6 ms·

Unfortunately WireGuard is UDP only, so I can't even use it to get out through the university wifi firewall. 80 / 443 on TCP only. At least OpenVPN, for all t

Unfortunately WireGuard is UDP only, so I can't even use it to get out through the university wifi firewall. 80 / 443 on TCP only. At least OpenVPN, for all the criticism the article throws at it, has the configurability to pass through the various strange firewall rules that exist in the real World. Waiting eight seconds for negotiation isn't a big deal when the new and shiny 'replacement' doesn't have a hope of working.

lucb1e 8y ago
I was going to say that that's illegal but you're probably from the USA, right? I'm not sure what the status there on net neutrality is right now. Edit: going by downvotes, it still seems to be a sore spot. That answers my question about its current status in the USA I suppose...
- nickik 8y ago
  You clearly don't know what net neutrality is.
  - lucb1e 8y ago
    I'm not sure that I don't, I've followed new IT-related laws in the Netherlands closely so I'm pretty sure I know what's included without looking it up. I'm more sceptical of someone who says "you have no idea" without anything to back that statement up. But for other readers, I'll elaborate. Blocking UDP is not treating all traffic the same. Even if the law would be about treating services equally and not any IP packet equally, then it still has a different impact on services like VoIP (which are often UDP) than it does on other services. Blocking certain types of packets is not compliant with net neutrality -- at least, not in the Netherlands. If there is a different definition whereever you come from, please tell me about it.
    - zamadatix 8y ago
      I have a feeling it's a bit more nuanced than that otherwise you're telling me a University in the Netherlands can't run a firewall on their internet link and they need to have all public addresses to get around the fact that no device dynamically NATs all L4 protocols. I'd be willing to bet my lunch that there are exceptions for private, government, and educational institutions or that there is an exception related to security services.
      - lucb1e 8y ago
        > you're telling me a University in the Netherlands can't run a firewall on their internet link Any blocks should be necessary/essential for network stability or security. If I have evidence that a trojan is using tcp port 1337, and I am not aware of any other application that uses it, then there is no problem blocking it. In practice, of course, malware would be crazy not to use tcp/443 or tcp/80, so blocking ports is rather pointless these days anyway. As for network stability: reasons like "by blocking VoIP we can sell our services and use that money to make our network more stable" are not good enough, of course. There has to be a concrete reason why {whatever you want to block} will benefit the network. > and they need to have all public addresses to get around the fact that no device dynamically NATs all L4 protocols. I guess since there is scarity in v4-addresses, it's not reasonable to use public addresses for each individual, so "blocking" incoming traffic (or rather, it being unrouteable) shouldn't be an issue. It's essential for the network's operation.
        zamadatix 8y ago
        Firewalls have stateful inspection and handshake inspection capabilities for known protocols on known ports. They also have URL filtering, IPS, DDoS protection, and threat monitoring. This is the big difference between an organization like a business/university vs an ISP. I wasn't talking simple ACLs, that only requires a basic switch.
    - nickik 8y ago
      Net neutrality is and has always been in any discussion in Switzerland, Germany, Austria, the US and everywhere I have seen else about ISP and ISP abusing their position in the market. I have never once heard anybody claim that private institutions are not allowed to shape their own network traffic. Unless you show me Dutch law that clearly spells this out, I will not for a second believe that it is illegal for a university to block certain protocols. If what you say were true then pretty much every single private organization would be operating illegally, anybody that runs VoIP, blocks UDP or any other way to shape the network.
  - ryanlol 8y ago
    Net neutrality is whatever Advance Publications, Facebook, Google and Netflix want it to be.
    - lucb1e 8y ago
      Where I live, net neutrality is whatever article 7.4a of the Telecommunications Act says...
blfr 8y ago
This seems more like a problem with your uni's firewall than with any VPN solution. If they're locking things down so hard, why do they allow you to set up an arbitrary VPN just by using TCP and :443? If OTOH they want to allow you to use a VPN, they should allow at least some UDP traffic. The way God intended BTW because running VPN traffic over TCP usually means running error detection and flow control twice on top of each other. Sure, some of the value of a VPN is running through misconfigured and outright hostile networks, hence various encapsulation schemes (over SSL, in DNS requests, etc), but only some of the value.
Amezarak 8y ago
