15 ms·

I was visiting China recently (my first time there). I thought bypassing The Great Firewall was going to be as simple as an "ssh -D" SOCKS setup, or a "ssh -w"

by mrb 11y ago

I was visiting China recently (my first time there). I thought bypassing The Great Firewall was going to be as simple as an "ssh -D" SOCKS setup, or a "ssh -w" tunnel. Oh boy, I was wrong. If you try this, or even a basic OpenVPN setup, you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out. After some research I read online the government does deep packet analysis and uses machine learning to find heuristics to guess which TCP connection or UDP stream is likely being used as a VPN. When they think there is a high probability a VPN is detected, they simply start dropping all the packets. Encryption is not enough. You need to disguise your VPN traffic to make it look like standard HTTPS sessions (since they don't block HTTPS). For example in a traditional HTTPS session, if the client browser downloads, say, a 500kB image over HTTPS, it will send periodical empty TCP ACK packets as it receives the data. But when using a VPN that encrypts data at the IP layer, these empty ACK packets will be encrypted, so The Great Firewall will see the client sending small ~80-120 bytes encrypted packets, and will count this as one more sign that this might be a VPN. That's why people in China have to use VPN tools that most westerners have never heard of: obfsproxy, ShadowVPN, SoftEther, gohop, etc. All these tools try to obfuscate and hide VPNs. I have a lot of respect for all these Chinese hackers like clowwindy who try to escape censorship, as it takes more technical prowess than you think to design a VPN that works in China.

