11 ms·
DSVPN – VPN using TCP at port 80 and 443
- parliament32 7y agoIs openvpn really that hard to set up? I don't remember having any issues just tweaking the default config file. If you want tcp 443 you just: port 443 proto tcp Is that really too hard?
- mikroskeem 7y agoReminds me this: https://github.com/unbit/vpn-ws https://github.com/unbit/vpn-ws Too bad that it never evolved further.
- Tepix 7y ago> Uses only modern cryptography, with formally verified implementations. That's a bit light on details. Does it have hardware acceleration? Replay attack protection? Perfect forward secrecy? What are the underlying algorithms? Implementation verified by whom? > Small (~25 KB), with an equally small and readable code base. No external dependencies. This looks cool, however I don't like the fact that it doesn't use a trusted crypto library such as libsodium. It is likely to get less review and if weaknesses are detected in the algorithms, it is less likely to be improved.
- sa1 7y ago> This looks cool, however I don't like the fact that it doesn't use a trusted crypto library such as libsodium. It is likely to get less review and if weaknesses are detected in the algorithms, it is less likely to be improved. That's somewhat amusing given that the author of dsvpn is the author of libsodium.
- forgotmypwd123 7y agoall the more reason for dsvpn to use libsodium!
- amq 7y ago> That's a bit light on details. Does it have hardware acceleration? Replay attack protection? Perfect forward secrecy? What are the underlying algorithms? Implementation verified by whom? More details here: https://github.com/jedisct1/charm https://github.com/jedisct1/charm
- gnode 7y agoThe Charm library appears to implement the Xoodoo cipher using SIMD instructions (SSE on x86; NEON on ARM). Implemented by the same author as the VPN. There appears to be a key exchange handshake to prevent replay attacks. PFS: doesn't look like it.
- jedisct1 7y agohttps://news.ycombinator.com/item?id=20493585 https://news.ycombinator.com/item?id=20493585
- armitron 7y agoKey rotation can in many cases be ultra annoying and you dismiss PFS far too easily. After Snowden, we know for a fact nation states are conducting massive data capture operations. In some cases, visiting specific trigger sites is enough to tag you. PFS is very useful and there is nothing wrong with admitting that DSVPN can be unsuitable for more people than just axe murderers.
- ComputerGuru 7y agoI automatically cringe and walk away when I see tcp over tcp. I’ve been bitten by it too many times. Someone correct me if I’m wrong, but it’s fundamentally incorrect and is pretty much guaranteed to devolve into pathological cases.
- xrisk 7y agoUseful for tunnelling out of environments where UDP is blocked.
- pkulak 7y agoSOCKS seems okay.
- mrb 7y agoSOCKS is not TCP over TCP. Application data (not TCP packets) is directly transferred over one TCP connection.
- mrb 7y agoHere is what the author of DSVPN says in the readme about that: «TCP-over-TCP is not as bad as some documents describe. It works surprisingly well in practice, especially with modern congestion control algorithms (BBR). For traditional algorithms that rely on packet loss, DSVPN couples the inner and outer congestion controllers by lowering TCP_NOTSENT_LOWAT and dropping packets when congestion is detected at the outer layer.»
- xfs 7y agoThis is wrong. BBR still does retransmission if packets do not arrive on time, and any retransmission in the inner TCP stack automatically becomes badput that wastes the outer TCP stack which is likely at the same time also doing retransmission for packet losses at lower layer. TCP_NOTSENT_LOWAT is not a solution to this either. It is a solution for HTTP/2 to be more aware of the congestion state and prioritize traffic properly, which itself does not do retransmission. It makes the buffer smaller so congestion is reported to upper layer earlier but still much later than when the actual congestion happens, distorting the upper/inner TCP congestion control. Also, a 128KiB value is hardcoded here for this knob, effectively rendering it only useful for a bandwidth delay product of 5Mbps * 200ms RTT.
- isatty 7y ago3 source files, amazing. This is a great opportunity for folks to learn more about implementing a VPN. I'm planning to re-implement it in rust (to learn from) and then contribute to Wireguards rust effort.
