Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the great firewall of China detects and blocks fully encrypted traffic [pdf]

gfw.report

Post reply on HN
Print view View original

41–50 of 289 posts

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#41

Post by __sy__ »

I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant?

Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when roaming around China, using a vpn to get to that shenzhen gateway. As far as I can recall, that always worked. This led me to believe that most of the vpn traffic analysis (and blocking)was done at the edge of the GFW and not inside of it. Again, this could be outdated by now.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#42

Post by apatheticonion »

__sy__ wrote: post #41

I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…

I tried to setup a shadowsocks server to bypass the GFW about 2 weeks ago. Server was hosted on my local network in Australia (with public IP), client was connecting from China (using the server IP).

It was blocked immediately and the client could not connect. I had several unknown IPs try to connect prior to the attempted connection.

I was stunned at how water tight the GFW is, it's really unfortunate as I would love to work/travel through China but cannot due to needing an active internet connection.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#43

Post by hughesjj »

cynicalsecurity wrote: post #32

Can you bring a Starlink and then just don't really care?

Nope. Starlink shuts down over china on the satellite side. Tesla has a huge presence there and they also threatened to shoot the satellites down (which they've done before) if starlink provided internet access there

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#44

Post by jongjong »

Ballas wrote: post #2

Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through. SSH is also exempt...

I was told that SOCKS proxies (which let you tunnel over SSH) are popular in China. It's super easy to setup and you don't need to install anything. You just need to SSH into any Linux EC2 instance outside of your network with ssh -D $port_number $username@$hostname and change a simple setting in your browser to proxy through that node using SOCKS5. It's nice because you still control the remote host (no need to trust some third party VPN) and the traffic is encrypted between your remote host and your local host (where it counts)... Anyone snooping would just think that you're SSHing into your EC2 instance for work purposes and not realize you're using it to browse the net.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#46

Post by __sy__ »

apatheticonion wrote: post #42
__sy__ wrote: post #41

I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…

I tried to setup a shadowsocks server to bypass the GFW about 2 weeks ago. Server was hosted on my local network in Australia (with public IP), client was connecting from China (using the server IP). It was blocked immediately and the client could not connect. I had several unknown IPs try to connect prior to the attempted connection. I was stunned at how water tight the GFW is, it's really unfortunate as I would lov…

Yeah pdf of report says that blocking is instant as of 2021. Also completely agree with the need for an active connection to do work. A lot of the software/hacker devs I knew have left China all together in the last 3-4 years. Inability to look up stuff reliably (even on working VPN providers) was one of the reasons cited by a few.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#48

Post by netheril96 »

jongjong wrote: post #44
Ballas wrote: post #2

Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through. SSH is also exempt...

I was told that SOCKS proxies (which let you tunnel over SSH) are popular in China. It's super easy to setup and you don't need to install anything. You just need to SSH into any Linux EC2 instance outside of your network with ssh -D $port_number $username@$hostname and change a simple setting in your browser to proxy through that node using SOCKS5. It's nice because you still control the remote host (no need to trus…

You were told wrong. If you uses SSH as a proxy, the connection will be slowed down to a crawl very soon. GFW distinguishes this from SSH command typing by looking at the traffic. This has been in place for at least a decade.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#49

Post by netheril96 »

apatheticonion wrote: post #45

Given HTTPS traffic is mostly permitted, could one obfuscate VPN traffic over http/3 (which I believe is UDP)?

Indeed a whole class of GFW bypassing tools are now based on masquerading as HTTPS. Trojan (TCP only), Vision (TCP only), Hysteria (UDP), just for some examples.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#50

Post by helen___keller »

WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

When I was in China in 2019, the VPN built into google fi actually got me around the GFW with zero effort. I didn’t even realize it until I caught myself checking American social media unhindered.

My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway.

Most people are not persecuted for using a VPN, I assume that’s reserved for people who the government already wanted to persecute and just need to give an excuse for why they detained their target.

Post reply on HN