usaar333 11y ago
How do multinational companies' china offices get through the firewall? For example if my company uses Google apps, how do I ensure that my china office has access?
- deleted 11y ago
  [deleted]
- hipaulshi 11y ago
  As far as Microsoft office in Beijing, I think they VPN to their Tokyo office first. Their traffic is ensured by negotiating directly with the big telecom company. Disclaimer: I do not work for them.
  - nialv7 11y ago
    This is correct Source: worked there for a while
  - chobo 11y ago
    This is interesting, I'd love to read/hear more about it. Is the negotiation an above-board thing? What are the conditions and costs to getting this kind of exception ensured?
    - gozo 11y ago
      From what I've heard, it's something like 100 000 USD a year for a 100 Mbit connection.
      - motoboi 11y ago
        Funny thing is: this is the same price payed in Brazil for a 100mbps MPLS link.
- bitinn 11y ago
  Not all VPN services are censored, and not all VPN protocol triggers the reset. But you can bet whatever you get for free (thus likely popular), will get banned soon enough. OpenVPN is like a prime suspect of a police procedural novel, it gets hunt down no matter what. Personally experience: I did work for Microsoft Shanghai and VPN works just fine. You need to have the right set of tools, and better, have a good channel of negotiation with the government.
- mcbridematt 11y ago
  Pay one of the telcos (i.e China Unicom) for an MPLS circuit out of the country. Also, international performance in general can be quite bad at peak times (i.e 30% packet loss), I suspect due to Comcast-style management of international transit. But if you buy a transit circuit from Unicom, no problem! Edit: to add to the grand parent, I've actually found ssh -D/-w0 (for a TUN device) quite reliable from China. What I really want to do is run multiple connections from different end points with a routing protocol to do fast-failover.
  - badpenny 11y ago
    > Pay one of the telcos (i.e China Unicom) for an MPLS circuit out of the country. Don't suppose you could explain to us network plebs how that would bypass the Great Firewall?
    - eitally 11y ago
      It's a private network/route with traffic containing nothing but corporate data. Most multinationals facing this situation route out through HK, with a secondary failover usually in Taiwan or Singapore. Works a treat, but is costly and latency can be subpar. It also doesn't solve the problem of mobile access to Google Apps for Chinese workers (Google Play Store & apps are not bundled by many (any?) Chinese OEM handset makers or carriers. You can root & sideload, or you can purchase phones outside the country and ship them to your employees, but even if you do this, there is still no guarantee they'll be able to access Google's apps while on cellular networks.
      - gozo 11y ago
        Google Apps will drain your battery when they can't access Google's servers. Roaming with a China Unicom Hong Kong sim card, like the cross border king, will give you gfw free access.
        kuschku 11y ago
        > Google Apps will drain your battery Google Apps will also drain your battery if you are in a region where Google has no network-location data yet, because then Google will turn on your GPS, and send to their servers the pair of GPS-coords and strength of networks. If you live in a suburb in Germany where almost no networks are known to Google, this means if you enable location services your GPS will try to get a fix 24/7, eating your battery in about 2 hours. This is probably going to be an issue in China, too, considering that Google doesn’t have location data there.
- mirimir 11y ago
  I've heard that commercial DCs and high-end hotels are less censored.
  - dawson 11y ago
    I'm in the Sheraton in Qingdao atm, and it's definitely less censored, I can access YouTube and Google Apps just fine; where as earlier today from a business down the road these websites were all blocked.
- a-saleh 11y ago
  We have colleagues in china and generally speaking, you find an alternative, and host it on premise. I believe this is the reason why they use Atlassian[1] products, where rest of us would use trello, e.t.c. [1] company that created jira
  - tajen 11y ago
    Aren't there a dozen of bugtrackers, intranet collaboration software, CI tools and git hostings that they could download and install? What's so special with the Atlassian products?
    - LoSboccacc 11y ago
      those sucks a little less than, say, bugtraq, offer enterprise support on premises which you'd never use but you need to do the purchasing when you go for a big company and kind of have a big recognized name for their customization support even if their whole stack sucks.
      - a-saleh 11y ago
        I think the "enterprise support on premisses" is the main deal, along with the fact that we have already used it for some of our big projects.
- chefkoch 11y ago
  Register your VPN with the authorities. We are atm doing this for a office in Beijing.
  - rahimnathwani 11y ago
    Is the primary purpose of your VPN to bypass GFW, or to provide access to your corporate network? I guess the latter would be considered a good reason.
    - chefkoch 11y ago
      yes, mainly to access the corp network.
liquidcool 11y ago
I'm curious, what is the risk of getting caught, and what is the penalty?
- tinydog 11y ago
  I am a native Chinese. I was threatened by the police because of publishing a unfair treatment from a decree of local magistrates. The police said that I had to delete all of them, otherwise I would be brought into jail and my parents would lose their job. At that time, I was only 16. I don't want to live in this country anymore but I have no choice. I love China but the government.
- imaginenore 11y ago
  Spending on what you do, detainment, torture, death.
thaumasiotes 11y ago
I have a good amount of recent experience with this. I found that it wasn't just a matter of your connection getting blocked; if you leave it up you'll experience some unreliable good periods (so, say, a torrent would download through the VPN overnight without a problem, but if I wanted to use the internet at any particular time, my connection was unlikely to be working). But yeah, I ended up signing up with Astrill.
loser777 11y ago
Very interesting... I was just in China recently and was sshing into a box I had in the states for an impromptu SOCKS proxy. I did notice that things would work fine for up to an hour or so before things started bogging down. I would start seeing "channel x: open failed..." errors. However, closing the session and reconnecting would fix the problem... until it started lagging out again. I thought it was just a consequence of being on spotty < 5mbps(ADSL?) connections. The internet situation was barely tolerable for a few weeks stay; I can't imagine what living in these conditions 24/7/365 is like.
- halfelf 11y ago
  Working in such network 24/7/365 means I have to spend about $90 per year on my vpn service, and keep vpn connection all the time when working. (otherwise google and SO will not come to save me from problems.)
- auganov 11y ago
  Yea, in my most desperate I wrote a script that opened ~10 connections and kept restarting them and used HAproxy as a frontend. It was maybe helping, but honestly, I couldn't tell. Luckily I discovered shadowsocks soon after that.
- ColinWright 11y ago
  I'm always brought up short when someone says/writes "24/7/365" because it really doesn't make sense. "24/7" means 24 hours a day, seven days a week. "24/365" means 24 hours a day, 365 days a year. "24/7/365" means 24 hours a day, 7 days a week, 365 weeks a year? I know, I know, it's become an idiom, and it's like "I could care less", and you can't try to understand it except as an atom that caries a meaning, but it just looks wrong to me. Sorry - I'll now return you to your regular programming.
  - nesyt 11y ago
    24/7/365 is dead. Long live 24/7/52!
  - sbarre 11y ago
captainmuon 11y ago
I've had almost the opposite experience. VPN sort of worked, but I could not open a single HTTPS connection. The VPN problems I had I could trace to a bad WiFi connection (I had to lower my MTU and it worked fine). Now, on previous trips I experienced what you mentioned. It seemed really like there was some machine learning going on, and after using a VPN for a while the connection would get bad. But I guess it might not be machine learning, there might just be a huge number of humans watching your traffic - which would explain why it is so inconsistent. The thing that worked best for me is just using ssh -D (on most days). Our workplace uses ssh a lot for secure communication with outside china, so that couldn't possibly be blocked without hindering our work (and I believe 'they' have no interest in that). So whenever I had to access something for work that was sillily blocked (argh gmail), I just used the ssh connection that was open anyway.
- bitinn 11y ago
  Actually this is classic daily life of a chinese netizen: you are never quite sure what the cause of your network woes is (not without spending time digging into it). Is it due to ISP QoS, or is it reset by GFW, or is it just mere network failure? And what most ppl do when facing this? They choose a local service instead of Twitter, Facebook, Youtube, Google. See, censorship is only a part (though a vital part) of the grand scheme.
