3 ms·

I will be traveling to China in a couple of days and was ignorantly hoping my OpenVPN-based VPN would work. Do you recommend that I set up strongSwan?

terrywang 9y ago
Try to change the default port 1194 to something else (e.g. 443) - this may not help as the GFW has the ability to detect OpenVPN specific traffic. If it is only for yourself and traffic is very little, it may survive the period of your stay in China. Nobody I know in mainland runs OpenVPN any more so I cannot really prove that, sigh...
- scott_karana 9y ago
  That trick no longer works at all, to my knowledge. The GFW is wise to it. That's why Tor had to implement HTTPS-like fake traffic padding in its obfsproxy modules, which also need to keep evolving...
ineedtosleep 9y ago
I used PIA with relative success. The caveats being: 1. DNS resolution may not work, so you'll need to find a way to resolve the domain name (i.e. hk.privateinternetaccess.com) to IPs for your config. 2. Even if you get an IP it may not work all the time. You will have to keep resolving the domain name for another IP (or maybe just look at all the DNS records?). EDIT: I should mention I used PIA's PPTP (yes, it's discouraged but it worked for my purposes) and L2TP configurations just fine.
rahimnathwani 9y ago
Set up Shadowsocks. (OpenVPN won't work regardless of port and choice of udp/tcp, unless you tunnel it through obfsproxy or similar.)
whooshee 9y ago
Just use Psiphon or ShadowsocksR, you will be fine, don't use a cliche old VPN.
ymhuang0808 9y ago
A few months ago, I went to Shanghai. Before going to China, I setup the Shadownsock on my server. My 4G network is roaming SIM card. I can surf on Google Map over my SIM card without any proxy or VPN. To prevent from sniffing, I always connect to the network via OpenVPN with non default port. In hotel, the Wi-Fi network cannot connect to many sites. Sometimes, I can connect the Internet via OpenVPN, but, Shadowsocks is more stable.
jbg_ 9y ago
Another option is roaming on a foreign SIM card - this usually bypasses the GFW quite effectively; roaming is effectively a VPN back to the home provider, and there seems to be some whitelist for these roaming tunnels. The providers probably provide surveillance access to the Chinese govt, but you will not have trouble accessing Google and other blocked sites, and any VPN you like should work fine through a roaming SIM. Whether you can find one with reasonable data rates in China is probably the main question. Two that I have used with great success are Kyivstar from Ukraine and China Unicom HK (note it must be HK, not mainland China). Others may be listed at [0]. [0] http://prepaid-data-sim-card.wikia.com/ http://prepaid-data-sim-card.wikia.com/
- L_Rahman 9y ago
  I can confirm that the foreign SIM card override works from my experience a couple of years ago. My T-Mobile had free international roaming baked in at 2G speeds. Unlike the US however, most foreign carriers in developed Asian nations (China/Korea) don't support 2G fallback, so I had free 3G everywhere. It was pretty much like using the American internet.

terrywang 9y ago

Try to change the default port 1194 to something else (e.g. 443) - this may not help as the GFW has the ability to detect OpenVPN specific traffic. If it is only for yourself and traffic is very little, it may survive the period of your stay in China. Nobody I know in mainland runs OpenVPN any more so I cannot really prove that, sigh...

scott_karana 9y ago
That trick no longer works at all, to my knowledge. The GFW is wise to it. That's why Tor had to implement HTTPS-like fake traffic padding in its obfsproxy modules, which also need to keep evolving...

ineedtosleep 9y ago

I used PIA with relative success. The caveats being: 1. DNS resolution may not work, so you'll need to find a way to resolve the domain name (i.e. hk.privateinternetaccess.com) to IPs for your config. 2. Even if you get an IP it may not work all the time. You will have to keep resolving the domain name for another IP (or maybe just look at all the DNS records?). EDIT: I should mention I used PIA's PPTP (yes, it's discouraged but it worked for my purposes) and L2TP configurations just fine.

rahimnathwani 9y ago

Set up Shadowsocks. (OpenVPN won't work regardless of port and choice of udp/tcp, unless you tunnel it through obfsproxy or similar.)

whooshee 9y ago

Just use Psiphon or ShadowsocksR, you will be fine, don't use a cliche old VPN.

ymhuang0808 9y ago

A few months ago, I went to Shanghai. Before going to China, I setup the Shadownsock on my server. My 4G network is roaming SIM card. I can surf on Google Map over my SIM card without any proxy or VPN. To prevent from sniffing, I always connect to the network via OpenVPN with non default port. In hotel, the Wi-Fi network cannot connect to many sites. Sometimes, I can connect the Internet via OpenVPN, but, Shadowsocks is more stable.

jbg_ 9y ago

Another option is roaming on a foreign SIM card - this usually bypasses the GFW quite effectively; roaming is effectively a VPN back to the home provider, and there seems to be some whitelist for these roaming tunnels. The providers probably provide surveillance access to the Chinese govt, but you will not have trouble accessing Google and other blocked sites, and any VPN you like should work fine through a roaming SIM. Whether you can find one with reasonable data rates in China is probably the main question. Two that I have used with great success are Kyivstar from Ukraine and China Unicom HK (note it must be HK, not mainland China). Others may be listed at [0]. [0] http://prepaid-data-sim-card.wikia.com/ http://prepaid-data-sim-card.wikia.com/

L_Rahman 9y ago
I can confirm that the foreign SIM card override works from my experience a couple of years ago. My T-Mobile had free international roaming baked in at 2G speeds. Unlike the US however, most foreign carriers in developed Asian nations (China/Korea) don't support 2G fallback, so I had free 3G everywhere. It was pretty much like using the American internet.