- yeasayer 7y ago> WireGuard doesn't work over TCP Can somebody well versed explain what the difference between TCP and UDP in this case? I obviously know what these are, I just don't understand why it's such a debatable choice applied to VPNs.
- 01CGAT 7y agohttps://openvpn.net/faq/what-is-tcp-meltdown/ https://openvpn.net/faq/what-is-tcp-meltdown/
- drewmol 7y ago01CGAT’s link sums it up as: TCP is not designed to be stacked and doing so results in the exponentially increasing retry timeout feature, used for reliability optimization of the protocol, conflicting to provoke excessive retransmission attempts by the upper layer TCP. The detailed explanation is in the linked article: “Why TCP over TCP is a bad idea”[0]. It was broken for me so I dug up an archive.org copy. The upper layer transmission control and and retransmission attempts are completely unnecessary as transmission is already guaranteed by the lower layer TCP. The upper layer TCP, unaware of TCP underneath and having an increasing timeout on acknowledgment failure, can begin to queue up more retransmission than the lower layer can process increasing congestion and inducing a meltdown effect. Explained better here: [0]https://web.archive.org/web/20190531210932/https://sites.inka.de/bigred/devel/tcp-tcp.html https://web.archive.org/web/20190531210932/https://sites.ink...
- aleks_me2 7y agoThat's a great tool. Easy to use and really robust in daily use. thanks for writing ;-)
- skanga 7y agoAny plans for a version on Windows?
- Erlich_Bachman 7y agoFrom the webpage: Non-features: Anything else. Including supporting operating systems I don't use. Never ever: Any feature request mentioning systemd. Cringe... hard to see why this toy project is this even on HN...
- nprateem 7y ago> Cringe... hard to see why this toy project is this even on HN... Or why it's been submitted to HN 6 times in the last 2 weeks...
- ossm1db 7y agoand every time it is posted, the "TCP over TCP is a bad idea" link is brought up (once by myself). Each time, the poster/supporters downplay TCP Meltdown. Solutions for VPN over TCP 80/443 already exist. It makes a great pet project, don't get me wrong, but it's not going to get any interest from industry professionals.
- paulannesley 7y agoToy projects are my favourite HN content. It's the H in HN.
- microcolonel 7y agoSeems like it's a personal project, and the author is absolutely ruling out supporting anything he doesn't like, including anything peripherally related to systemd, which seems a bit childish to me; but heh, it's not my work.
- iamnotacrook 7y agoHow is not doing something you don't want to do childish? Is it childish go to Barcelona instead of Paris on holiday?
- sam_lowry_ 7y ago> OpenVPN is horribly difficult to set up. OpenVPN is dead easy to setup with a shared secret, and it can work over TCP in pretty much the same way.
- Erlich_Bachman 7y agoPlus the project lacks in features, you can't compare it to OpenVPN, it basically has done one sinlge usecase, for one OS, etc. So basically the author thought it was simple enough for him to write a new software, but not simple enough to setup OpenVPN? (which anyone can do, especially in the shared secret case?) This project smells. I would not recommend anyone to use this project, it seems like something the author have simply enjoyed writing, not something that is created for using. Also how is "using ports 80 and 443" is a new "feature" when every other VPN can do exactly that?
- vardump 7y ago> Plus the project lacks in features, you can't compare it to OpenVPN, it basically has done one sinlge usecase, for one OS, etc. Looks like mainly just Windows is missing? I didn't check it carefully, but seems to be fine on macOS and Linux. Not sure if the server would run on macOS, but I don't think that would be a common use case.
- Naac 7y agoWhile I don't think setting up openvpn is "difficult", in the sense that it's a hard problem to solve, I would definitely not go as far as to say that it is "dead easy". Setting up openvpn is definitely involved[0]. And I think being concerned that you've configured something incorrectly is a real issue, especially when it comes to security. [0] https://wiki.archlinux.org/index.php/OpenVPN https://wiki.archlinux.org/index.php/OpenVPN
- Erlich_Bachman 7y agoBut you would trust this toy project in terms of security? The point of something like OpenVPN is that all security cases and bugs are worked out already, and there is tons of information for all use cases, and everything is already polished. Sure you might need to learn some new configuration options, but you won't just use them in this project, they will serve you for the rest of your life for all possible VPN usage cases.