berkut 11y ago
Back in 2006/2007 when I was doing web development, I knew a few people at F5 and Zeus Technology (developers of application firewalls at the time), and they said The Great Firewall was using loads of F5 tech with deep packet inspection for all data. I assume 9 years later (don't know what the modern tech for web stuff is these day, but I assume encryption plays a key part) they're doing just as intrusive inspection and filtering of data.
Laforet 11y ago
This might sound a bit counter intuitive but they really hate OpenVPN and SSH tunnels - not to mention they are trivial to detect and the process is highly automated. Traditional VPNs such as PPTP/IPsec as well as various forms of obfuscated proxies are generally not interfered with unless something major happens. A lot of the alleged "censorship" are actually symptoms of high latency and packet loss on home connections.
- kijin 11y ago
  I suppose that means OpenVPN and SSH are too secure for the Chinese government to eavesdrop on. PPTP, on the other hand, has been known to be insecure for ages. So... could you avoid detection by passing an SSH tunnel through a PPTP VPN? Add enough layers, and the censors might not bother to unwrap all of them.
  - Laforet 11y ago
    Yes you can. Shadowsocks was intended for the similar purpose of tunnelling traffic and it is a bit more flexible than GRE-based VPNs
  - rsy96 11y ago
    Given that most US websites are now over HTTPS, breaking PPTP won't actually give Chinese government much information to eavesdrop on. They may know that someone is accessing Google or Twitter, but they cannot know the actual keywords or tweets they are reading. Note that Chinese government does not have backdoor access to those US websites, nor do they control a significant fraction of Internet infrastructure.
    - giodamelio 11y ago
      What about Chinese signed root certs?
      - rsy96 11y ago
        That is why it is recommended to untrust every Chinese CA from your system. It won't affect daily browsing even for most Chinese users. The super majority of Chinese websites, even state owned ones, buy certificates from US companies.
edwinyzh 11y ago
"Thanks" to the Great FireWall by one of the evilest governments, I might have to finally give up Gmail after many years struggling using it with the help of a wide variety of GFW-fighting tools. My deepest respect to all the authors.
aosmith 11y ago
Spoofing GGP tends to work very well in these situations.
Aoyagi 11y ago
What is this supposed to mean? https://github.com/clowwindy/ShadowVPN https://github.com/clowwindy/ShadowVPN "Removed according to regulations."
- fredoliveira 11y ago
  Did you miss the original link? https://github.com/shadowsocks/shadowsocks-iOS/issues/124#issuecomment-133630294 https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is...
  - Aoyagi 11y ago
    As a matter of fact I did, thank you. Let me just find the nearest cliff to jump off.
olalonde 11y ago
> Encryption is not enough. I use an unencrypted PPTP VPN and the connection is really fast and stable here (Shenzhen, China Telecom). I have tried OpenVPN and ssh but both were much slower. FWIW, I don't believe using a VPN is illegal in China (though operating a VPN service without a license most likely is) and pretty much every single foreigner I know uses one.
- deleted 11y ago
  [deleted]
- oliwarner 11y ago
  Per the other comment, MS-CHAP2 is crackable. The PRC govt is probably happy to encourage people to think they're secure using it.
  - olalonde 11y ago
    Yes, that was my point. They are happy to let people circumvent the firewall as long as they're still able to read the traffic.
- Bromlife 11y ago
  PPTP is not secure. You need to open another, more secure, tunnel within your PPTP session.
- caiych 11y ago
  According to a recent file. Using a VPN isn't illegal. But hosting an unregistered VPN service in China is illegal. And the right of using an unregistered VPN service is not guaranteed.
0xFFC 11y ago
I am in Iran , you cannot believe it , same here , They use deep packet inspection too, they will shut every package down. every open vpn , cisco vpn , etc connection will lose connection every 2-3 min . Connection to outside web is almost impossible. I have noticed they have multiple situation, for example when everything's quiet internet is not so bad (despite the fact bandwidth is extremely low for huge amount of people), but when some news came out about government corruption, guess what ? some vpn does not work . In 2009 green movement they closed every https connection.(maybe that was red alert situation) p.s : https://en.wikipedia.org/wiki/Deep_packet_inspection https://en.wikipedia.org/wiki/Deep_packet_inspection p.s. : I use vps from netherlands for bypassing firewall. but It takes huge amount of time and a little money.but the point is 99.999% people don't have this option (I use shadowsocks, sometimes another tunnels) so they use internet the way is or some software like freegate and other but with extremely low speed unbearable lag. p.s. : pptp, l2ps and others are closed right now. even president rohani couldn't manage the situation . I have heard he did want to do something but supreme leader and his people stopped him.
- yyhhsj0521 11y ago
  I heard rumors that that before Halal Internet was launched the censorship of Iran was relegated to Huawei, the same company that builds and maintains the Great Firewall...
  - 0xFFC 11y ago
    Yes , I have heard it too . halal internet not going to launch , because Rohani is not believe in it and tries to postpone it every year(maybe they have technical issues too , I don't have information) . all military site's have ethernet and connect to each other with it.
- geff82 11y ago
  wish you all the best. I pay 5$ for a digitalocean droplet to provide my family in Iran with an OpenVPN connection. This works quite well, we do not have any issues so far.
- dujiulun2006 11y ago
fyolnish 11y ago
When I was in China last year I had no problems using OpenVPN on my Holland based server.
- njloof 11y ago
  Hotel WiFi may not be as restricted as the average citizen's connection. Local 3G/4G service may be more restricted than your home provider's roaming service. It's a bit of a crapshoot, but the GFW is definitely targeted more towards locals than visitors.
nly 11y ago
Sounds like an overseas vendor needs to drop a blanket of satellite internet coverage over mainland China.
- melling 11y ago
  Sounds like you live in a world where you didn't notice that China became the second most powerful economy, and which will become the most powerful economy within a decade or so. Of course they're going to have the military to go with that: https://en.m.wikipedia.org/wiki/2007_Chinese_anti-satellite_missile_test https://en.m.wikipedia.org/wiki/2007_Chinese_anti-satellite_...
  - nly 11y ago
    The great firewall is a cowardly, non-confrontational technical infrastructure. I don't see China using a multi-billion$ missile system to shoot down a harmless foreign communications satellite that also served people outside of China. They're smarter than that.
    - melling 11y ago
      You have no idea what you're talking about: http://www.history.com/this-day-in-history/chinese-counterattacks-in-korea-change-nature-of-war http://www.history.com/this-day-in-history/chinese-counterat... http://nationalinterest.org/feature/deadly-lessons-the-last-time-china-america-went-war-11558 http://nationalinterest.org/feature/deadly-lessons-the-last-...
- ColinWright 11y ago
  ... usage of which would be detected, and the users arrested and hauled off for "questioning" about spying and/or being a terrorist.
  - nly 11y ago
    And using a VPN doesn't have these risks?
jeremyis 11y ago
Weird, was just there a month ago for two weeks and used https://www.expressvpn.com/ https://www.expressvpn.com/ with no issue. I mostly cruised reddit / the internet so maybe there wasn't enough volume.
- fridsun 11y ago
  It depends. I am a bit surprised that reddit is not blocked. Neither is hackernews. Apart from classic Google, Facebook, Twitter, AWS is targeted intensely for its role in "affiliated freedom", to the point releases on github are blocked, others not as much.
- deleted 11y ago
  [deleted]
MrBra 11y ago
Why go through Internet access providers in first place? Just get a radio transmitter and start broadcasting on short waves with encrypted digital modes... at least for short, critical transmissions.
- thaumaturgy 11y ago
  At 1.2kbps?
  - MrBra 11y ago
    Q: "Would you like a free, uncensored system to talk to anyone in the world? On top of that you could also send data at 1.2 kpbs, again free and uncensored. You just need to swich frequencies quite often and randomly, in order to avoid that the bad guys will track you down..." A: "No, 1.2kpbs is not enough, thanks but I prefer censorship." Is that what you're saying?
    - thaumaturgy 11y ago
      Sorry, I've already had my fill of stupid arguments on the internet for the next couple days. Maybe some other time we can get together and do our best to misunderstand eachother.
      - MrBra 11y ago
