3 ms·
Please expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?
by tambourine_man 4y ago
Please expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?
- patrakov 4y ago
- pelasaco 4y agoWhy apache would care? We are talking about DPI solutions, aka deep packet inspection. They are normally deployed inline, and SSH tunnels are so often blocked, that in some solutions you have it one click away from you https://www.sonicwall.com/support/knowledge-base/how-to-block-ssh-tunneling-proxy-tunneling-using-application-control/170503546461794/ https://www.sonicwall.com/support/knowledge-base/how-to-bloc.... Other solutions try to make the traffic similar with Apache + Firefox to make it harder to be detectable and blocked by DPI solutions..
- tambourine_man 4y agoInteresting, thanks. And would Wireguard be transparent to DPI?
- pelasaco 4y agothere are many implementations of DPI out there, each one with your own set of rules and heuristics... this discussion[1] talks about it, but the short answer is: it depends References: [1] https://www.reddit.com/r/WireGuard/comments/ajv0eq/wireguard_and_deep_packet_inspection_dpi/ https://www.reddit.com/r/WireGuard/comments/ajv0eq/wireguard...
- tambourine_man 4y ago@patrakov I can't reply to you directly. If the only thing a web server could do is differentiate tunnel from direct IP connection with or without firewall/NAT, which are ubiquitous, it's an interesting effort, but a tour de force with little gain IMO.