VPN services blocked in Sri Lanka as information controls tighten

ssh over https, using proxytunnel works really good too. Looks like regular https traffic. And in addition to forwarding individual ports, openssh also has full vpn capability using tun/tap devices.

>simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

Sounds like security theater. Using port knocking isn't going to hide the fact there's a SSH connection between you and some server. If anything, having a non standard configuration (non standard port number or port knocking) makes you more suspicious.

Assuming that nobody in Sri Lanka is implementing DPI on ISPs' edge interfaces, the safer solution would be to run your own vpn endpoint hosted in the USA or Europe, as openvpn in tcp mode, or wireguard, on port 443. Without pwning your client device, they're technically incapable of properly MITMing TLS1.2 and can't break the internet so thoroughly by blocking https/port 443 traffic (which would also break gmail, all other popular webmail, and a huge chunk of everything else with hugely popular public websites where port 80 is redirected to 443 for TLS end-to-end).

So unless somebody cares to inspect your traffic flow in particular and notices that it's openvpn traffic on 443 and not normal TLS1.2 traffic, it's likely to work.

Until they block the DoH ips bundled in Firefox

Algo is better than Streisand. https://github.com/trailofbits/algo

Thanks. I'll be taking a look at tunelling soon. The material around it is difficult to read and put together to be honest.

I'm right now using Nord via their ovpn files. Somehow it made its way through one ISP ruleset.

For my digital ocean box, I asked someone else to use tunnelblick with the ovpn file I provided them to see if it worked (they were in another country) and it worked. This makes me believe it's most likely a country level issue.

In general though I'd like to learn about networking more thoroughly and set up a censorship resistant option which I can help others to setup and share as well later on. Any primers/pointers are appreciated too. I'll start with all the things you mentioned though.

OpenVPN iirc has a custom negotiation protocol which happens before TLS and is probably the vector used for detection.

In China, most of the solution would be cut down after days/weeks/months. Although the connection was encrypted, GFW would still try to guess if the connection behaviors match some VPN features according to some algorithms, then cut it down.

Currently, I'm using Algo[0] setting up VPN and use Wireguard[1] connect to it, both of them are working perfectly than other solutions I have used.

[0] https://github.com/trailofbits/algo [1] https://www.wireguard.com/

Can you share more on this?

Here's some possible evidence that they're alive and well.

https://translate.google.com/translate?hl=en&sl=zh-CN&u=http...

If he's referring to China, sadly he probably won't live to see that day.

Fortunately for people who care about the health of the internet, I doubt that the Sri Lankan government has the technical acumen or sufficient budget to operate anything similar to the Chinese GFW's DPI abilities.

HN discussion really is useless these days.

So I'm not sure what question you're asking if someone has put thought into, but assuming it was "What do they hope to achieve by this?"

shakes Magic 8 ball

My guess is it's a combination of what the Sri Lankan poster above mentioned combined with a reaction to further technical escalation by the citizenry.

Unfortunately, there are too many unknowns w.r.t. Sri Lanka's government/cultural values for me to even hazard a guess as to what the endgame is beyond minimizing net driven attempts to organize.

What I do see potentially transpiring, however, is someone figuring out how to host basic net based communication within the country; odds are though, the government feel themselves sufficiently equipped to take down in country rabble rousing, and possibly aim to keep outside influences from inflaming things further.

Best thing you can do if you want to get out, is find the IP addresses for your particular of site, and use that. DNS based blocking does squat if you're maintaining your own registry of IP->Domain Name bindings. If they catch on and start trying to IP block, well, welcome back to the pre/early internet days. Hopefully you know someone willing to host you a forwarding proxy.

Stay safe Sri Lanka folks.

Sometimes people just don't like each other, due to prejudice, differences in religion, some old beef between clans / ethnic groups / regional groups. This may have no relation to the government being oppressive or liberal.

Shutting down communication channels rarely helps defuse such situations, though. It leads to more isolation, more rumors, more enmity.

"I felt this to be reasonable" haha ....

Update: social media isn't blocked anymore. Six days in total - reasonable enough, I think.

Yeah, I'm specifically pointing to the idea of leveraging HTTP/2's multiplexed streams to embed VPNs into the same connection as normal web traffic from CDNs. Things like 1.1.1.1 Warp don't attempt to hide the fact that they're a VPN and thus wouldn't really help with what I'm talking about.