        Haha. Ok. And sorry.
sdm 11y ago
In my experience ... spending a lot of time working in China ... most people use Astrill or ExpressVPN. I'm surprised no one has mentioned them here yet. They own the VPN market in China. Almost every senior developer I've met here subscribes to one or the other -- with Astrill being far ahead in terms of user base. They both champion their "stealth" options and other than the odd day you don't really notice the GFW. Pretty much all the ISPs sell "international lines" as well. But only as part of their business packages. Usually it will run for about US$1k/mo - US$3k/mo with minimum 1-2 year contract for their "starter" package. Most tech companies in my area have them; they work very well. Essentially they are a hardline to Hong Kong and they ration out to subscribers. They key thing to understand about the GFW is that it's not about general censorship of the population. Frankly the government doesn't care if someone who is middle class, i.e., invested in the status quo, gets around the GFW. They are more concerned about conservatives in lower classes trying to organize to stop the move towards capitalism. And it's mostly about protecting the market now so local companies can get access to these lower classes as their position improves and they join the middle class.
- tripzilch 11y ago
  I don't understand, who can afford US$1000 per month? I'm assuming only medium-large businesses, so do they divide up these "international lines" among their employees or something? Can these employees also use these lines at home, or only in the office?
  - wogong 11y ago
    It's for business of course, mainly international companies I guess. Local companies don't need to cross the firewall. Employees can only use these lines in the office. Actually most Chinese are not aware of the existence of the Great Firewall (GFW), really bad.
    - sdm 11y ago
      In the tech field, everyone is very very aware. I can't speak about other fields though. In my experience, pretty much anyone who is middle class or above knows about it. Granted middle class and above is only about 300 million of the almost 1.4 billion people -- so very much a minority. Granted China is huge and I mainly move in tech circles so YMMV. It's not just international companies. Chinese companies are all about going overseas now. China is now a next exporter of investment. Plus it seems every company with an app that has a moderate amount of success wants to reach Chinese outside of the China -- they have more money -- and so need to integrate with blocked services like FB. And exporting Chinese online games to other developing nations is really taking off.
userbinator 11y ago
Encryption is not enough. You need to disguise your VPN traffic to make it look like standard HTTPS sessions (since they don't block HTTPS). In other words, steganography.
marme 11y ago
using ssh tunnel works just fine in china but they detect it and start blocking the ips. You can usually get a few weeks before they block the ip address. It works better if the server is from a legitimate source like an edu. Most of the detection is focused on blocking vpns and they are very good and disrupting vpn traffic
ausjke 11y ago
This was exactly what I experienced in summer at China this year, no openvpn(not even commercial one or Linode self-hosted one), no ssh-tunnel, no other used-to-work vpn solutions. For ssh it sometimes work for a few days then the whole IP/host is blocked. I did not have to time try obfsproxy, shadowsock or whatever, but it really really sucked, to make things worse, my Nexus phone could not get any updates etc either, as Google is also _fully_ blocked, I felt I was back to Stone age there.
fossuser 11y ago
This is a great talk about some of the methods China and other governments use to block the Tor network: https://www.youtube.com/watch?v=GwMr8Xl7JMQ https://www.youtube.com/watch?v=GwMr8Xl7JMQ It's a pretty sophisticated arms race that's lead to some cool stuff, notably pluggable transports (like the obfsproxy you mentioned): https://www.torproject.org/docs/pluggable-transports.html.en https://www.torproject.org/docs/pluggable-transports.html.en Unfortunately the companies that enable this deep packet inspection are often American companies working overseas. My friend who used to work at Cisco said they had internal slide decks about the improvements they could make to the Chinese firewall. Then there's Bluecoat in Sunnyvale (https://www.bluecoat.com/ https://www.bluecoat.com/) building the censorship systems for the middle east. Why do American companies sell this kind of stuff to China and non-democracies in the middle east? They must rationalize it in someway, but I think it's wrong.
- jefurii 11y ago
  > Why do American companies sell this kind of stuff to China and non-democracies in the middle east? They must rationalize it in someway, but I think it's wrong. Pursuit of the almighty Free Market without regard for scruples or morality. Basically, public corporations base success only on money. If you as an executive refuse to bow down before Mammon[1,2] then you are replaced by someone who will. Seealso Charles Stross' excellent Invaders From Mars[3]. The Chinese government and other regimes pay big money for these tools. [1] https://en.wikipedia.org/wiki/Mammon https://en.wikipedia.org/wiki/Mammon [2] https://en.wikipedia.org/wiki/Mammon_%28Dungeons_%26_Dragons%29 https://en.wikipedia.org/wiki/Mammon_%28Dungeons_%26_Dragons... [3] http://www.antipope.org/charlie/blog-static/2010/12/invaders-from-mars.html http://www.antipope.org/charlie/blog-static/2010/12/invaders...
- rahimnathwani 11y ago
  Note: that video is from 2011, and in my experience China's VPN blocking has changed significantly over that time. In 2011, I could use OpenVPN over UDP reliably, as long as I didn't use the same port for every connection. That is no longer the case, and I'm grateful for Shadowsocks as it's easy to set up (both server-side and Android client) than OpenVPN over stunnel.
gcb0 11y ago
which leads me to two questions: 1. if you need custom vpn, why even have apple devices?! 2. why focus on vpn over their network instead of mesh?
lewisl9029 11y ago
Some of my friends have had success with VPNGate. http://www.vpngate.net/en/ http://www.vpngate.net/en/ It's based on SoftEther VPN, which happens to be open-source and cross platform. http://www.softether.org/ http://www.softether.org/ I'm using it for most of my VPN setups and I've generally found it to be superior to OpenVPN in every aspect (performance, usability, protocol support, obfuscation, etc).
eloy 11y ago
The Chinese authorities neither understand how FOSS works nor the Streisand Effect.
- task_queue 11y ago
  Not having to worry about != not understanding
inguinalhernia 11y ago
"you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out" I recall the same thing occurring in Shanghai with many of the popular webmail services, they'd work briefly, usually just long enough to log in and get a glimpse at an inbox, then it would time out endlessly and that'd be it.
vpndada 11y ago
Based on my experience, if you set up a VPN server (such as OpenVPN) by yourself and use it in China, you will see strange behaviours and the VPN server might stop working after some time. As a result, I've given up using my VPN but been using third party VPN service, which works better. Here's a list of VPNs that currently works in China: http://www.vpndada.com/best-vpns-for-china/ http://www.vpndada.com/best-vpns-for-china/
superuser2 11y ago
How do foreign organizations with email and internal applications inside the firewall do business in China? Do they simply have to make an exception to their security policies for employees based in China? Put them on Baidu email accounts instead? Or are IT departments of big lumbering fortune-500s also dependent on these tools?
- zhte415 11y ago
  No. Big foreign corporations, like in all countries, VPN back to their home country. The same all over the world. Internal policy dictates this, all over the world. Email is usually on self-hosted Exchange. Corporate firewall blocks stuff like Youtube and Facebook - also the same over the world, but some users with the business need can access whatever the business need dictates. Some large companies just bypass the national firewall for speed reasons - this is negotiated with the government on an individual basis - pragmatically this makes sense, as the traffic is 100% encrypted back between fixed sources and destinations, and inspecting it just wastes resources for all parties. Some corporations may also have their websites for the public access bypass any filtering, also for speed reasons (for example, internet banking).
  - superuser2 11y ago
    So exemptions from the VPN detection/shutdown mechanism can simply be negotiated by those with the political clout to do so?
    - zhte415 11y ago
      Absolutely.
    - joshYarnspinner 11y ago
      Indeed. The point of the GFW is to prevent political unrest. MNC's workers are unlikely to be fermenting dissent at work. Deploying the GFW on their connections doesn't really aid the government as a whole in terms of staying in power, but it does mean that MNCs will get pissed off and may reduce their presence in China.

