3 ms·

If your network allows TLS to an arbitary DOH server it allows VPN over TLS to an arbitrary server

• judge2020 6y ago
  A lot of networks block VPNs via port number + DPI, but can't really block DNS over HTTPS if it looks like a connection to any other HTTPS website.
  • iso1631 6y ago
    Yes, which is why my VPNs are available on port 443 and 53, including a TLS based VPN. Now port 53 can and often is intercepted (but sometimes it gets through when 443 doesnt)
    • manquer 6y ago
      it does not matter under what port including 443 you are running the service, deep packet inspection (DPI) can sniff out VPN traffic, perhaps you may not encountered this type of firewall as it somewhat more expensive to run both computationally and licensing wise. It is not possible to sniff out DoH traffic via DPI as looks exactly the same as regular traffic While running flash servers for media use in corporate environment (when flash was still a thing) back I used to run into similar problems with RTMP/ RTMPS constantly.
      • shawnz 6y ago
        You can use an HTTPS "CONNECT" proxy to protect your VPN traffic in the same way (I assume that's the kind of setup they were referring to on port 443)