5 ms·

I feel like China is good about public/shared VPN's. If you set up your own and keep the details to yourself I was under the impression that it'd work just fine

I feel like China is good about public/shared VPN's. If you set up your own and keep the details to yourself I was under the impression that it'd work just fine. That being said I love to travel and can work wherever but haven't been to CN yet for this reason in particular.

ryan-c 8y ago
From what I've heard second-hand (my SO has a friend who frequently travels to China), they do actually block people's private one-off VPN servers quite effectively. Have a look at https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf - it talks about GFW using machine learning with flow analysis to do this.
- userchris 8y ago
  I took that class (comp 116) a few years ago! Just had some fun finding and rereading my own final paper from the archives (the one you linked to makes mine seem way less interesting). Ming is a really awesome and unique lecturer.
  - mar77i 8y ago
    If I may ask, why pass the perfectly appropriate opportunity to... link it here?
- dev_dull 8y ago
  Indeed they do. It starts off working fine, but then eventually it stops. I assume they're running some AI/ML against the traffic pattern to determine if it's a VPN. I think they're light-years beyond simple traffic blocking and shaping.
- anticensor 8y ago
  Why do they not outright block encrypted connections which they fail to bruteforce?
  - jandrese 8y ago
    That blocks a large percentage of the websites out there now. It's probably easier to just block all AWS/Azure/Linode/DigitalOcean/etc... blocks.
- walrus01 8y ago
  basically, netflow analysis tools feeding into an automated pattern matching system. 100% crypto traffic no matter what looks different than usual usage patterns. The netflow tools need some time to gather enough flow statistics between your outside-china VPN endpoint and your domestic IP, but once that's gathered, it's pretty hard to get around. tools like obfsproxy for openvpn can help.
iancarroll 8y ago
If you are just visiting, the Great Firewall is not really a problem, as foreign SIM cards route directly to the internet. Just make sure you have a reasonable international plan with your carrier before you go.
- drenvuk 8y ago
  This is true. My phone connected to 4g when I turned it on but then upon my first search using google now it disconnected and then reconnected to an H+ network and completed the search. It was pretty cool how they made a completely separate network for it.
- kevingadd 8y ago
  With the caveat that in some countries the way data roaming works is all the data is routed back to your home before actually being routed to its destination - for example, if I visit Canada with a US T-Mobile SIM, all my traffic first has to travel to the US, even if I'm pinging a Canadian server. If you end up with this sort of data configuration in China, you'll be having a bad time using it for anything performance-sensitive. Good enough for email though, I bet.

ryan-c 8y ago

From what I've heard second-hand (my SO has a friend who frequently travels to China), they do actually block people's private one-off VPN servers quite effectively. Have a look at https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf - it talks about GFW using machine learning with flow analysis to do this.

userchris 8y ago
I took that class (comp 116) a few years ago! Just had some fun finding and rereading my own final paper from the archives (the one you linked to makes mine seem way less interesting). Ming is a really awesome and unique lecturer.
- mar77i 8y ago
  If I may ask, why pass the perfectly appropriate opportunity to... link it here?
dev_dull 8y ago
Indeed they do. It starts off working fine, but then eventually it stops. I assume they're running some AI/ML against the traffic pattern to determine if it's a VPN. I think they're light-years beyond simple traffic blocking and shaping.
anticensor 8y ago
Why do they not outright block encrypted connections which they fail to bruteforce?
- jandrese 8y ago
  That blocks a large percentage of the websites out there now. It's probably easier to just block all AWS/Azure/Linode/DigitalOcean/etc... blocks.
walrus01 8y ago
basically, netflow analysis tools feeding into an automated pattern matching system. 100% crypto traffic no matter what looks different than usual usage patterns. The netflow tools need some time to gather enough flow statistics between your outside-china VPN endpoint and your domestic IP, but once that's gathered, it's pretty hard to get around. tools like obfsproxy for openvpn can help.

iancarroll 8y ago

If you are just visiting, the Great Firewall is not really a problem, as foreign SIM cards route directly to the internet. Just make sure you have a reasonable international plan with your carrier before you go.

drenvuk 8y ago
This is true. My phone connected to 4g when I turned it on but then upon my first search using google now it disconnected and then reconnected to an H+ network and completed the search. It was pretty cool how they made a completely separate network for it.
kevingadd 8y ago
With the caveat that in some countries the way data roaming works is all the data is routed back to your home before actually being routed to its destination - for example, if I visit Canada with a US T-Mobile SIM, all my traffic first has to travel to the US, even if I'm pinging a Canadian server. If you end up with this sort of data configuration in China, you'll be having a bad time using it for anything performance-sensitive. Good enough for email though, I bet.