by mrb 11y ago

usaar333 11y ago

How do multinational companies' china offices get through the firewall? For example if my company uses Google apps, how do I ensure that my china office has access?

deleted 11y ago
[deleted]
hipaulshi 11y ago
As far as Microsoft office in Beijing, I think they VPN to their Tokyo office first. Their traffic is ensured by negotiating directly with the big telecom company. Disclaimer: I do not work for them.
- nialv7 11y ago
  This is correct Source: worked there for a while
- chobo 11y ago
  This is interesting, I'd love to read/hear more about it. Is the negotiation an above-board thing? What are the conditions and costs to getting this kind of exception ensured?
  - gozo 11y ago
    From what I've heard, it's something like 100 000 USD a year for a 100 Mbit connection.
    - motoboi 11y ago
      Funny thing is: this is the same price payed in Brazil for a 100mbps MPLS link.
bitinn 11y ago
Not all VPN services are censored, and not all VPN protocol triggers the reset. But you can bet whatever you get for free (thus likely popular), will get banned soon enough. OpenVPN is like a prime suspect of a police procedural novel, it gets hunt down no matter what. Personally experience: I did work for Microsoft Shanghai and VPN works just fine. You need to have the right set of tools, and better, have a good channel of negotiation with the government.
mcbridematt 11y ago
Pay one of the telcos (i.e China Unicom) for an MPLS circuit out of the country. Also, international performance in general can be quite bad at peak times (i.e 30% packet loss), I suspect due to Comcast-style management of international transit. But if you buy a transit circuit from Unicom, no problem! Edit: to add to the grand parent, I've actually found ssh -D/-w0 (for a TUN device) quite reliable from China. What I really want to do is run multiple connections from different end points with a routing protocol to do fast-failover.
- badpenny 11y ago
  > Pay one of the telcos (i.e China Unicom) for an MPLS circuit out of the country. Don't suppose you could explain to us network plebs how that would bypass the Great Firewall?
  - eitally 11y ago
    It's a private network/route with traffic containing nothing but corporate data. Most multinationals facing this situation route out through HK, with a secondary failover usually in Taiwan or Singapore. Works a treat, but is costly and latency can be subpar. It also doesn't solve the problem of mobile access to Google Apps for Chinese workers (Google Play Store & apps are not bundled by many (any?) Chinese OEM handset makers or carriers. You can root & sideload, or you can purchase phones outside the country and ship them to your employees, but even if you do this, there is still no guarantee they'll be able to access Google's apps while on cellular networks.
    - gozo 11y ago
      Google Apps will drain your battery when they can't access Google's servers. Roaming with a China Unicom Hong Kong sim card, like the cross border king, will give you gfw free access.
      - kuschku 11y ago
        > Google Apps will drain your battery Google Apps will also drain your battery if you are in a region where Google has no network-location data yet, because then Google will turn on your GPS, and send to their servers the pair of GPS-coords and strength of networks. If you live in a suburb in Germany where almost no networks are known to Google, this means if you enable location services your GPS will try to get a fix 24/7, eating your battery in about 2 hours. This is probably going to be an issue in China, too, considering that Google doesn’t have location data there.
mirimir 11y ago
I've heard that commercial DCs and high-end hotels are less censored.
- dawson 11y ago
  I'm in the Sheraton in Qingdao atm, and it's definitely less censored, I can access YouTube and Google Apps just fine; where as earlier today from a business down the road these websites were all blocked.
a-saleh 11y ago
We have colleagues in china and generally speaking, you find an alternative, and host it on premise. I believe this is the reason why they use Atlassian[1] products, where rest of us would use trello, e.t.c. [1] company that created jira
- tajen 11y ago
  Aren't there a dozen of bugtrackers, intranet collaboration software, CI tools and git hostings that they could download and install? What's so special with the Atlassian products?
  - LoSboccacc 11y ago
    those sucks a little less than, say, bugtraq, offer enterprise support on premises which you'd never use but you need to do the purchasing when you go for a big company and kind of have a big recognized name for their customization support even if their whole stack sucks.
    - a-saleh 11y ago
      I think the "enterprise support on premisses" is the main deal, along with the fact that we have already used it for some of our big projects.
chefkoch 11y ago
Register your VPN with the authorities. We are atm doing this for a office in Beijing.
- rahimnathwani 11y ago
  Is the primary purpose of your VPN to bypass GFW, or to provide access to your corporate network? I guess the latter would be considered a good reason.
  - chefkoch 11y ago
    yes, mainly to access the corp network.

liquidcool 11y ago

I'm curious, what is the risk of getting caught, and what is the penalty?

tinydog 11y ago
I am a native Chinese. I was threatened by the police because of publishing a unfair treatment from a decree of local magistrates. The police said that I had to delete all of them, otherwise I would be brought into jail and my parents would lose their job. At that time, I was only 16. I don't want to live in this country anymore but I have no choice. I love China but the government.
imaginenore 11y ago
Spending on what you do, detainment, torture, death.

thaumasiotes 11y ago

I have a good amount of recent experience with this. I found that it wasn't just a matter of your connection getting blocked; if you leave it up you'll experience some unreliable good periods (so, say, a torrent would download through the VPN overnight without a problem, but if I wanted to use the internet at any particular time, my connection was unlikely to be working). But yeah, I ended up signing up with Astrill.

