Hacker News Reader

Comment by jvanderbot | Hacker News Reader

How, technically, can they block wire guard? It can operate as pure UDP on any port. Are we referring to wireguard vendors like tailscale here?

View on HN

China uses statistics, entropy of packets and other DPI-like methods[1],

also HN discussions of it[2]:

[1] https://gfw.report/publications/usenixsecurity23/en/

[2] https://news.ycombinator.com/item?id=36531485

The protocol has a defined structure (check out 5.4.6 in [1]), and can therefore be detected and blocked. It's probably easier to block than a TLS VPN, which has a lot of typical TLS noise to hide in.

[1] https://www.wireguard.com/papers/wireguard.pdf

What about something like udp over tcp?

This is the first (that I know of) public conversation about this and goes into detail about the various problems with obfuscating WireGuard.

https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184...

The reply https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185...

... is pretty informative. There is a PSK mode, which really should be essentially indistinguishable from random UDP packets. But I haven't read deeply enough. I do PSK on all my networks, but that has its own disadvantages. I honestly thought that was the only way to do wireguard.

This is what I was wondering. I don’t understand these VPNs too deeply (though I do occasionally administer an OpenVPN setup), but I was under the impression that they’re sending encrypted packets over UDP on arbitrary ports. That seems quite tough to analyze and block.

> That seems quite tough to analyze and block.

Why analyze when you can whitelist?

Ok fair. The approach might be block everything except https/tcp.

In which case what we need is https side channel VPNs.

I would have thought psk mode would have encrypted the entirety of the initial handshake

maybe not

Wireguard headers are fingerprintable.

Reply on news.ycombinator.com