- sayrer 7y agono one could have predicted this!
- kccqzy 7y agoWhat's the significance of emphasizing port 80 and 443? You can assign basically any ports to any application. If some firewall blocks all traffic but 443, you can configure the service yourself to listen on 443.
- wongarsu 7y ago443 is a nice default since it's the most likely port to be both unblocked and left alone by middleboxes. But I agree that it's not exactly a unique feature. "DSVPN - Dead Simple VPN over TCP" would have been a better headline
- jerf 7y agoYou, I, and many of the readers here know that. The rest of the world does not. I've been asked before why I had something that needed to be encrypted running over port 80 and thus, unencrypted. It was a bit of a challenge to explain that we actually used SSL on port 80 just fine. (Somewhat similar reasons this VPN uses these ports.)
- penagwin 7y agoPort 443 is special because it's dedicated to common encrypted web traffic (HTTPS) - so the port is always available are rarely tampered with. If the traffic is inspected it will resemble HTTPS traffic anyway. It's not detection proof - but it avoids a TON of common problems with VPNS.
- Znafon 7y ago> WireGuard doesn't work over TCP. I see this repeated in a lot of places about WireGuard but is there anything wrong with UDPTunnel (http://www.cs.columbia.edu/~lennox/udptunnel/ http://www.cs.columbia.edu/~lennox/udptunnel/)? Why would one prefer this instead of WireGuard + UDPTunnel?
- comex 7y agoThere's also udp2raw-tunnel: https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel It allows you to tunnel UDP over a fake, non-lossless TCP connection. That is, it wraps packets in TCP headers to make them look like TCP to firewalls, but it doesn't actually implement TCP; instead, each "TCP" packet corresponds to one UDP packet, and it makes no attempt to resend dropped packets. This way you avoid the problems with TCP-over-TCP.
- mhandley 7y agoIf you're going to pretend to be TCP, you probably need to look like TCP to middleboxes. When we investigated this a few years back, we found that on port 80, only 85% of the client locations we tested would pass TCP if there were holes in the sequence space. In fact this heavily influenced the design of Multipath TCP (MPTCP). The paper is here, relevant section is 4.3: https://conferences.sigcomm.org/imc/2011/docs/p181.pdf https://conferences.sigcomm.org/imc/2011/docs/p181.pdf
- Hello71 7y agoctrl-f "seq" In FakeTCP header mode,udp2raw simulates 3-way handshake while establishing a connection,simulates seq and ack_seq while data transferring. --seq-mode <number> seq increase mode for faketcp: 0:static header,do not increase seq and ack_seq 1:increase seq for every packet,simply ack last seq 2:increase seq randomly, about every 3 packets,simply ack last seq 3:simulate an almost real seq/ack procedure(default) 4:similiar to 3,but do not consider TCP Option Window_Scale, maybe useful when firewall doesnt support TCP Option --seq-mode The FakeTCP mode does not behave 100% like a real tcp connection. ISPs may be able to distinguish the simulated tcp traffic from the real TCP traffic (though it's costly). seq-mode can help you change the seq increase behavior slightly. If you experience connection problems, try to change the value.
- ac130kz 7y agoAgain, no Windows support. The code base isn't that big though, maybe it's the time to implement one myself.
- hclaria 7y agoOr you could encapsulate OpenVPN inside stunnel to make it indiscernible from regular HTTPS traffic https://www.perfect-privacy.com/en/manuals/linux_openvpn_stealth_stunnel https://www.perfect-privacy.com/en/manuals/linux_openvpn_ste...
- dzsekijo 7y agoI wonder how it fares compared to VPN over ssh, https://help.ubuntu.com/community/SSH_VPN https://help.ubuntu.com/community/SSH_VPN
- davidcollantes 7y agoWhen it comes to simplicty, DSVPN beats it.
- deleted 7y ago[deleted]
- david_draco 7y agoIn what metric would you be interested in?
- rkeene2 7y agoThere's no need to "sudo ssh" (which has all kinds of bad implications). For an example see: http://www.rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm http://www.rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm
- progval 7y ago> Maybe: > * Support for multiple clients. As long as it doesn't support multiple clients that can connect to each other, it's more of a proxy/gateway than a VPN.