Yeah, and this is a pretty common situation on a lot of public networks. The whole reason I set up an OpenVPN (configured over tcp on port 80) was to be able to use irc!
- lucb1e 8y ago
  Since net neutrality laws came into place a few years ago, I've been seeing it less and less. A few big ones (like the biggest rail company, NS, which offers free on-board wifi) got into trouble for blocking things like video streaming and it seems others took heed. Now most networks even allow TCP/25, and without any abuse that I've heard of.
rlvesco7 8y ago
Wrap it in stunnel if you can. Basically an https wrapper. Stunnel is increasingly useful for all kinds of VPN especially when you are traveling since more and more places are blocking vpn. Https is almost never blocked. Works pretty much every except China.
- lighttower 8y ago
  What works in China lately?
  - m-p-3 8y ago
    Probably obfs4, as long as it has not been flagged or detected yet.
  - kweks 8y ago
    Buy a China Mobile Hong Kong 4G China data roaming SIM in Hong Kong airport (arrival concourse). $15USD, rechargable - and 4G unfiltered internet in mainland China.
  - A2017U1 8y ago
    Shadowsocks
  - andyonthewings 8y ago
    Tor with bridge (Azure) works, at least for me 2 weeks ago.
galadran 8y ago
Oh man! If only there was a way to take UDP packets and tunnel them over TCP! Wait a second! http://manpages.ubuntu.com/manpages/xenial/man1/udptunnel.1.html http://manpages.ubuntu.com/manpages/xenial/man1/udptunnel.1.... Setup Wireguard on your server as though everything were normal. However, on the server, run this command (as a service): udptunnel -s 443 127.0.0.1/51820 Then on your client run: udptunnel -c [SERVER-ADDR]/443 127.0.0.1 51818 In the Client's Wireguard Config, where you would normally specify the server's address / port. Instead specify 127.0.0.1 51818. Finished! Don't forget to open the firewall on the server's port 443! Setting up udptunnel as a systemd service to auto start / restart only involves writing two short files! Wireguard uses a standard service file as well so you can simply require the udptunnel service as a prerequisite! Personally, I find this style of combining simple components much more satisfying (and secure!) than the gargantuan complexity of OpenVPN/IPSec! Wireguard's simplicity means it is easy to have a mental model around how it functions and how it can be composed!
- Foxboron 8y ago
  Huh. Think I'll package udptunnel for Arch and fix up the ArchWiki entry with this. Super neat.
  - nickik 8y ago
    You doing gods work.
- hoistbypetard 8y ago
  I've not seen/used udptunnel before. Nice. Thanks for the pointer. It looks much simpler than other tricks I've tried to accomplish the same goal.
- zamadatix 8y ago
  Since you mentioned security note the security implications towards the end of the page as this is actually pretty insecure without additional components. Also note this results in: application data in IP+<L4 protocol> in IP+UDP Tunnel (Wireguard) in IP+TCP So securing the component mess and header bloat is becoming as bad as OpenVPN/IPSec which you abhorred. Still probably faster than OpenVPN though as that implementation is amazingly bad.
amaccuish 8y ago
That sucks. Have you tried UDP over port 53? Also, I find ocserv/opeconnect much better for passing firewalls as it much more closely resembles HTTPS, I find OpenVPN is too easy to fingerprint. It opportunistically uses UDP if it can, otherwise it uses TCP.
- hamandcheese 8y ago
  You could tunnel with stunnel, which I think would make it quite difficult to fingerprint and distinguish from an ordinary TLS connection.
gsich 8y ago
How do you make DNS queries? Those ancient setups need to die.
- lima 8y ago
  Some networks force you to use their resolvers and/or have a whitelist of common public ones. But running wireguard on port 53 might just work!
- dingaling 8y ago
  As suggested below, internal resolver. To be honest I'm a bit surprised vy the reactions here. This isn't an unusual configuration, I've worked in two other companies that had the same rules; nothing except web traffic even on the 'public' wifi. The latter permitted any device to connect but had absolutely no exceptions to the firewall rules. The corp nets did have an exception process but only for servers in the DMZ.
vdm 8y ago
https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel
fanf2 8y ago
That’s crappy. You should lobby them to join eduroam which is not completely useless - see p.32 of the service definition for the minimum allowed ports https://www.eduroam.org/wp-content/uploads/2016/05/GN3-12-192_eduroam-policy-service-definition_ver28_26072012.pdf https://www.eduroam.org/wp-content/uploads/2016/05/GN3-12-19...
- beojan 8y ago
  And as a side benefit you get secure WiFi at many (most in Europe) universities, teaching hospitals, city centers close to a university, etc.
ptman 8y ago
Have you tried sslh + sshuttle?
jrockway 8y ago
UDP is a reasonable default. TCP-inside-TCP, which is what you're going to get with a TCP VPN, is generally terrible.
- eps 8y ago
  Generally, TCP-over-TCP is fine. It some edge cases though it is indeed terrible.
CamperBob2 8y ago
The problem isn't that your university blocks everything but 80/443, the problem is that you and everyone else there apparently tolerate it. Don't do that.

