4 ms·
Can you not disguise the wireguard tunnels as something else? E.g. just set the destination/listen port as 443/UDP? Or 53, 123.
by CameronNemo 6y ago
Can you not disguise the wireguard tunnels as something else? E.g. just set the destination/listen port as 443/UDP? Or 53, 123.
- judge2020 6y agoWhile not usual for places like coffee shops, i've seen cruises and hotels do DPI since probably a sizable amount of revenue can be generated from fast wifi access or by unblocking all sites.
- CameronNemo 6y agoYep that is always an issue. Not sure how a hypothetical QUIC tunnel would avoid that, though. Would appreciate any info you can provide on mitigating deep packet inspection blocking techniques.
- grishka 6y agoI've been tempted to write a quick-and-dirty websocket tunnel for quite some time. Let's see how they DPI any of that without breaking anything else.
- shawnz 6y agoWhy not just use an HTTP CONNECT proxy running over HTTPS?
- grishka 6y agoYou could do that? Well, you probably could. But there are some "proactive" DPIs that make a request themselves before letting you through. Would this protect against that? It's easy to set up a regular web server that would serve what everyone would see as an ordinary personal website, except when you make a request to a secret URL.
- shawnz 6y agoYou could require authentication (and as other posters pointed out, make sure to spoof any wrong authentications for maximum deniability). It is also simple to serve some pages over HTTP alongside the proxy functionality so that the server appears to be a typical web server. Just turn on mod_proxy_connect in addition to your existing httpd configuration if you use Apache for example. I use this method on my domains, although I've never tried using it from within e.g. China