- ggregoire 7y agoA simple noob question: in this context where I want to access a private remote machine, what are the advantages of a VPN (let's say over TCP, I don't know if it matters?) vs. a simple ssh tunnel?
- deleted 7y ago[deleted]
- brennebeck 7y agoI think that really depends on whether you need all traffic routed through the tunnel/vpn and what else you were trying to accomplish. For just basic system access there isn’t much advantage to vpn, but it would really depend on what you’re trying to accomplish (keep people out? Just secure your connection to another machine? Etc.).
- amaccuish 7y agoBut does it look like SSL traffic? That's the problem with OpenVPN, it's quite easy detect. For restrictive environments I much prefer Ocserv (uses OpenConnect/AnyConnect protocol) or mirosoft's sstp protocol. I was back in Dubai recently and sadly WireGuard didn't work, so I had to use OpenConnect, which while doesn't have the connectionless-like behaviour of WireGuard atleast worked.
- privethedge 7y agohttps://en.wikipedia.org/wiki/SoftEther_VPN https://en.wikipedia.org/wiki/SoftEther_VPN > Firewalls performing deep packet inspection are unable to detect SoftEther's VPN transport packets as a VPN tunnel because HTTPS is used to camouflage the connection.
- amaccuish 7y agoExactly. SoftEther is also one of the only linux servers I know of that can do Microsoft's SSTP protocol, which is convenient since it's built in to Windows and looks like HTTPS. I'm not sure SoftEther's own SSL protocol is widely used, or it's more used for site-to-site.
- Sirened 7y agoIt's cool but the author's motivation doesn't make sense. OpenVPN was too hard to setup so they decided to write their own VPN from scratch? It's cool as an academic endeavor but by actually using it, they not only tossed out all the years of security work and the audits OpenVPN has gone through but also spent a ton of time creating something that they now will have to personally maintain.
- IronWolve 7y agoOpenvpn takes some work to setup, but it works over proxies very very well. I can vpn into my cloud vm over the corporate squid based proxy (barracuda and plain squid) from my linux desktop, over port 443. But yes, things could be much more simple to setup for the average user, it shouldnt take hours to lean configs and setup.
- faissaloo 7y agoOpenVPN is more than just hard to setup, it's legitimately absurd and the documentation isn't even close to navigable.
- adonnjohn 7y agoI'm glad it's not just me... I've tried 3 separate times now to set up the necessary pieces. I get all the way to the end and it just... doesn't work. And I'm just not a good enough network engineer to sniff out why.
- stevewillows 7y agoA lot of people in the low-end VPS community use this [1] -- and I've used it ever since. The installation script just works. Adding a new user? Run the script. I don't think we're alone in the struggle. https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install
- adonnjohn 7y agoThanks for the resource! It's always a pet project to try and set it up, so I never researched any install helpers very heavily. I'll definitely try this next.
- dClauzel 7y ago> Blocks IPv6 on the client to prevent IPv6 leaks. No IPv6? That's a no.
- faissaloo 7y ago>Doesn't perform any heap memory allocations That's fascinating, I wonder how they managed that (unless they used cheats like sbrk of course).
- dragontamer 7y agoIts not super hard if you don't give a care about your local stack space. Just over-allocate a bunch of static arrays on your stack. Stack variables in C99 (and most C++ compilers supporting C99) can even have a dynamic, run-time determined length. It compiles down to a "add esp, (blah)" command, if anyone is curious, so its super efficient. I prefer stack-based allocations in my code. I only use heap-variables if I'm passing data between threads. If you need to pass data "up" your functions, then its a parameter (that is passed in on the stack). I would argue that stack-based variables are preferred in C++ due to RAII.
- oso2k 7y ago`sbrk` modifies the heap [0]. [0] https://linux.die.net/man/2/sbrk https://linux.die.net/man/2/sbrk
- faissaloo 7y agoOh right I was confusing it with alloca() http://man7.org/linux/man-pages/man3/alloca.3.html http://man7.org/linux/man-pages/man3/alloca.3.html