4 ms·
A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offendin
by fb03 7y ago
A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.
- derekp7 7y agossh over https, using proxytunnel works really good too. Looks like regular https traffic. And in addition to forwarding individual ports, openssh also has full vpn capability using tun/tap devices.
- TomK32 7y agoAnd you can still serve a regular https website from that same server!
- gruez 7y ago>simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile. Sounds like security theater. Using port knocking isn't going to hide the fact there's a SSH connection between you and some server. If anything, having a non standard configuration (non standard port number or port knocking) makes you more suspicious.
- walrus01 7y agoI think you overestimate the desire, motivation and technical capability of sri lankan ISPs to start doing netflow analysis and DPI on individual subscribers' end user connections. Unless you were to attract the attention of somebody in government, and they forced an ISP to escalate an issue to the 3rd or 4th tier of network engineering running the core of the bigger ASes there, they're not going to be doing that. It's not the chinese GFW.
- bArray 7y agoNot only this, but there's a massive difference between stopping people from accessing the web via VPNs and stopping people from SSH'ing into their servers. You block SSH access and you're probably going to take a financial toll Country wide.
- walrus01 7y agoAssuming that nobody in Sri Lanka is implementing DPI on ISPs' edge interfaces, the safer solution would be to run your own vpn endpoint hosted in the USA or Europe, as openvpn in tcp mode, or wireguard, on port 443. Without pwning your client device, they're technically incapable of properly MITMing TLS1.2 and can't break the internet so thoroughly by blocking https/port 443 traffic (which would also break gmail, all other popular webmail, and a huge chunk of everything else with hugely popular public websites where port 80 is redirected to 443 for TLS end-to-end). So unless somebody cares to inspect your traffic flow in particular and notices that it's openvpn traffic on 443 and not normal TLS1.2 traffic, it's likely to work.
- nstart 7y agoI have a feeling theyve done some form of traffic analysis. My default open vpn setup on a digital ocean box with the port changed to 443 is blocked somehow with both major ISPs here.
- walrus01 7y agoare you using openvpn in tcp or udp mode? the default udp is pretty easy to block even if it's on 443, the tcp requires somewhat more DPI.
- nstart 7y agoTried tcp too. Weirdly it refused to work. Haven't been able to fully check for configuration errors on my end here but i can't think of anything I did wrong either :)
- walrus01 7y agoIt's also very much possible that the entire digitalocean /22, /20 or even /18 sized chunk of ipv4 space it's in has just been null routed, due to the documented presence of other VPN endpoints in it.