lucb1e 8y ago

I was going to say that that's illegal but you're probably from the USA, right? I'm not sure what the status there on net neutrality is right now. Edit: going by downvotes, it still seems to be a sore spot. That answers my question about its current status in the USA I suppose...

nickik 8y ago
You clearly don't know what net neutrality is.
- lucb1e 8y ago
  I'm not sure that I don't, I've followed new IT-related laws in the Netherlands closely so I'm pretty sure I know what's included without looking it up. I'm more sceptical of someone who says "you have no idea" without anything to back that statement up. But for other readers, I'll elaborate. Blocking UDP is not treating all traffic the same. Even if the law would be about treating services equally and not any IP packet equally, then it still has a different impact on services like VoIP (which are often UDP) than it does on other services. Blocking certain types of packets is not compliant with net neutrality -- at least, not in the Netherlands. If there is a different definition whereever you come from, please tell me about it.
  - zamadatix 8y ago
    I have a feeling it's a bit more nuanced than that otherwise you're telling me a University in the Netherlands can't run a firewall on their internet link and they need to have all public addresses to get around the fact that no device dynamically NATs all L4 protocols. I'd be willing to bet my lunch that there are exceptions for private, government, and educational institutions or that there is an exception related to security services.
    - lucb1e 8y ago
      > you're telling me a University in the Netherlands can't run a firewall on their internet link Any blocks should be necessary/essential for network stability or security. If I have evidence that a trojan is using tcp port 1337, and I am not aware of any other application that uses it, then there is no problem blocking it. In practice, of course, malware would be crazy not to use tcp/443 or tcp/80, so blocking ports is rather pointless these days anyway. As for network stability: reasons like "by blocking VoIP we can sell our services and use that money to make our network more stable" are not good enough, of course. There has to be a concrete reason why {whatever you want to block} will benefit the network. > and they need to have all public addresses to get around the fact that no device dynamically NATs all L4 protocols. I guess since there is scarity in v4-addresses, it's not reasonable to use public addresses for each individual, so "blocking" incoming traffic (or rather, it being unrouteable) shouldn't be an issue. It's essential for the network's operation.
      - zamadatix 8y ago
        Firewalls have stateful inspection and handshake inspection capabilities for known protocols on known ports. They also have URL filtering, IPS, DDoS protection, and threat monitoring. This is the big difference between an organization like a business/university vs an ISP. I wasn't talking simple ACLs, that only requires a basic switch.
  - nickik 8y ago
    Net neutrality is and has always been in any discussion in Switzerland, Germany, Austria, the US and everywhere I have seen else about ISP and ISP abusing their position in the market. I have never once heard anybody claim that private institutions are not allowed to shape their own network traffic. Unless you show me Dutch law that clearly spells this out, I will not for a second believe that it is illegal for a university to block certain protocols. If what you say were true then pretty much every single private organization would be operating illegally, anybody that runs VoIP, blocks UDP or any other way to shape the network.
- ryanlol 8y ago
  Net neutrality is whatever Advance Publications, Facebook, Google and Netflix want it to be.
  - lucb1e 8y ago
    Where I live, net neutrality is whatever article 7.4a of the Telecommunications Act says...

blfr 8y ago

This seems more like a problem with your uni's firewall than with any VPN solution. If they're locking things down so hard, why do they allow you to set up an arbitrary VPN just by using TCP and :443? If OTOH they want to allow you to use a VPN, they should allow at least some UDP traffic. The way God intended BTW because running VPN traffic over TCP usually means running error detection and flow control twice on top of each other. Sure, some of the value of a VPN is running through misconfigured and outright hostile networks, hence various encapsulation schemes (over SSL, in DNS requests, etc), but only some of the value.

