5 ms·

Does it actually work from China? Their VPN blocking has gotten really good lately.

dwohnitmok 7y ago
Essentially no. As yorwba points out in a sibling post the GFW is wise to the protocols being used. Algo doesn't work either. Or more accurately they don't work for long. The GFW slowly degrades the connection over the course of some minutes, making it unusable after a while. This then resets every day or so. After a series of days or weeks the IP address associated with the server is completely blocked. The situation with Shadowsocks has more or less been the same for me. I have been unable to have a reliable connection to blocked websites with either a self-hosted (on servers outside of China) Algo or Shadowsocks server. This has meant it is impractical to run your own server with circumvention software. As far as I can tell the way that VPN providers get around this in China is to just operate a huge fleet of IP addresses that rotate in as they are inevitably blocked and leave ones that get blocked out of rotation long enough so that they are no longer blocked. I have heard that V2Ray is the new way to go if you want to set up your own way of getting around the GFW, but it looks rather complicated to set up. https://github.com/v2ray/v2ray-core https://github.com/v2ray/v2ray-core Basically the GFW is quite sophisticated these days and the usual solutions used outside of China don't work.
- NamTaf 7y ago
  I use Streisand to spin up both Wireguard and Shadowsocks whenever I visit China and sustain a ~300KB/sec connection usually on both of them. Occasionally it'll drop out for a night, but it's generally fine by the next morning, without needing to cycle the destination IP. I'm not sure whether it's to do with my hotel's wifi or the VPN itself. I run it off a DigitalOcean or Vultr VPS, depending on which is working better at the time. Last time I used it (Feb this year), Streisand wrapped Shadowsocks in simple-obfs, but it appears that the latest release now uses v2ray since May or so. I'll be testing it in a few weeks when I'm next back there. Wireguard 'just worked' back then, too. Assuming Algo does Wireguard the same as Streisand, I've no reason to believe it wouldn't work regardless of the method you use to set it up.
  - dwohnitmok 7y ago
    Oh that's fascinating. I just got back from China a couple of weeks ago after an extended stay. I had set up Algo and Shadowsocks separately on DigitalOcean and I wasn't able to sustain that kind of speed on them for more than a couple of minutes, even back in February (I kept trying off and on until about April and then gave up). Interesting, I had no idea Streisand has a V2Ray option at this point. May have to give it another go.
- js2 7y ago
  Curious. I have a colleague who works from China a couple times a year and VPNs in to work (a well known US company) using Cisco AnyConnect[1] and tells me he's never had any trouble. 1. Which has an alternative open source client – http://www.infradead.org/openconnect/ http://www.infradead.org/openconnect/
  - L_Rahman 7y ago
    The GFW is likely sophisticated enough to make distinctions between corporate VPN connectivity using products like Cisco AnyConnect and personal use setups on AWS/DO/Azure/GC or even a home server. One of the things I've wondered about, and I hope people more informed than me will forgive my ignorance, is whether it's possible to implement a VPN protocol that looks like ordinary HTTPS traffic. I know very little about the specific mechanics of network protocols so the very premise might be nonsensical but I would appreciate an explanation of why this might or might not be possible.
    - therealx 7y ago
      OpenVPN was/is meant to "just be https traffic"
      - chopin 7y ago
        Any source on how it is then distinguishable from https?
        mikeash 7y ago
        I don’t have a source, but they do traffic analysis to detect VPNs based on usage, not just protocol. For example, ssh is not blocked. However, use ssh -D to proxy web traffic through your connection, and the whole connection will hang in short order.
      - js2 7y ago
        OpenVPN is based on SSL/TLS, which https also uses, but no, it wasn’t designed to look like https traffic. For one thing, OpenVPN uses UDP on port 1194 by default due to technical issues running TCP over TCP. You can switch it to use TCP and run it on port 443, but the underlying VPN traffic usually doesn’t have the same pattern as a typical http connection so it is discernible from https via side-channel attacks. You can try obfuscating the traffic but my guess is that makes it look even less like https. References: - http://sites.inka.de/~W1011/devel/tcp-tcp.html http://sites.inka.de/~W1011/devel/tcp-tcp.html - https://wiki.wireshark.org/OpenVPN https://wiki.wireshark.org/OpenVPN - https://github.com/OpenVPN/openvpn/pull/3 https://github.com/OpenVPN/openvpn/pull/3 - https://community.openvpn.net/openvpn/wiki/TrafficObfuscation https://community.openvpn.net/openvpn/wiki/TrafficObfuscatio... - http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.com/my-experience-with-the-great-firewal... - https://news.ycombinator.com/item?id=10905076 https://news.ycombinator.com/item?id=10905076
- thinkingemote 7y ago
  How about a SSH tunnel (e.g. using sshuttle) on a server you have access to?
  - Mediterraneo10 7y ago
    The Great Firewall has been able to detect and block SSH tunneling for years now, probably already a decade.
  - Quiark 7y ago
    they've been able to identify and block these 5 years ago
yorwba 7y ago
Some of the protocols supported by Streisand are basically useless because their packets are so easy to identify (OpenConnect and OpenVPN are definitely in that category), but I do know people successfully using Shadowsocks to circumvent the Great Firewall. They're not running their own servers, though.
- netheril96 7y ago
  GFW does not block all VPN protocols that are easy to identify. OpenConnect and OpenVPN are both easy to identify, but GFW interferes with the latter but not the former (for now).
zrth 7y ago
Wireguard on AWS works for me.