loser777 11y ago

Very interesting... I was just in China recently and was sshing into a box I had in the states for an impromptu SOCKS proxy. I did notice that things would work fine for up to an hour or so before things started bogging down. I would start seeing "channel x: open failed..." errors. However, closing the session and reconnecting would fix the problem... until it started lagging out again. I thought it was just a consequence of being on spotty < 5mbps(ADSL?) connections. The internet situation was barely tolerable for a few weeks stay; I can't imagine what living in these conditions 24/7/365 is like.

halfelf 11y ago
Working in such network 24/7/365 means I have to spend about $90 per year on my vpn service, and keep vpn connection all the time when working. (otherwise google and SO will not come to save me from problems.)
auganov 11y ago
Yea, in my most desperate I wrote a script that opened ~10 connections and kept restarting them and used HAproxy as a frontend. It was maybe helping, but honestly, I couldn't tell. Luckily I discovered shadowsocks soon after that.
ColinWright 11y ago
I'm always brought up short when someone says/writes "24/7/365" because it really doesn't make sense. "24/7" means 24 hours a day, seven days a week. "24/365" means 24 hours a day, 365 days a year. "24/7/365" means 24 hours a day, 7 days a week, 365 weeks a year? I know, I know, it's become an idiom, and it's like "I could care less", and you can't try to understand it except as an atom that caries a meaning, but it just looks wrong to me. Sorry - I'll now return you to your regular programming.
- nesyt 11y ago
  24/7/365 is dead. Long live 24/7/52!
- sbarre 11y ago

captainmuon 11y ago

I've had almost the opposite experience. VPN sort of worked, but I could not open a single HTTPS connection. The VPN problems I had I could trace to a bad WiFi connection (I had to lower my MTU and it worked fine). Now, on previous trips I experienced what you mentioned. It seemed really like there was some machine learning going on, and after using a VPN for a while the connection would get bad. But I guess it might not be machine learning, there might just be a huge number of humans watching your traffic - which would explain why it is so inconsistent. The thing that worked best for me is just using ssh -D (on most days). Our workplace uses ssh a lot for secure communication with outside china, so that couldn't possibly be blocked without hindering our work (and I believe 'they' have no interest in that). So whenever I had to access something for work that was sillily blocked (argh gmail), I just used the ssh connection that was open anyway.

bitinn 11y ago
Actually this is classic daily life of a chinese netizen: you are never quite sure what the cause of your network woes is (not without spending time digging into it). Is it due to ISP QoS, or is it reset by GFW, or is it just mere network failure? And what most ppl do when facing this? They choose a local service instead of Twitter, Facebook, Youtube, Google. See, censorship is only a part (though a vital part) of the grand scheme.

berkut 11y ago

Back in 2006/2007 when I was doing web development, I knew a few people at F5 and Zeus Technology (developers of application firewalls at the time), and they said The Great Firewall was using loads of F5 tech with deep packet inspection for all data. I assume 9 years later (don't know what the modern tech for web stuff is these day, but I assume encryption plays a key part) they're doing just as intrusive inspection and filtering of data.

Laforet 11y ago

This might sound a bit counter intuitive but they really hate OpenVPN and SSH tunnels - not to mention they are trivial to detect and the process is highly automated. Traditional VPNs such as PPTP/IPsec as well as various forms of obfuscated proxies are generally not interfered with unless something major happens. A lot of the alleged "censorship" are actually symptoms of high latency and packet loss on home connections.

kijin 11y ago
I suppose that means OpenVPN and SSH are too secure for the Chinese government to eavesdrop on. PPTP, on the other hand, has been known to be insecure for ages. So... could you avoid detection by passing an SSH tunnel through a PPTP VPN? Add enough layers, and the censors might not bother to unwrap all of them.
- Laforet 11y ago
  Yes you can. Shadowsocks was intended for the similar purpose of tunnelling traffic and it is a bit more flexible than GRE-based VPNs
- rsy96 11y ago
  Given that most US websites are now over HTTPS, breaking PPTP won't actually give Chinese government much information to eavesdrop on. They may know that someone is accessing Google or Twitter, but they cannot know the actual keywords or tweets they are reading. Note that Chinese government does not have backdoor access to those US websites, nor do they control a significant fraction of Internet infrastructure.
  - giodamelio 11y ago
    What about Chinese signed root certs?
    - rsy96 11y ago
      That is why it is recommended to untrust every Chinese CA from your system. It won't affect daily browsing even for most Chinese users. The super majority of Chinese websites, even state owned ones, buy certificates from US companies.

edwinyzh 11y ago

"Thanks" to the Great FireWall by one of the evilest governments, I might have to finally give up Gmail after many years struggling using it with the help of a wide variety of GFW-fighting tools. My deepest respect to all the authors.

aosmith 11y ago

Spoofing GGP tends to work very well in these situations.

Aoyagi 11y ago

What is this supposed to mean? https://github.com/clowwindy/ShadowVPN https://github.com/clowwindy/ShadowVPN "Removed according to regulations."

fredoliveira 11y ago
Did you miss the original link? https://github.com/shadowsocks/shadowsocks-iOS/issues/124#issuecomment-133630294 https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is...
- Aoyagi 11y ago
  As a matter of fact I did, thank you. Let me just find the nearest cliff to jump off.

olalonde 11y ago

> Encryption is not enough. I use an unencrypted PPTP VPN and the connection is really fast and stable here (Shenzhen, China Telecom). I have tried OpenVPN and ssh but both were much slower. FWIW, I don't believe using a VPN is illegal in China (though operating a VPN service without a license most likely is) and pretty much every single foreigner I know uses one.

deleted 11y ago
[deleted]
oliwarner 11y ago
Per the other comment, MS-CHAP2 is crackable. The PRC govt is probably happy to encourage people to think they're secure using it.
- olalonde 11y ago
  Yes, that was my point. They are happy to let people circumvent the firewall as long as they're still able to read the traffic.
Bromlife 11y ago
PPTP is not secure. You need to open another, more secure, tunnel within your PPTP session.
caiych 11y ago
According to a recent file. Using a VPN isn't illegal. But hosting an unregistered VPN service in China is illegal. And the right of using an unregistered VPN service is not guaranteed.

