Does anyone know if there is technology out there which would allow for VPN traffic to blend in with other traffic, or to bypass DPI in any way?
SSL VPN, but it would likely be targeted anyway.
China Cracks Down on VPN Services After Censorship System ‘Upgrade’
11–20 of 94 posts
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#12Earlier quoted context omitted.
I was in Shanghai last month & in previous years bypassing the firewall was not too much of a hassle. When I arrived in Shanghai for the holidays this year my old VPN provider didn't work anymore, plus they added DNS poisoning and bandwidth throttling. I actually upgraded TO StrongVPN, which seems to be one of the affected VPN services now. My conclusion was that it has become effectively impossible to run a western…
Uhm, many of the larger companies have direct connections out of China that don't cross the GFW, even Chinese companies. If you are important and rich enough...
Yep, as always money buys everything in China. I was wondering how the smaller indie IT people do it though: to me it just seems like a cat-and-mouse game not worth the effort.
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#13This has been going on for some time now, I'm surprised it is being reported again now. Rule of thumb.. if someone can work out what you are doing by launching Wireshark, so can a nation-scale IPS system a la Great Wall
That's true but just to be clear, they are not blocking VPNs at protocol level but "manually" blocking the IPs of specific providers. They do the same with Tor: block all public Tor relay IPs.
My own VPN instances have been shot down within a couple of days of use, definitely IPS-style behavior.
I can't comment on commercial providers, but the capability to autoblock common VPN protocols is definitely there.
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#14Earlier quoted context omitted.
That's true but just to be clear, they are not blocking VPNs at protocol level but "manually" blocking the IPs of specific providers. They do the same with Tor: block all public Tor relay IPs.
My own VPN instances have been shot down within a couple of days of use, definitely IPS-style behavior. I can't comment on commercial providers, but the capability to autoblock common VPN protocols is definitely there.
Interesting, I didn't know they did that. I've been running my own VPN as well for a couple of years without problem. Is it possible you were running Tor on your server or something else got you blocked (some AWS IPs seem to get blocked for no apparent reason)?
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#15Now is another good time to remind people of projects like Streisand[0], who make setting up censorship avoiding tools simpler that they otherwise would be.
Streisand in particular provides various tools for masking VPN traffic as HTTPS (Stunnel/SSLH et al) that may prove useful during crackdowns like this. As well as setting up things like a tor bridge.
One note, there is currently an issue with the Digital Ocean provisioning, which prevents it from completing initial setup, but I have easily and successfully setup instance on Rackspace and AWS recently.
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#16I'm living in Shanghai. Still connected fine over a IPSec tunnel. I run my own VPN server on Rackspace/AWS (only 2 public IPs), the connection is and has been relatively stable (about a year). 12MBit/s from Shanghai to the IPSec server in Hong Kong, 38ms consistent ping (100MBit/s connection). Using a Cisco SMB router, so the connection is pure IPSec and standard ports.
How do you handle access from mobile devices? I found managing a VPN (from iPhone) more trouble than it's worth. Moving between networks often dropped the connection long enough to kill the VPN.
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#17Earlier quoted context omitted.
My own VPN instances have been shot down within a couple of days of use, definitely IPS-style behavior. I can't comment on commercial providers, but the capability to autoblock common VPN protocols is definitely there.
Interesting, I didn't know they did that. I've been running my own VPN as well for a couple of years without problem. Is it possible you were running Tor on your server or something else got you blocked (some AWS IPs seem to get blocked for no apparent reason)?
No, just OpenVPN, and from the searching I did at the time, this is a well known problem.
These days I just tunnel over SSH or even remote desktop into a remote server.
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#18This is the reason I no longer work from Shanghai. Attempting to do anything in the tech spave while constantly playing cat and mouse got to be such a productivity killer that it was becoming impossible to work. You'd rarely know if failures were because of some Firewall nonsense or something else. It's a tragedy really. I am one guy, but I've since hired several developers and my little company is gaining traction -…
You are not alone. According to reports, many IT businesses relying on stable internet connection have moved away from China Mainland to other countries of Asia like Singapore. The problem is, government doesn't actually care. They see political stability as the top priority. To achieve it, they are willing to sacrifice foreign business chances.
Any link to such reports? Curious to see
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#19I'm living in Shanghai. Still connected fine over a IPSec tunnel. I run my own VPN server on Rackspace/AWS (only 2 public IPs), the connection is and has been relatively stable (about a year). 12MBit/s from Shanghai to the IPSec server in Hong Kong, 38ms consistent ping (100MBit/s connection). Using a Cisco SMB router, so the connection is pure IPSec and standard ports.
How do you handle access from mobile devices? I found managing a VPN (from iPhone) more trouble than it's worth. Moving between networks often dropped the connection long enough to kill the VPN.
Maybe you can try the Shadowsocks browser app from the App Store.
It has a public SSH tunelling proxy. You can also use your own server settings if you have one.
Works pretty well for basic web stuff.
Re: China Cracks Down on VPN Services After Censorship System ‘Upgrade’
#20Earlier quoted context omitted.
How do you handle access from mobile devices? I found managing a VPN (from iPhone) more trouble than it's worth. Moving between networks often dropped the connection long enough to kill the VPN.
Maybe you can try the Shadowsocks browser app from the App Store. It has a public SSH tunelling proxy. You can also use your own server settings if you have one. Works pretty well for basic web stuff.
Thanks. That's cool & would alleviate the pain a bit I guess. The thing that drove me nuts is that Slack was blocked, but I guess I could have run that from within a private browsing app like the one your recommended.