GoodbyeDPI: Deep Packet Inspection circumvention utility • Hacker News Board

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#121

Post by pelasaco » Mon, Jul 25, 2022, 1:35 PM UTC

tambourine_man wrote: post #118

pelasaco wrote: post #89

Earlier quoted context omitted.

> SSH is very simple and there’s almost nothing a SSH tunnel can’t do. You cannot disguise your SSH traffic mimicking HTTPS traffic which help you to bypass DPI solutions.. so its easy to block/filter/log your traffic or even pinpoint you in an adverse environment.

Please expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?

Why apache would care? We are talking about DPI solutions, aka deep packet inspection. They are normally deployed inline, and SSH tunnels are so often blocked, that in some solutions you have it one click away from you https://www.sonicwall.com/support/knowledge-base/how-to-bloc.... Other solutions try to make the traffic similar with Apache + Firefox to make it harder to be detectable and blocked by DPI solutions..

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#122

Post by tambourine_man » Mon, Jul 25, 2022, 3:47 PM UTC

pelasaco wrote: post #121

tambourine_man wrote: post #118

Earlier quoted context omitted.

Please expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?

Why apache would care? We are talking about DPI solutions, aka deep packet inspection. They are normally deployed inline, and SSH tunnels are so often blocked, that in some solutions you have it one click away from you https://www.sonicwall.com/support/knowledge-base/how-to-bloc... . Other solutions try to make the traffic similar with Apache + Firefox to make it harder to be detectable and blocked by DPI solutions..

Interesting, thanks. And would Wireguard be transparent to DPI?

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#123

Post by tambourine_man » Mon, Jul 25, 2022, 3:59 PM UTC

tambourine_man wrote: post #118

pelasaco wrote: post #89

Earlier quoted context omitted.

> SSH is very simple and there’s almost nothing a SSH tunnel can’t do. You cannot disguise your SSH traffic mimicking HTTPS traffic which help you to bypass DPI solutions.. so its easy to block/filter/log your traffic or even pinpoint you in an adverse environment.

Please expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?

@patrakov I can't reply to you directly.

If the only thing a web server could do is differentiate tunnel from direct IP connection with or without firewall/NAT, which are ubiquitous, it's an interesting effort, but a tour de force with little gain IMO.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#124

Post by pelasaco » Tue, Jul 26, 2022, 6:26 PM UTC

tambourine_man wrote: post #122

pelasaco wrote: post #121

Earlier quoted context omitted.

Why apache would care? We are talking about DPI solutions, aka deep packet inspection. They are normally deployed inline, and SSH tunnels are so often blocked, that in some solutions you have it one click away from you https://www.sonicwall.com/support/knowledge-base/how-to-bloc... . Other solutions try to make the traffic similar with Apache + Firefox to make it harder to be detectable and blocked by DPI solutions..

Interesting, thanks. And would Wireguard be transparent to DPI?

there are many implementations of DPI out there, each one with your own set of rules and heuristics... this discussion[1] talks about it, but the short answer is: it depends

References:

[1] https://www.reddit.com/r/WireGuard/comments/ajv0eq/wireguard...