6 ms·

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-heres-why https://security.ias.edu/deep-packet-inspection

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-heres-why https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar from being physically in their server room and inspecting their setup. Add to the VPN a DoH resolver that I own and control too, and it makes things even better. I also block port 80 on my machine as an extra measure. No need to be using port 80 in this day and age except for captive portals which I rarely ever have to use.

ditsuke 4y ago
It's widely employed by Russian and Indian ISPs to censor access to websites. I've had a largely successful run with GoodbyeDPI 's circumvention.
- cyber_kinetist 4y ago
  South Korea also does this, and this tool is well known as one of the best circumvention methods (alongside with VPNs, but they cost money)
- izacus 4y ago
  More importantly, it's widely deployed by HNers in US to snoop though everything you do on your phone, tablet and computer if you dare to use their wifi. The ops topics are full of people claiming how critically important it is for them to sniff through everything you do on "their" network for security. You don't need to go to Russia, China or India to have your privacy violated. Just go to work.
  - kevin_thibedeau 4y ago
    Your privacy isn't violated if you avail yourself of someone else's property.
    - b112 4y ago
      Violation and legality are two entirely different things.
    - taneq 4y ago
      Depends whether you were aware of the consequences of accessing that property. If you walk through my front gate and I pants you, take photos of your junk and upload them, you'll probably be upset unless I had a sign on the gate saying (in clear language, not 14 pages of irrelevant 6pt legalese hiding a link to the actual 'privacy policy' document which admits in obfuscated language that pantsing is an option) that this would happen.
      - 0xedd 4y ago
        No. When all "gates" in a domain have this sign, it isn't less upsetting.
    - izacus 4y ago
      The networks of ISPs you're "availing yourself to" are their property.
rogers18445 4y ago
You don't control the myriad of routers between you and your server, and between the server and its destination. One reason to use commercial VPNs is to at least attempt to launder your packets.
patrakov 4y ago
Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (the city uses a geo-restricting filter out of security concerns), and you will see foreign prices (which might be 5x higher in some cases!) on sites that differentiate based on the country. Also, extra latency in games. None of that applies with GoodbyeDPI. Edit: the above is written from the viewpoint of the past myself, before emigration to the Philippines.
- 5e92cb50239222b 4y ago
  I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally compressed), and looks just like another SSH connection. I've used many other solutions (including WireGuard, etc.) on and off, but always come back to SSH.
  - userbinator 4y ago
    point your applications to That's the problem. Not all of them will implement tunneling their own traffic through SOCKS, and there's still other things like DNS that you might also want to go through the tunnel, but can't easily do so. A VPN sits at a lower layer, just looking like a regular network connection, so applications don't need to be aware.
    - 5e92cb50239222b 4y ago
      Well, yeah, that's the problem (or the main advantage depending on your viewpoint). The post I was replying to mentioned how painful it is to avoid routing through VPN where it's not needed (although it's pretty easy to do on Linux with network namespaces, and IIRC policy routing, which I've never tried). I just want to point out the simplest solution which for some reason doesn't seem to be very popular, although it covers most users' use-cases better than a VPN connection does (IMHO). Don't know about other browsers, but Firefox is able to send DNS requests through socks, whether you're using DNS-over-HTTPS or not.
pyinstallwoes 4y ago
What VPN service did you choose, and what were the contenders if any?
occamrazor 4y ago
Haven’t you just replaced trust in your ISP with trust in the hosting provider of your VPN? (Depending on yourISP and provider this can be a good trade-off)
wruza 4y ago
religiously route all my traffic through a VPN that I own and control Can you please share an easy way to do that? I’m usually not afraid of wading through configuration swamps, but when it comes to openvpn, I curl up in a corner crying.
- Zen1th 4y ago
  Personally I use dsvpn (https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn) which is super simple to setup and use, and it's made by the guy who created libsodium.
  - wruza 4y ago
    Thanks! But from what I can see in sources (please correct me if that’s wrong), it is not a vpn, and a regular vpn client cannot connect to it. Nice idea along the lines of SOCKS proxy.
    - dicknuckle 4y ago
      You can just use Tailscale if all of this seems like a pushup. It's wireguard under the hood and everything JustWorks™
- Diris 4y ago
  This is probably the easiest way. It uses wireguard instead of openvpn but I'm pretty sure it's better https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install
- blacksmith_tb 4y ago
  I have had good luck with Algo: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
DethNinja 4y ago
FYI, your setup is great if you don’t trust your ISP but it doesn’t provide any privacy. Public VPNs act as a mixer and hide your tracks. IP correlation is very easy nowadays, so persistent single connection to your own VPN won’t protect you from certain entities that correlate your traffic. DoH is better than DNS but it doesn’t provide privacy. You should switch to DNSCrypt.
diasan 4y ago
The problem / disconnect with that DPI is dead article is that corporations still want to use use, as they control their employees computers. Hence I've recently been asked to implement a URL inspecting firewall, which implies a HTTPS intercepting MiTM proxy. They will probably require some exception list where things get passed through 'unmolested', but for a white listed sub-set of sites (say well known health, banking, etc). The one thing which can break that is cert pinning, but then the corporations can simply mandate that apps requiring/using cert pinning not be used from the corporate machines. There are some bumps in the techniques caused by HTTPS RRs, AltSvc and HTTP/3, but they will be worked around, at worst by forced downgrades. The "they'll never no argument" carries no weight, as employers up front tend to inform their employees that the communications are monitored, hence giving the corporation legal cover. That said, I do generally agree with the aim of that article, but changing the corporate mindset is a different (non technical) problem; it is all about providing the corporation with a colorable argument towards reducing their liability in certain scenarios.
from 4y ago
> I religiously route all my traffic through a VPN that I own and control. But then you are losing the anonymizing effect of the VPN. If you are doing something illegal this is obviously bad but I guess it otherwise doesn't really matter. Companies like Mullvad have tens of thousands of users which means that the actions of one VPN IP address can not be attributed to just one person. You're just transferring the ability to surveil you from your ISP to whoever hosts your VPN server.
checkyoursudo 4y ago
Why not run everything through TOR then? Or is that too limiting?
SergeAx 4y ago
But why exactly do you do this? Own a server somewhere, admin it, replace or repair it in case of trouble - what for?