Essentially no. As yorwba points out in a sibling post the GFW is wise to the protocols being used. Algo doesn't work either. Or more accurately they don't work for long. The GFW slowly degrades the connection over the course of some minutes, making it unusable after a while. This then resets every day or so. After a series of days or weeks the IP address associated with the server is completely blocked. The situation with Shadowsocks has more or less been the same for me. I have been unable to have a reliable connection to blocked websites with either a self-hosted (on servers outside of China) Algo or Shadowsocks server. This has meant it is impractical to run your own server with circumvention software. As far as I can tell the way that VPN providers get around this in China is to just operate a huge fleet of IP addresses that rotate in as they are inevitably blocked and leave ones that get blocked out of rotation long enough so that they are no longer blocked. I have heard that V2Ray is the new way to go if you want to set up your own way of getting around the GFW, but it looks rather complicated to set up. https://github.com/v2ray/v2ray-core https://github.com/v2ray/v2ray-core Basically the GFW is quite sophisticated these days and the usual solutions used outside of China don't work.

NamTaf 7y ago
I use Streisand to spin up both Wireguard and Shadowsocks whenever I visit China and sustain a ~300KB/sec connection usually on both of them. Occasionally it'll drop out for a night, but it's generally fine by the next morning, without needing to cycle the destination IP. I'm not sure whether it's to do with my hotel's wifi or the VPN itself. I run it off a DigitalOcean or Vultr VPS, depending on which is working better at the time. Last time I used it (Feb this year), Streisand wrapped Shadowsocks in simple-obfs, but it appears that the latest release now uses v2ray since May or so. I'll be testing it in a few weeks when I'm next back there. Wireguard 'just worked' back then, too. Assuming Algo does Wireguard the same as Streisand, I've no reason to believe it wouldn't work regardless of the method you use to set it up.
- dwohnitmok 7y ago
  Oh that's fascinating. I just got back from China a couple of weeks ago after an extended stay. I had set up Algo and Shadowsocks separately on DigitalOcean and I wasn't able to sustain that kind of speed on them for more than a couple of minutes, even back in February (I kept trying off and on until about April and then gave up). Interesting, I had no idea Streisand has a V2Ray option at this point. May have to give it another go.
js2 7y ago
Curious. I have a colleague who works from China a couple times a year and VPNs in to work (a well known US company) using Cisco AnyConnect[1] and tells me he's never had any trouble. 1. Which has an alternative open source client – http://www.infradead.org/openconnect/ http://www.infradead.org/openconnect/
- L_Rahman 7y ago
  The GFW is likely sophisticated enough to make distinctions between corporate VPN connectivity using products like Cisco AnyConnect and personal use setups on AWS/DO/Azure/GC or even a home server. One of the things I've wondered about, and I hope people more informed than me will forgive my ignorance, is whether it's possible to implement a VPN protocol that looks like ordinary HTTPS traffic. I know very little about the specific mechanics of network protocols so the very premise might be nonsensical but I would appreciate an explanation of why this might or might not be possible.
  - therealx 7y ago
    OpenVPN was/is meant to "just be https traffic"
    - chopin 7y ago
      Any source on how it is then distinguishable from https?
      - mikeash 7y ago
        I don’t have a source, but they do traffic analysis to detect VPNs based on usage, not just protocol. For example, ssh is not blocked. However, use ssh -D to proxy web traffic through your connection, and the whole connection will hang in short order.
    - js2 7y ago
      OpenVPN is based on SSL/TLS, which https also uses, but no, it wasn’t designed to look like https traffic. For one thing, OpenVPN uses UDP on port 1194 by default due to technical issues running TCP over TCP. You can switch it to use TCP and run it on port 443, but the underlying VPN traffic usually doesn’t have the same pattern as a typical http connection so it is discernible from https via side-channel attacks. You can try obfuscating the traffic but my guess is that makes it look even less like https. References: - http://sites.inka.de/~W1011/devel/tcp-tcp.html http://sites.inka.de/~W1011/devel/tcp-tcp.html - https://wiki.wireshark.org/OpenVPN https://wiki.wireshark.org/OpenVPN - https://github.com/OpenVPN/openvpn/pull/3 https://github.com/OpenVPN/openvpn/pull/3 - https://community.openvpn.net/openvpn/wiki/TrafficObfuscation https://community.openvpn.net/openvpn/wiki/TrafficObfuscatio... - http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.com/my-experience-with-the-great-firewal... - https://news.ycombinator.com/item?id=10905076 https://news.ycombinator.com/item?id=10905076
thinkingemote 7y ago
How about a SSH tunnel (e.g. using sshuttle) on a server you have access to?
- Mediterraneo10 7y ago
  The Great Firewall has been able to detect and block SSH tunneling for years now, probably already a decade.
- Quiark 7y ago
  they've been able to identify and block these 5 years ago

yorwba 7y ago

Some of the protocols supported by Streisand are basically useless because their packets are so easy to identify (OpenConnect and OpenVPN are definitely in that category), but I do know people successfully using Shadowsocks to circumvent the Great Firewall. They're not running their own servers, though.

netheril96 7y ago
GFW does not block all VPN protocols that are easy to identify. OpenConnect and OpenVPN are both easy to identify, but GFW interferes with the latter but not the former (for now).

zrth 7y ago

Wireguard on AWS works for me.