India mulling over banning VPNs forever | Hacker News Reader

India mulling over banning VPNs forever

medianama.com

35 pointsBrajeshwar10 comments

If they want to kill off remote work by people who are required to use VPNs to access corporate networks then they should go right ahead. With the pandemic raging still and workers that do remote work from their homes instead of the offices it will only harm the economy more there. No U.S. corporation will allow anyone overseas to connect without a VPN.

Practically speaking, it would not apply to business VPNs. No jurisdiction that 'bans' VPNs today prevents businesses from connecting to their enterprise LANs. No government is so stupid to break commerce in their jurisdiction.

This is about individuals, and blocking most consumer VPN services is not that difficult. Naive DNS filtering would work against the leading VPN providers domains.

"No government is so stupid to break commerce in their jurisdiction. " there are many stupid governments

It is difficult for old politicians to understand the difference between securing your device networking & harping national security concerns. Similar to I guess playing video games from China backed companies is not okay but enabling him-grown startups to take VC money from Tencent is okay.

Can't one just rent a VPS on some random provider and run a VPN server on some random port or does it go deeper than that?

Or maybe just RDP to a rented windows VM and go from there.

This would probably work. I can bypass network filters by just running my own OpenVPN on standard VPN ports, because it only blocks known VPN servers and performs no packet inspection or port blocking. If that's done, you might have to use TLS- port 443- then hope the deep packet inspection doesn't get you.

Ultimately they want to go for the low hanging fruit with little effort. Blocking common VPN servers takes a few minutes to do and maintain. Anything more and you've got to spend real money on packet inspection on possibly an entire country's bandwidth.

Is this possible to do, technologically speaking?

The Chinese firewall seems to be able to detect VPN packets (not decrypt, just detect them) and drop them, so even trying to connect is annoying.

I guess people could use SSL VPN and pretending to be HTTPS, but the detector might be able to detect patterns and realize it's not HTTPS traffic.

Hard - Impossible. China Already tried to do this in some capacity with deep packet inspection/ Only allowing HTTPs and such. People just circumvent this by just routing data thru HTTPS.

Ofcourse you can block IPs of popular VPN providers decreasing accessibility but it'd be impossible to stop it completely.

Though this would easily restrict the majority of non-tech savvy individuals while doing nothing

Wikipedia [1] documents some methods.

[1] https://en.m.wikipedia.org/wiki/Great_Firewall#Blocking_meth...

Yes. DPI (Deep Packet Inspection) can occur on network boundaries and filter out traffic on practically anything you can imagine. Blocking VPN IPSec traffic is easy.

Note, it probably requires installing or configuring network bottlenecks for filtering. Getting the topology correct is harder than the actual filtering, which is a standard feature on enterprise and isp networking hardware.

State of the Art is the Chinese GFW -- it can do things like:

* look for keywords in tcp packets and reset connections

* block whole protocols based on attributes (such as encryption parameters), Tor is always playing cat and mouse here and generally blocked

* detect if an encrypted ssh session is being used to tunnel traffic, and reset the connection at both sides with a TCP Reset flag.

* modify http traffic to send malicious js to browsers to attack other servers

Reply on news.ycombinator.com