1. Which has an alternative open source client – http://www.infradead.org/openconnect/
One of the things I've wondered about, and I hope people more informed than me will forgive my ignorance, is whether it's possible to implement a VPN protocol that looks like ordinary HTTPS traffic. I know very little about the specific mechanics of network protocols so the very premise might be nonsensical but I would appreciate an explanation of why this might or might not be possible.
For one thing, OpenVPN uses UDP on port 1194 by default due to technical issues running TCP over TCP. You can switch it to use TCP and run it on port 443, but the underlying VPN traffic usually doesn’t have the same pattern as a typical http connection so it is discernible from https via side-channel attacks. You can try obfuscating the traffic but my guess is that makes it look even less like https.
References:
- http://sites.inka.de/~W1011/devel/tcp-tcp.html
- https://wiki.wireshark.org/OpenVPN
- https://github.com/OpenVPN/openvpn/pull/3
- https://community.openvpn.net/openvpn/wiki/TrafficObfuscatio...
- http://blog.zorinaq.com/my-experience-with-the-great-firewal...
For example, ssh is not blocked. However, use ssh -D to proxy web traffic through your connection, and the whole connection will hang in short order.
Experiences with the GFW is perhaps the starkest example of YMMV I've seen yet in the world of computing.