5 ms·

Is mullvad able to drill through the Great Firewall of China? Few VPN can

by gopty 6y ago

wwwwwwwww 6y ago
Nowadays its probably best to set up your own VPN server for that. Back when I lived there, most VPNs got occationally blocked, then they would get new IPs and work fine again. But from what I heard, it got way worse since Winnie the Pooh took over.
- dheera 6y ago
  Agree. I always use my own VPN for this. Most VPN services get blocked eventually and then play cat-and-mouse to get themselves back up, so the service is overall unreliable. The China firewall also does some "intelligent" blocking of common VPN protocols by fingerprinting their traffic patterns, handshakes, ports, and other things. If you set up own server, it helps to modify the protocol or wrap it in a proxy that obfuscates the VPN traffic as something innocent-looking. Basically, if you implement something like TCP/IP-over-cat-picture-jpeg-files-on-HTTP-port-80 you'll generally have a rock solid experience. (That's not exactly what I do, but it's along the same lines of thinking, you get the idea, be creative.) Unfortunately I'm not going to provide code to do this though because that makes it vulnerable to its traffic pattern being fingerprinted and blocked. Also, avoid AWS. Using slightly lesser-known IaaS providers helps.
  - rightbyte 6y ago
    Interesting thought. A little part of me want to make a TCP-over-HTML cat pictures wrapper. Maybe put the payload in every fifth cat pixel or something. Should work for bmp:s right.
  - mekster 6y ago
    So you'd be exchanging cat pictures million times a day? That'll stand out well.
- myrandomcomment 6y ago
  I am not sure using your own is a good idea. Every time I was in China for the last 3 years they would quickly find and block my small startups VPN. I was able to send an email and ask someone to move it to a new IP. Now imaging you have your own setup and they block it, as well as access to the provider you used to create the VM that runs it. Using something like Nord or the like at least you know that they will keep changing the IPs. Your mileage might vary, but this was my experience.
  - VectorLock 6y ago
    I guess if you really wanted to be clever you could set up a number of IP addresses and if your VPN doesn't see you login for, say, a day, switch to another IP. Or just give your VM 14 addresses and rotate them as you need. For a 2 week trip/14 addresses this would cost you about $26 on AWS.
    - blacksmith_tb 6y ago
      Digital Ocean will let you use their Floating IPs to do this for no charge (I have an Algo VM I'm paying them to host). 1: https://www.digitalocean.com/docs/networking/floating-ips/ https://www.digitalocean.com/docs/networking/floating-ips/
  - acct776 6y ago
    You wouldn't advertise you were using your personal VPS as a VPN.
    - acdha 6y ago
      Your activity advertises that to anyone who can see the traffic. Even if you use a popular port, the traffic volume and timing easily stands out — and if you’re actually in China ask what they’d conclude from a client which does no other traffic except for that one IP/protocol/port, unlike basically every other device.
- Stevvo 6y ago
  They often block VPN traffic at the protocol level i.e. even rolling your own is going to be a headache. That said, I never had problems using an SSH tunnel and the end result is the same.
  - dilyevsky 6y ago
    Heh if they blocked ssh my access logs would be considerably leaner
beermonster 6y ago
Shadowsocks always used to work well enough to evade the GFoC if you hosted your own VPS. Which is simpler than say strongSwan - and IPSEC gives the game away anyway. https://gfw.report/blog/ss_advise/en/ https://gfw.report/blog/ss_advise/en/ https://gfw.report/blog/ss_tutorial/en/ https://gfw.report/blog/ss_tutorial/en/

Is mullvad able to drill through the Great Firewall of China? Few VPN can

by gopty 6y ago

Is mullvad able to drill through the Great Firewall of China? Few VPN can

Nowadays its probably best to set up your own VPN server for that. Back when I lived there, most VPNs got occationally blocked, then they would get new IPs and work fine again. But from what I heard, it got way worse since Winnie the Pooh took over.

dheera 6y ago
Agree. I always use my own VPN for this. Most VPN services get blocked eventually and then play cat-and-mouse to get themselves back up, so the service is overall unreliable. The China firewall also does some "intelligent" blocking of common VPN protocols by fingerprinting their traffic patterns, handshakes, ports, and other things. If you set up own server, it helps to modify the protocol or wrap it in a proxy that obfuscates the VPN traffic as something innocent-looking. Basically, if you implement something like TCP/IP-over-cat-picture-jpeg-files-on-HTTP-port-80 you'll generally have a rock solid experience. (That's not exactly what I do, but it's along the same lines of thinking, you get the idea, be creative.) Unfortunately I'm not going to provide code to do this though because that makes it vulnerable to its traffic pattern being fingerprinted and blocked. Also, avoid AWS. Using slightly lesser-known IaaS providers helps.
- rightbyte 6y ago
  Interesting thought. A little part of me want to make a TCP-over-HTML cat pictures wrapper. Maybe put the payload in every fifth cat pixel or something. Should work for bmp:s right.
- mekster 6y ago
  So you'd be exchanging cat pictures million times a day? That'll stand out well.
myrandomcomment 6y ago
I am not sure using your own is a good idea. Every time I was in China for the last 3 years they would quickly find and block my small startups VPN. I was able to send an email and ask someone to move it to a new IP. Now imaging you have your own setup and they block it, as well as access to the provider you used to create the VM that runs it. Using something like Nord or the like at least you know that they will keep changing the IPs. Your mileage might vary, but this was my experience.
- VectorLock 6y ago
  I guess if you really wanted to be clever you could set up a number of IP addresses and if your VPN doesn't see you login for, say, a day, switch to another IP. Or just give your VM 14 addresses and rotate them as you need. For a 2 week trip/14 addresses this would cost you about $26 on AWS.
  - blacksmith_tb 6y ago
    Digital Ocean will let you use their Floating IPs to do this for no charge (I have an Algo VM I'm paying them to host). 1: https://www.digitalocean.com/docs/networking/floating-ips/ https://www.digitalocean.com/docs/networking/floating-ips/
- acct776 6y ago
  You wouldn't advertise you were using your personal VPS as a VPN.
  - acdha 6y ago
    Your activity advertises that to anyone who can see the traffic. Even if you use a popular port, the traffic volume and timing easily stands out — and if you’re actually in China ask what they’d conclude from a client which does no other traffic except for that one IP/protocol/port, unlike basically every other device.
Stevvo 6y ago
They often block VPN traffic at the protocol level i.e. even rolling your own is going to be a headache. That said, I never had problems using an SSH tunnel and the end result is the same.
- dilyevsky 6y ago
  Heh if they blocked ssh my access logs would be considerably leaner

beermonster 6y ago

Shadowsocks always used to work well enough to evade the GFoC if you hosted your own VPS. Which is simpler than say strongSwan - and IPSEC gives the game away anyway. https://gfw.report/blog/ss_advise/en/ https://gfw.report/blog/ss_advise/en/ https://gfw.report/blog/ss_tutorial/en/ https://gfw.report/blog/ss_tutorial/en/