0xFFC 11y ago

I am in Iran , you cannot believe it , same here , They use deep packet inspection too, they will shut every package down. every open vpn , cisco vpn , etc connection will lose connection every 2-3 min . Connection to outside web is almost impossible. I have noticed they have multiple situation, for example when everything's quiet internet is not so bad (despite the fact bandwidth is extremely low for huge amount of people), but when some news came out about government corruption, guess what ? some vpn does not work . In 2009 green movement they closed every https connection.(maybe that was red alert situation) p.s : https://en.wikipedia.org/wiki/Deep_packet_inspection https://en.wikipedia.org/wiki/Deep_packet_inspection p.s. : I use vps from netherlands for bypassing firewall. but It takes huge amount of time and a little money.but the point is 99.999% people don't have this option (I use shadowsocks, sometimes another tunnels) so they use internet the way is or some software like freegate and other but with extremely low speed unbearable lag. p.s. : pptp, l2ps and others are closed right now. even president rohani couldn't manage the situation . I have heard he did want to do something but supreme leader and his people stopped him.

yyhhsj0521 11y ago
I heard rumors that that before Halal Internet was launched the censorship of Iran was relegated to Huawei, the same company that builds and maintains the Great Firewall...
- 0xFFC 11y ago
  Yes , I have heard it too . halal internet not going to launch , because Rohani is not believe in it and tries to postpone it every year(maybe they have technical issues too , I don't have information) . all military site's have ethernet and connect to each other with it.
geff82 11y ago
wish you all the best. I pay 5$ for a digitalocean droplet to provide my family in Iran with an OpenVPN connection. This works quite well, we do not have any issues so far.
dujiulun2006 11y ago

fyolnish 11y ago

When I was in China last year I had no problems using OpenVPN on my Holland based server.

njloof 11y ago
Hotel WiFi may not be as restricted as the average citizen's connection. Local 3G/4G service may be more restricted than your home provider's roaming service. It's a bit of a crapshoot, but the GFW is definitely targeted more towards locals than visitors.

nly 11y ago

Sounds like an overseas vendor needs to drop a blanket of satellite internet coverage over mainland China.

melling 11y ago
Sounds like you live in a world where you didn't notice that China became the second most powerful economy, and which will become the most powerful economy within a decade or so. Of course they're going to have the military to go with that: https://en.m.wikipedia.org/wiki/2007_Chinese_anti-satellite_missile_test https://en.m.wikipedia.org/wiki/2007_Chinese_anti-satellite_...
- nly 11y ago
  The great firewall is a cowardly, non-confrontational technical infrastructure. I don't see China using a multi-billion$ missile system to shoot down a harmless foreign communications satellite that also served people outside of China. They're smarter than that.
  - melling 11y ago
    You have no idea what you're talking about: http://www.history.com/this-day-in-history/chinese-counterattacks-in-korea-change-nature-of-war http://www.history.com/this-day-in-history/chinese-counterat... http://nationalinterest.org/feature/deadly-lessons-the-last-time-china-america-went-war-11558 http://nationalinterest.org/feature/deadly-lessons-the-last-...
ColinWright 11y ago
... usage of which would be detected, and the users arrested and hauled off for "questioning" about spying and/or being a terrorist.
- nly 11y ago
  And using a VPN doesn't have these risks?

jeremyis 11y ago

Weird, was just there a month ago for two weeks and used https://www.expressvpn.com/ https://www.expressvpn.com/ with no issue. I mostly cruised reddit / the internet so maybe there wasn't enough volume.

fridsun 11y ago
It depends. I am a bit surprised that reddit is not blocked. Neither is hackernews. Apart from classic Google, Facebook, Twitter, AWS is targeted intensely for its role in "affiliated freedom", to the point releases on github are blocked, others not as much.
deleted 11y ago
[deleted]

MrBra 11y ago

Why go through Internet access providers in first place? Just get a radio transmitter and start broadcasting on short waves with encrypted digital modes... at least for short, critical transmissions.

thaumaturgy 11y ago
At 1.2kbps?
- MrBra 11y ago
  Q: "Would you like a free, uncensored system to talk to anyone in the world? On top of that you could also send data at 1.2 kpbs, again free and uncensored. You just need to swich frequencies quite often and randomly, in order to avoid that the bad guys will track you down..." A: "No, 1.2kpbs is not enough, thanks but I prefer censorship." Is that what you're saying?
  - thaumaturgy 11y ago
    Sorry, I've already had my fill of stupid arguments on the internet for the next couple days. Maybe some other time we can get together and do our best to misunderstand eachother.
    - MrBra 11y ago
      Haha. Ok. And sorry.

sdm 11y ago

In my experience ... spending a lot of time working in China ... most people use Astrill or ExpressVPN. I'm surprised no one has mentioned them here yet. They own the VPN market in China. Almost every senior developer I've met here subscribes to one or the other -- with Astrill being far ahead in terms of user base. They both champion their "stealth" options and other than the odd day you don't really notice the GFW. Pretty much all the ISPs sell "international lines" as well. But only as part of their business packages. Usually it will run for about US$1k/mo - US$3k/mo with minimum 1-2 year contract for their "starter" package. Most tech companies in my area have them; they work very well. Essentially they are a hardline to Hong Kong and they ration out to subscribers. They key thing to understand about the GFW is that it's not about general censorship of the population. Frankly the government doesn't care if someone who is middle class, i.e., invested in the status quo, gets around the GFW. They are more concerned about conservatives in lower classes trying to organize to stop the move towards capitalism. And it's mostly about protecting the market now so local companies can get access to these lower classes as their position improves and they join the middle class.

tripzilch 11y ago
I don't understand, who can afford US$1000 per month? I'm assuming only medium-large businesses, so do they divide up these "international lines" among their employees or something? Can these employees also use these lines at home, or only in the office?
- wogong 11y ago
  It's for business of course, mainly international companies I guess. Local companies don't need to cross the firewall. Employees can only use these lines in the office. Actually most Chinese are not aware of the existence of the Great Firewall (GFW), really bad.
  - sdm 11y ago
    In the tech field, everyone is very very aware. I can't speak about other fields though. In my experience, pretty much anyone who is middle class or above knows about it. Granted middle class and above is only about 300 million of the almost 1.4 billion people -- so very much a minority. Granted China is huge and I mainly move in tech circles so YMMV. It's not just international companies. Chinese companies are all about going overseas now. China is now a next exporter of investment. Plus it seems every company with an app that has a moderate amount of success wants to reach Chinese outside of the China -- they have more money -- and so need to integrate with blocked services like FB. And exporting Chinese online games to other developing nations is really taking off.

