21–30 of 33 posts
My brother was in Beijing for the summer, and he said the SSH tunnel I set up for him worked fine. It's possible that things have changed in the couple months since he's left, but I'd be surprised ... If you want to go really overboard, tunnel IP over DNS, ICMP, or some other common protocol ;-) (e.g. http://thomer.com/howtos/nstx.html )
All bypass methods can be categorized into two: 1. Methods that requires a 3rd-party server 2. Methods that do NOT requires a 3rd-party server Currently mainland underground hackers focus on methods #2, and as far as I know 3 POC works fine through GFW on OSI level 3, 4, and 7, unless the target is an IP ban.
There is also now DNS poisoning of high profile sites like Facebook and Twitter. So be sure to use a DNS proxy that is outside China.
This is where many people think wrong. GFW hijacks all UDP port 53 data, and OpenDNS fails like others. You MUST use a clean DNS server inside China or on localhost. Query DNS via IPv6/SSH/VPN/Socks/TOR/TCP.
Their blocking vpn and ssh even on non standard ports? Don't know much about the Great Firewall, but I usually keep a SSH server listening on port 80 on a box, sometimes those hotels and company networks don't let anything other than port 80 outbound, and it has yet to fail me.
Theoretically GFW can do that, because SSH handshake has fingerprints that can be identified. But it will irritate every administrator on this world. From a reliable source I heard they only ban SSH/VPN service if they can get a free account for testing. So if you are going to use SSH/VPN, make sure the provider do not serve free trials.
Honest to say, I could not afford another premium VPN service.
Once a new method is found, people will flood to it, then it will be noticed, and banned. Since GFW was created, this process happened repeatedly. So IMHO, there's no silver bullet.
Once a new method is found, people will flood to it, then it will be noticed, and banned. Since GFW was created, this process happened repeatedly. So IMHO, there's no silver bullet.
It's a coevolutionary arms race, it follows a predictable cycle of escalating attacks and defenses until a stable equilibrium is reached, or the environment changes. The thing is that in this case the government of China appears to have decided that it cannot afford to do without the internet; and that means that they cannot 'win' in the ultimate sense, as by allowing filtered communication they are opening a channel…
I use witopia.net - great service - but make sure you get the more expensive ssl package (and play around trying the various nodes). As others have said, it is truly the best $60 bucks I've ever spent if you're a frequent traveler in China. I use it to watch hulu, youtube, facebook, etc. Sometimes it's a bit slower than I'd like but I often find that using it I can get foreign sites faster than even going direct.
ssh tunnel always works for me
I thought the GFW worked by sending a RST to any TCP connection that it didn't like. If you ignore the RST then the connection goes ahead. Has that changed? http://www.cl.cam.ac.uk/~rnc1/talks/060628-Ignoring.pdf
Earlier quoted context omitted.
There is also now DNS poisoning of high profile sites like Facebook and Twitter. So be sure to use a DNS proxy that is outside China.
> So be sure to use a DNS proxy that is outside China. This is where many people think wrong. GFW hijacks all UDP port 53 data, and OpenDNS fails like others. You MUST use a clean DNS server inside China or on localhost. Query DNS via IPv6/SSH/VPN/Socks/TOR/TCP.
Though I think the best work-around is hosting a server outside of mainland china, and then tunnel through ssh or vpn. An EC2 might works here, but I've not tested it. If someone tested, please share us your hacking.
Thanks all.