ditsuke 4y ago

It's widely employed by Russian and Indian ISPs to censor access to websites. I've had a largely successful run with GoodbyeDPI 's circumvention.

cyber_kinetist 4y ago
South Korea also does this, and this tool is well known as one of the best circumvention methods (alongside with VPNs, but they cost money)
izacus 4y ago
More importantly, it's widely deployed by HNers in US to snoop though everything you do on your phone, tablet and computer if you dare to use their wifi. The ops topics are full of people claiming how critically important it is for them to sniff through everything you do on "their" network for security. You don't need to go to Russia, China or India to have your privacy violated. Just go to work.
- kevin_thibedeau 4y ago
  Your privacy isn't violated if you avail yourself of someone else's property.
  - b112 4y ago
    Violation and legality are two entirely different things.
  - taneq 4y ago
    Depends whether you were aware of the consequences of accessing that property. If you walk through my front gate and I pants you, take photos of your junk and upload them, you'll probably be upset unless I had a sign on the gate saying (in clear language, not 14 pages of irrelevant 6pt legalese hiding a link to the actual 'privacy policy' document which admits in obfuscated language that pantsing is an option) that this would happen.
    - 0xedd 4y ago
      No. When all "gates" in a domain have this sign, it isn't less upsetting.
  - izacus 4y ago
    The networks of ISPs you're "availing yourself to" are their property.

rogers18445 4y ago

You don't control the myriad of routers between you and your server, and between the server and its destination. One reason to use commercial VPNs is to at least attempt to launder your packets.

patrakov 4y ago

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (the city uses a geo-restricting filter out of security concerns), and you will see foreign prices (which might be 5x higher in some cases!) on sites that differentiate based on the country. Also, extra latency in games. None of that applies with GoodbyeDPI. Edit: the above is written from the viewpoint of the past myself, before emigration to the Philippines.

