5 ms·

Is it easier to get past the firewall in super urban China? Why is that?

kube-system 5y ago
Pure speculation, but I would guess that it may make practical sense for the party to relax the firewall in places where access to internet resources abroad could be more necessary for economic reasons.
tyingq 5y ago
The much heavier traffic and variety of traffic in urban areas probably means looser rules. Even if just to reduce the noise for the great firewall admins.
- azinman2 5y ago
  It’s not about heavier traffic. China literally has different rules for different parts of the country, different ISPs, different wireless providers (especially foreign versus domestic), etc.
  - tyingq 5y ago
    That doesn't mean that "volume/variety" isn't also a driver for different rules.
    - azinman2 5y ago
      Where do you get that from, and what would be the technical basis?
      - tyingq 5y ago
        >what would be the technical basis? Just the sort of thing you see in the real world. It's much easier to lock down access for a network with less people using it. A network with more people starts to find all the edge cases where your lock-down rules break legitimate things, which results in calls to your boss from people with the clout to make you change stuff. Similar for reporting, alerting, etc. Volume and variety of traffic can force you to be more lenient in larger networks. Or lose any real effectiveness because your signal/noise ratio is now bad.
wyager 5y ago
I always had a hard time getting past the GFWoC in Shenzhen, even with wg tunnels to my own servers.
- kurthr 5y ago
  I don't remember the specifics, but there were a lot of different packet types (eg UDP not just TCP) and protocols that ExpressVPN used to negotiate and transfer data. I'm sure there was quite a bit of cat-mouse, but I also assumed that there might be a symbiotic (or more) connection between Chinese security and ExpressVPN. I just wanted things to work, and didn't care so much about the actual "privacy" of the tunnel.
- blablablub 5y ago
  With wg sending keep alive packets every 30 seconds it is one of the easiest protocols to block. Quite surprised you got any connection at all.

Pure speculation, but I would guess that it may make practical sense for the party to relax the firewall in places where access to internet resources abroad could be more necessary for economic reasons.

tyingq 5y ago

The much heavier traffic and variety of traffic in urban areas probably means looser rules. Even if just to reduce the noise for the great firewall admins.

azinman2 5y ago
It’s not about heavier traffic. China literally has different rules for different parts of the country, different ISPs, different wireless providers (especially foreign versus domestic), etc.
- tyingq 5y ago
  That doesn't mean that "volume/variety" isn't also a driver for different rules.
  - azinman2 5y ago
    Where do you get that from, and what would be the technical basis?
    - tyingq 5y ago
      >what would be the technical basis? Just the sort of thing you see in the real world. It's much easier to lock down access for a network with less people using it. A network with more people starts to find all the edge cases where your lock-down rules break legitimate things, which results in calls to your boss from people with the clout to make you change stuff. Similar for reporting, alerting, etc. Volume and variety of traffic can force you to be more lenient in larger networks. Or lose any real effectiveness because your signal/noise ratio is now bad.

wyager 5y ago

I always had a hard time getting past the GFWoC in Shenzhen, even with wg tunnels to my own servers.

kurthr 5y ago
I don't remember the specifics, but there were a lot of different packet types (eg UDP not just TCP) and protocols that ExpressVPN used to negotiate and transfer data. I'm sure there was quite a bit of cat-mouse, but I also assumed that there might be a symbiotic (or more) connection between Chinese security and ExpressVPN. I just wanted things to work, and didn't care so much about the actual "privacy" of the tunnel.
blablablub 5y ago
With wg sending keep alive packets every 30 seconds it is one of the easiest protocols to block. Quite surprised you got any connection at all.