userbinator 11y ago

Encryption is not enough. You need to disguise your VPN traffic to make it look like standard HTTPS sessions (since they don't block HTTPS). In other words, steganography.

marme 11y ago

using ssh tunnel works just fine in china but they detect it and start blocking the ips. You can usually get a few weeks before they block the ip address. It works better if the server is from a legitimate source like an edu. Most of the detection is focused on blocking vpns and they are very good and disrupting vpn traffic

ausjke 11y ago

This was exactly what I experienced in summer at China this year, no openvpn(not even commercial one or Linode self-hosted one), no ssh-tunnel, no other used-to-work vpn solutions. For ssh it sometimes work for a few days then the whole IP/host is blocked. I did not have to time try obfsproxy, shadowsock or whatever, but it really really sucked, to make things worse, my Nexus phone could not get any updates etc either, as Google is also _fully_ blocked, I felt I was back to Stone age there.

fossuser 11y ago

This is a great talk about some of the methods China and other governments use to block the Tor network: https://www.youtube.com/watch?v=GwMr8Xl7JMQ https://www.youtube.com/watch?v=GwMr8Xl7JMQ It's a pretty sophisticated arms race that's lead to some cool stuff, notably pluggable transports (like the obfsproxy you mentioned): https://www.torproject.org/docs/pluggable-transports.html.en https://www.torproject.org/docs/pluggable-transports.html.en Unfortunately the companies that enable this deep packet inspection are often American companies working overseas. My friend who used to work at Cisco said they had internal slide decks about the improvements they could make to the Chinese firewall. Then there's Bluecoat in Sunnyvale (https://www.bluecoat.com/ https://www.bluecoat.com/) building the censorship systems for the middle east. Why do American companies sell this kind of stuff to China and non-democracies in the middle east? They must rationalize it in someway, but I think it's wrong.

jefurii 11y ago
> Why do American companies sell this kind of stuff to China and non-democracies in the middle east? They must rationalize it in someway, but I think it's wrong. Pursuit of the almighty Free Market without regard for scruples or morality. Basically, public corporations base success only on money. If you as an executive refuse to bow down before Mammon[1,2] then you are replaced by someone who will. Seealso Charles Stross' excellent Invaders From Mars[3]. The Chinese government and other regimes pay big money for these tools. [1] https://en.wikipedia.org/wiki/Mammon https://en.wikipedia.org/wiki/Mammon [2] https://en.wikipedia.org/wiki/Mammon_%28Dungeons_%26_Dragons%29 https://en.wikipedia.org/wiki/Mammon_%28Dungeons_%26_Dragons... [3] http://www.antipope.org/charlie/blog-static/2010/12/invaders-from-mars.html http://www.antipope.org/charlie/blog-static/2010/12/invaders...
rahimnathwani 11y ago
Note: that video is from 2011, and in my experience China's VPN blocking has changed significantly over that time. In 2011, I could use OpenVPN over UDP reliably, as long as I didn't use the same port for every connection. That is no longer the case, and I'm grateful for Shadowsocks as it's easy to set up (both server-side and Android client) than OpenVPN over stunnel.

gcb0 11y ago

which leads me to two questions: 1. if you need custom vpn, why even have apple devices?! 2. why focus on vpn over their network instead of mesh?

lewisl9029 11y ago

Some of my friends have had success with VPNGate. http://www.vpngate.net/en/ http://www.vpngate.net/en/ It's based on SoftEther VPN, which happens to be open-source and cross platform. http://www.softether.org/ http://www.softether.org/ I'm using it for most of my VPN setups and I've generally found it to be superior to OpenVPN in every aspect (performance, usability, protocol support, obfuscation, etc).

eloy 11y ago

The Chinese authorities neither understand how FOSS works nor the Streisand Effect.

task_queue 11y ago
Not having to worry about != not understanding

inguinalhernia 11y ago

"you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out" I recall the same thing occurring in Shanghai with many of the popular webmail services, they'd work briefly, usually just long enough to log in and get a glimpse at an inbox, then it would time out endlessly and that'd be it.

vpndada 11y ago

Based on my experience, if you set up a VPN server (such as OpenVPN) by yourself and use it in China, you will see strange behaviours and the VPN server might stop working after some time. As a result, I've given up using my VPN but been using third party VPN service, which works better. Here's a list of VPNs that currently works in China: http://www.vpndada.com/best-vpns-for-china/ http://www.vpndada.com/best-vpns-for-china/

superuser2 11y ago

How do foreign organizations with email and internal applications inside the firewall do business in China? Do they simply have to make an exception to their security policies for employees based in China? Put them on Baidu email accounts instead? Or are IT departments of big lumbering fortune-500s also dependent on these tools?

zhte415 11y ago
No. Big foreign corporations, like in all countries, VPN back to their home country. The same all over the world. Internal policy dictates this, all over the world. Email is usually on self-hosted Exchange. Corporate firewall blocks stuff like Youtube and Facebook - also the same over the world, but some users with the business need can access whatever the business need dictates. Some large companies just bypass the national firewall for speed reasons - this is negotiated with the government on an individual basis - pragmatically this makes sense, as the traffic is 100% encrypted back between fixed sources and destinations, and inspecting it just wastes resources for all parties. Some corporations may also have their websites for the public access bypass any filtering, also for speed reasons (for example, internet banking).
- superuser2 11y ago
  So exemptions from the VPN detection/shutdown mechanism can simply be negotiated by those with the political clout to do so?
  - zhte415 11y ago
    Absolutely.
  - joshYarnspinner 11y ago
    Indeed. The point of the GFW is to prevent political unrest. MNC's workers are unlikely to be fermenting dissent at work. Deploying the GFW on their connections doesn't really aid the government as a whole in terms of staying in power, but it does mean that MNCs will get pissed off and may reduce their presence in China.