Hacker News Reader

Comment by abstractbarista | Hacker News Reader

Looks like it's mostly DNS-based. Meh. But still, this underscores the importance of operating your own VPN if you want to maintain comms through the silly twitches of a gov't like this. The biggest VPN providers are the first to be targeted. Even just having an SSH host outside the country will do fine.

On another note, I recently set up a Tor bridge with pluggable transports to help those in choked areas. It was a fun homelab challenge, and a good way to spread my privilege of having a free connection.

View on HN

A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

ssh over https, using proxytunnel works really good too. Looks like regular https traffic. And in addition to forwarding individual ports, openssh also has full vpn capability using tun/tap devices.

And you can still serve a regular https website from that same server!

>simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

Sounds like security theater. Using port knocking isn't going to hide the fact there's a SSH connection between you and some server. If anything, having a non standard configuration (non standard port number or port knocking) makes you more suspicious.

I think you overestimate the desire, motivation and technical capability of sri lankan ISPs to start doing netflow analysis and DPI on individual subscribers' end user connections.

Unless you were to attract the attention of somebody in government, and they forced an ISP to escalate an issue to the 3rd or 4th tier of network engineering running the core of the bigger ASes there, they're not going to be doing that. It's not the chinese GFW.

Not only this, but there's a massive difference between stopping people from accessing the web via VPNs and stopping people from SSH'ing into their servers. You block SSH access and you're probably going to take a financial toll Country wide.

Assuming that nobody in Sri Lanka is implementing DPI on ISPs' edge interfaces, the safer solution would be to run your own vpn endpoint hosted in the USA or Europe, as openvpn in tcp mode, or wireguard, on port 443. Without pwning your client device, they're technically incapable of properly MITMing TLS1.2 and can't break the internet so thoroughly by blocking https/port 443 traffic (which would also break gmail, all other popular webmail, and a huge chunk of everything else with hugely popular public websites where port 80 is redirected to 443 for TLS end-to-end).

So unless somebody cares to inspect your traffic flow in particular and notices that it's openvpn traffic on 443 and not normal TLS1.2 traffic, it's likely to work.

I have a feeling theyve done some form of traffic analysis. My default open vpn setup on a digital ocean box with the port changed to 443 is blocked somehow with both major ISPs here.

are you using openvpn in tcp or udp mode? the default udp is pretty easy to block even if it's on 443, the tcp requires somewhat more DPI.

Tried tcp too. Weirdly it refused to work. Haven't been able to fully check for configuration errors on my end here but i can't think of anything I did wrong either :)

It's also very much possible that the entire digitalocean /22, /20 or even /18 sized chunk of ipv4 space it's in has just been null routed, due to the documented presence of other VPN endpoints in it.

The easiest way to roll your own, securely: https://github.com/StreisandEffect/streisand

Algo is better than Streisand. https://github.com/trailofbits/algo

How?

From what I can see, it's only for setting up a VPN provider, nothing else like Tor etc. (that may attract unwanted attention). It supports IKEv2 which isn't blocked by a lot of firewalls and supports far more VPS providers than Streisand.

Interested in a comparison. I’m currently using Streisand.

I have my vpn served via port 443 on a server that also runs a website on that same port. But I think there's better ways to make it hard for attackers to block me.

> DNS-based

Firefox has build-in DNS over HTTPS. That will help.

Until they block the DoH ips bundled in Firefox

There are other DoH providers.

Reply on news.ycombinator.com