3 ms·
> SSH is very simple and there’s almost nothing a SSH tunnel can’t do. You cannot disguise your SSH traffic mimicking HTTPS traffic which help you to bypass DP
by pelasaco 4y ago
> SSH is very simple and there’s almost nothing a SSH tunnel can’t do.
You cannot disguise your SSH traffic mimicking HTTPS traffic which help you to bypass DPI solutions.. so its easy to block/filter/log your traffic or even pinpoint you in an adverse environment.
- tambourine_man 4y agoPlease expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?
- patrakov 4y ago
- pelasaco 4y agoWhy apache would care? We are talking about DPI solutions, aka deep packet inspection. They are normally deployed inline, and SSH tunnels are so often blocked, that in some solutions you have it one click away from you https://www.sonicwall.com/support/knowledge-base/how-to-block-ssh-tunneling-proxy-tunneling-using-application-control/170503546461794/ https://www.sonicwall.com/support/knowledge-base/how-to-bloc.... Other solutions try to make the traffic similar with Apache + Firefox to make it harder to be detectable and blocked by DPI solutions..
- tambourine_man 4y agoInteresting, thanks. And would Wireguard be transparent to DPI?
- pelasaco 4y agothere are many implementations of DPI out there, each one with your own set of rules and heuristics... this discussion[1] talks about it, but the short answer is: it depends References: [1] https://www.reddit.com/r/WireGuard/comments/ajv0eq/wireguard_and_deep_packet_inspection_dpi/ https://www.reddit.com/r/WireGuard/comments/ajv0eq/wireguard...
- tambourine_man 4y ago@patrakov I can't reply to you directly. If the only thing a web server could do is differentiate tunnel from direct IP connection with or without firewall/NAT, which are ubiquitous, it's an interesting effort, but a tour de force with little gain IMO.