly. So IMHO, there's no silver bullet.

Re: Ask HN: How would you tunnel through GFW?

#4

Post by neilc » Fri, Oct 02, 2009, 7:00 AM UTC

TOR still works fine -- you just need to configure it to use bridges. https://www.torproject.org/bridges

Re: Ask HN: How would you tunnel through GFW?

#5

Post by dryicerx » Fri, Oct 02, 2009, 7:00 AM UTC

Their blocking vpn and ssh even on non standard ports?

Don't know much about the Great Firewall, but I usually keep a SSH server listening on port 80 on a box, sometimes those hotels and company networks don't let anything other than port 80 outbound, and it has yet to fail me.

Re: Ask HN: How would you tunnel through GFW?

#6

Post by est » Fri, Oct 02, 2009, 7:00 AM UTC

All bypass methods can be categorized into two:

1. Methods that requires a 3rd-party server

2. Methods that do NOT requires a 3rd-party server

Currently mainland underground hackers focus on methods #2, and as far as I know 3 POC works fine through GFW on OSI level 3, 4, and 7, unless the target is an IP ban.

Re: Ask HN: How would you tunnel through GFW?

#7

Post by est » Fri, Oct 02, 2009, 7:05 AM UTC

dryicerx wrote: post #5

Their blocking vpn and ssh even on non standard ports? Don't know much about the Great Firewall, but I usually keep a SSH server listening on port 80 on a box, sometimes those hotels and company networks don't let anything other than port 80 outbound, and it has yet to fail me.

Theoretically GFW can do that, because SSH handshake has fingerprints that can be identified. But it will irritate every administrator on this world.

From a reliable source I heard they only ban SSH/VPN service if they can get a free account for testing. So if you are going to use SSH/VPN, make sure the provider do not serve free trials.

Re: Ask HN: How would you tunnel through GFW?

#8

Post by juvenn » Fri, Oct 02, 2009, 7:06 AM UTC

neilc wrote: post #4

TOR still works fine -- you just need to configure it to use bridges. https://www.torproject.org/bridges

Thanks, I will try this if I get free time, but Tor is difficult to configure.

And I can not even access the bridge link you gave.

Re: Ask HN: How would you tunnel through GFW?

#9

Post by cwan » Fri, Oct 02, 2009, 7:20 AM UTC

I use witopia.net - great service - but make sure you get the more expensive ssl package (and play around trying the various nodes). As others have said, it is truly the best $60 bucks I've ever spent if you're a frequent traveler in China. I use it to watch hulu, youtube, facebook, etc. Sometimes it's a bit slower than I'd like but I often find that using it I can get foreign sites faster than even going direct.

Re: Ask HN: How would you tunnel through GFW?

#10

Post by neilc » Fri, Oct 02, 2009, 7:27 AM UTC

juvenn wrote: post #8

neilc wrote: post #4

TOR still works fine -- you just need to configure it to use bridges. https://www.torproject.org/bridges

Thanks, I will try this if I get free time, but Tor is difficult to configure. And I can not even access the bridge link you gave.

Yeah, the TOR website is blocked by GFW, I believe. Basic idea:

1. Email bridges@torproject.org ; the body of the email should contain the line "get bridges".

2. In Vidalia Network Settings, click "My ISP blocks connections to the Tor network", and add the bridge IPs you got via email.