Comment by neopallium | Hacker News Reader

Comment by neopallium | Hacker News Reader

Parent Full thread

I have found using ShadowSocks [0] to work best for me here in China. VPNs create one connection for all traffic (which is easier for China's GFW to detect/block/slow down). ShadowSocks creates a new TCP/UDP connection for each connection that it proxies.

My setup:

Cheap VPS server in Hong Kong [1] (5USD/month, 512 RAM, 2Mbit port) running the ShadowSocks server (libev version). I have upgrade the port to 20Mbits for an extra 10USD/month. The port could be upgrade to 50Mbits for 25USD/month.

For DNS I use ChinaDNS [2] to automatically filter out bad DNS results from China's censorship. It works by sending DNS queries to all multiple DNS server at the same time (give it a few local DNS servers and foreign DNS servers). The foreign DNS connections are tunneled through ShadowSocks.

ShadowSocks can work as a Socks5 proxy, tunnel or transparent proxy [3]. Socks5 is the easiest to use and can even do DNS lookups on the server. I use the transparent proxy [3] option, since it allows selecting which traffic should go over the proxy.

The socks5 option will try to proxy localhost & lan conections to the proxy server.

An optimized list of subnets can be generated using bestroutetb [4]. I load the subnets for China (can private LAN) into an ipset hash and use iptables rules to exclude those subnets from going over the proxy.

ChinaDNS [2] and bestroutetb [4] could be used for VPNs too. This could be used when trying to access different services (US, UK, etc..) that don't allow access from outside their country. Use one VPN for US and another for UK, then use bestroutetb [4] to build subnet lists for each country route traffic over the correct VPN.

0. https://shadowsocks.org/

1. http://www.36cloud.com/

2. https://github.com/shadowsocks/ChinaDNS

3. https://github.com/shadowsocks/shadowsocks-libev/blob/master...

4. https://github.com/ashi009/bestroutetb

edit: fix formatting and port prices.

As someone who is pretty much oblivious to how the censorship works in China: Why do you use such a slow and expensive VPS, and why Hong Kong?

I'll take my best shot at guessing his answers. The Great Firewall employs many techniques for censorship. The simplest block sites and poison your dns cache. Http packets are inspected to deterministically decide whether are block a connection.

Https is an improvement, but they still use machine learning to make estimates on encrypted contents of packets. If packets going to and from a location (i.e. Your vpn server) meet some criteria with some confidence, they perform attacks on that connection and subsequent connections To the same endpoint. I'm not sure on the specifics, but these attacks will cause ~90% of that connection's traffic to drop. The system is dynamic, so your countermeasures have to be as well.

I'm guessing HK because it's physically and politically close. It's considered Chinese territory, but not under China's GFW. I've heard from friends that GFW censorship is more aggressive around sensitive times (i.e. Tiananmen square anniversary) and news.

If any of this is wrong or inaccurate, someone please correct me. I'd love to have a better mental model of the GFW so that I could better work remotely from there.

I have read that the GFW will also try to fingerprint a server if packet analysis shows that it might be a VPN.

VyperVPN has a stealth protocol (Chameleon) which tries to obfuscate the VPN connection to make it look like other types of connections. Other VPN providers might be doing the same thing.

When I first came to China about 3 years ago, I tried using a VPN service but it wasn't reliable and connecting was always slow. So I tried running my own OpenVPN server on a VPS in HK (different provider [0]).

What I found at that time was that the GFW seemed to detect the VPNS's TLS connection and delay some packets which caused the connection setup to timeout. I even created my own obfuscating TCP tunnel (written in Lua) and tunneled OpenVPN through that. The obfuscation made OpenVPN work much better.

I still had latency issue when doing a long download. I later found out that the latency issue was caused by my VPS provider having a 2Mbit bandwidth cap on traffic to China from the server (they don't say anything about this limit or how much it would cost raise the limit on their website [0]). Also I found that if I apply the 2Mbit rate limit on the VPS server, then latency didn't go sky high (slowly growing to 10 or 12 second ping times before dropping again). It has only been in the last 3-4 months that I have known about this issue and moved to a new provider.

I started using ShadowSocks because it uses a protocol that doesn't have any easy to detect fingerprints (all of the data in the protocol is encrypted), so it doesn't really need obfuscation to hide the connection from the GFW. Also ShadowSocks creates many connections (one for each proxied connection), so even if the GFW delays some of the packets, it will not cause a stall of all connections.

But I think the biggest thing that I like about ShadowSocks is that it doesn't need time to setup a VPN connection, the tun0 device and routing rules. So when my laptop connects to a different WiFi network, everything just works (except I sometimes need to reset the DNS tunnels, but I could automate the reset).

0. http://www.vpshosting.com.hk/

I don't need a lot of server resources for the proxy. So the cheapest server is more then enough. The real issue is getting good latency & bandwidth to sites outside of China.

What I am paying for good latency & bandwidth on that server is cheap compared to other providers.

Hong Kong is very close to me (Guangzhou), so latency is low (around 9-10ms).

Here is the latency I am seeing right now:

1. Ping to DigitalOcean VPS server in San Franciso: 270ms

2. Ping to 36cloud.com VPS server: 10ms

3. Ping from 36cloud VPS to DigitalOcean VPS: 160ms

4. Proxy running on DigitalOcean VPS server in San Franciso: 274ms, DL: 3Mbits, UL: 4Mbits

5. Proxy running on 36cloud.com VPS server: 178ms, DL: 8Mbits, UL: 5Mbits

The last two are from using speedtest.net with the same speedtest server in SF. So the VPS in HK save me almost 100ms of latency. which greatly improves browsing speed.

Reply on news.ycombinator.com