Comment by GuB-42 | Hacker News Reader

Comment by GuB-42 | Hacker News Reader

Parent Full thread

There is that small country called China...

You are probably aware of the "Great Firewall of China" that blocks access from mainland China to Google, Meta, etc... Which means that if you are a westerner in China and want to access the internet as you know it, or if you are Chinese and access the rest of the world, then you need some kind of VPN to bypass the restrictions.

The Great Firewall is quite advanced, and you need some layers of stealth not to be detected and blocked. Furthermore, they actively search for VPN endpoints and block their IP addresses. It limits your choice of VPNs, and Mullvad is one of the good ones for that purpose, along with Astrill and LetsVPN.

Not in China, but in a similar country using DPI inspections to block. Neither Mullvad nor any other rank and file VPN works. Need to use something like xray to bypass.

Various VPNs allow to tunnel over SSH. If they don't want to block all SSH traffic, DPI is useless.

do you mean, xray to a vps and install mullvad on that vps? Tried that, but as soon as I install mullvad on a vps, I'm no longer able to ssh into it. Gave up, too complex.

What I understand is that they are using machine learning techniques to detect access patterns. Even if they don't understand the bytes because it is encrypted, they can match the sizes and timing of packets. So if the tunnel over SSH technique is common, and they detect a SSH connection that behaves in a specific way, for example because of fixed-size handshake packets, they can guess it is tunneling a VPN.

That was my experience.

When I was in China I would use my own VPN using ec2 and the now defunct Streisand (which uses stunnel). First few requests were always fast but as you use more bandwidth your requests would start to slow down considerably.

Oddly a foreign sim gets uncensored internet, so that's what I've recommended to travelers, but haven't been back since COVID so that might be outdated info.

Reply on news.ycombinator.com