5e92cb50239222b 4y ago
I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally compressed), and looks just like another SSH connection. I've used many other solutions (including WireGuard, etc.) on and off, but always come back to SSH.
- userbinator 4y ago
  point your applications to That's the problem. Not all of them will implement tunneling their own traffic through SOCKS, and there's still other things like DNS that you might also want to go through the tunnel, but can't easily do so. A VPN sits at a lower layer, just looking like a regular network connection, so applications don't need to be aware.
  - 5e92cb50239222b 4y ago
    Well, yeah, that's the problem (or the main advantage depending on your viewpoint). The post I was replying to mentioned how painful it is to avoid routing through VPN where it's not needed (although it's pretty easy to do on Linux with network namespaces, and IIRC policy routing, which I've never tried). I just want to point out the simplest solution which for some reason doesn't seem to be very popular, although it covers most users' use-cases better than a VPN connection does (IMHO). Don't know about other browsers, but Firefox is able to send DNS requests through socks, whether you're using DNS-over-HTTPS or not.

pyinstallwoes 4y ago

What VPN service did you choose, and what were the contenders if any?

occamrazor 4y ago

Haven’t you just replaced trust in your ISP with trust in the hosting provider of your VPN? (Depending on yourISP and provider this can be a good trade-off)

wruza 4y ago

religiously route all my traffic through a VPN that I own and control Can you please share an easy way to do that? I’m usually not afraid of wading through configuration swamps, but when it comes to openvpn, I curl up in a corner crying.

Zen1th 4y ago
Personally I use dsvpn (https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn) which is super simple to setup and use, and it's made by the guy who created libsodium.
- wruza 4y ago
  Thanks! But from what I can see in sources (please correct me if that’s wrong), it is not a vpn, and a regular vpn client cannot connect to it. Nice idea along the lines of SOCKS proxy.
  - dicknuckle 4y ago
    You can just use Tailscale if all of this seems like a pushup. It's wireguard under the hood and everything JustWorks™
Diris 4y ago
This is probably the easiest way. It uses wireguard instead of openvpn but I'm pretty sure it's better https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install
blacksmith_tb 4y ago
I have had good luck with Algo: https://github.com/trailofbits/algo https://github.com/trailofbits/algo

DethNinja 4y ago

FYI, your setup is great if you don’t trust your ISP but it doesn’t provide any privacy. Public VPNs act as a mixer and hide your tracks. IP correlation is very easy nowadays, so persistent single connection to your own VPN won’t protect you from certain entities that correlate your traffic. DoH is better than DNS but it doesn’t provide privacy. You should switch to DNSCrypt.

diasan 4y ago

The problem / disconnect with that DPI is dead article is that corporations still want to use use, as they control their employees computers. Hence I've recently been asked to implement a URL inspecting firewall, which implies a HTTPS intercepting MiTM proxy. They will probably require some exception list where things get passed through 'unmolested', but for a white listed sub-set of sites (say well known health, banking, etc). The one thing which can break that is cert pinning, but then the corporations can simply mandate that apps requiring/using cert pinning not be used from the corporate machines. There are some bumps in the techniques caused by HTTPS RRs, AltSvc and HTTP/3, but they will be worked around, at worst by forced downgrades. The "they'll never no argument" carries no weight, as employers up front tend to inform their employees that the communications are monitored, hence giving the corporation legal cover. That said, I do generally agree with the aim of that article, but changing the corporate mindset is a different (non technical) problem; it is all about providing the corporation with a colorable argument towards reducing their liability in certain scenarios.

from 4y ago

> I religiously route all my traffic through a VPN that I own and control. But then you are losing the anonymizing effect of the VPN. If you are doing something illegal this is obviously bad but I guess it otherwise doesn't really matter. Companies like Mullvad have tens of thousands of users which means that the actions of one VPN IP address can not be attributed to just one person. You're just transferring the ability to surveil you from your ISP to whoever hosts your VPN server.

checkyoursudo 4y ago

Why not run everything through TOR then? Or is that too limiting?

SergeAx 4y ago

But why exactly do you do this? Own a server somewhere, admin it, replace or repair it in case of trouble - what for?