Amezarak 8y ago

Yeah, and this is a pretty common situation on a lot of public networks. The whole reason I set up an OpenVPN (configured over tcp on port 80) was to be able to use irc!

lucb1e 8y ago
Since net neutrality laws came into place a few years ago, I've been seeing it less and less. A few big ones (like the biggest rail company, NS, which offers free on-board wifi) got into trouble for blocking things like video streaming and it seems others took heed. Now most networks even allow TCP/25, and without any abuse that I've heard of.

rlvesco7 8y ago

Wrap it in stunnel if you can. Basically an https wrapper. Stunnel is increasingly useful for all kinds of VPN especially when you are traveling since more and more places are blocking vpn. Https is almost never blocked. Works pretty much every except China.

lighttower 8y ago
What works in China lately?
- m-p-3 8y ago
  Probably obfs4, as long as it has not been flagged or detected yet.
- kweks 8y ago
  Buy a China Mobile Hong Kong 4G China data roaming SIM in Hong Kong airport (arrival concourse). $15USD, rechargable - and 4G unfiltered internet in mainland China.
- A2017U1 8y ago
  Shadowsocks
- andyonthewings 8y ago
  Tor with bridge (Azure) works, at least for me 2 weeks ago.

galadran 8y ago

Oh man! If only there was a way to take UDP packets and tunnel them over TCP! Wait a second! http://manpages.ubuntu.com/manpages/xenial/man1/udptunnel.1.html http://manpages.ubuntu.com/manpages/xenial/man1/udptunnel.1.... Setup Wireguard on your server as though everything were normal. However, on the server, run this command (as a service): udptunnel -s 443 127.0.0.1/51820 Then on your client run: udptunnel -c [SERVER-ADDR]/443 127.0.0.1 51818 In the Client's Wireguard Config, where you would normally specify the server's address / port. Instead specify 127.0.0.1 51818. Finished! Don't forget to open the firewall on the server's port 443! Setting up udptunnel as a systemd service to auto start / restart only involves writing two short files! Wireguard uses a standard service file as well so you can simply require the udptunnel service as a prerequisite! Personally, I find this style of combining simple components much more satisfying (and secure!) than the gargantuan complexity of OpenVPN/IPSec! Wireguard's simplicity means it is easy to have a mental model around how it functions and how it can be composed!

Foxboron 8y ago
Huh. Think I'll package udptunnel for Arch and fix up the ArchWiki entry with this. Super neat.
- nickik 8y ago
  You doing gods work.
hoistbypetard 8y ago
I've not seen/used udptunnel before. Nice. Thanks for the pointer. It looks much simpler than other tricks I've tried to accomplish the same goal.
zamadatix 8y ago
Since you mentioned security note the security implications towards the end of the page as this is actually pretty insecure without additional components. Also note this results in: application data in IP+<L4 protocol> in IP+UDP Tunnel (Wireguard) in IP+TCP So securing the component mess and header bloat is becoming as bad as OpenVPN/IPSec which you abhorred. Still probably faster than OpenVPN though as that implementation is amazingly bad.

amaccuish 8y ago

That sucks. Have you tried UDP over port 53? Also, I find ocserv/opeconnect much better for passing firewalls as it much more closely resembles HTTPS, I find OpenVPN is too easy to fingerprint. It opportunistically uses UDP if it can, otherwise it uses TCP.

hamandcheese 8y ago
You could tunnel with stunnel, which I think would make it quite difficult to fingerprint and distinguish from an ordinary TLS connection.

gsich 8y ago

How do you make DNS queries? Those ancient setups need to die.

lima 8y ago
Some networks force you to use their resolvers and/or have a whitelist of common public ones. But running wireguard on port 53 might just work!
dingaling 8y ago
As suggested below, internal resolver. To be honest I'm a bit surprised vy the reactions here. This isn't an unusual configuration, I've worked in two other companies that had the same rules; nothing except web traffic even on the 'public' wifi. The latter permitted any device to connect but had absolutely no exceptions to the firewall rules. The corp nets did have an exception process but only for servers in the DMZ.

vdm 8y ago

https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel

fanf2 8y ago

That’s crappy. You should lobby them to join eduroam which is not completely useless - see p.32 of the service definition for the minimum allowed ports https://www.eduroam.org/wp-content/uploads/2016/05/GN3-12-192_eduroam-policy-service-definition_ver28_26072012.pdf https://www.eduroam.org/wp-content/uploads/2016/05/GN3-12-19...

beojan 8y ago
And as a side benefit you get secure WiFi at many (most in Europe) universities, teaching hospitals, city centers close to a university, etc.

ptman 8y ago

Have you tried sslh + sshuttle?

jrockway 8y ago

UDP is a reasonable default. TCP-inside-TCP, which is what you're going to get with a TCP VPN, is generally terrible.

eps 8y ago
Generally, TCP-over-TCP is fine. It some edge cases though it is indeed terrible.

CamperBob2 8y ago

The problem isn't that your university blocks everything but 80/443, the problem is that you and everyone else there apparently tolerate it. Don't do that.