4 ms·

This is a good recommendation. Using Tor sounds good in theory, but it's too far easy to identify all of the Tor connections and identify the residences connec

This is a good recommendation. Using Tor sounds good in theory, but it's too far easy to identify all of the Tor connections and identify the residences connected to them. I would suggest using SSH tunnels on whatever port a given server normally communicates on. If this is 443, connections should just look like normal web browsing on an ISP level. If the server is used to transmit other data over TLS using that port should be fine too. All of that said, the challenging thing is not to secure the traffic, but to make it look normal. A persistent connection is not normal from a residential IP in most cases. This means you should take your session down once you've sent your messages for the day.

tsujamin 4y ago
> If this is 443, connections should just look like normal web browsing on an ISP level Except that it doesn't look like TLS - depending on what the traffic inspection capabilities look like I imagine someone speaking SSH on port 443 is pretty incriminating :/
- JonChesterfield 4y ago
  ssh over 443 is likely to be rather common since most firewalls leave 443 alone
LinuxBender 4y ago
If the datacenter had been using SSH on port 22 to AWS in the past, I would just stick with that. The less changes the less obvious something is out of place. It sounds like they can still egress the datacenters for now. The connection to the residence would be the last hop in the SSH proxy foward chain meaning that all Iran will see is Datacenter -> AWS. Then it is AWS -> residence. Iran would not have visibility into AWS egress traffic, rather Five-Eyes [1] would see everything in and out of AWS. Datacenter -> Non-Iranian-AWS Region -> Non-Iranian Residence -> Internet. The flow from the DC to AWS is all they would see. [1] - https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
- 4m1rk 4y ago
  Just a side note: I guess it still can be suspicious as AWS is banned for Iranian. Irainians usually use other VPS providers.
  - LinuxBender 4y ago
    Ah I was unaware. In that case they should use whatever VPS they normally use that is outside of Iran. Hopefully some of them are outside of the country.

tsujamin 4y ago

> If this is 443, connections should just look like normal web browsing on an ISP level Except that it doesn't look like TLS - depending on what the traffic inspection capabilities look like I imagine someone speaking SSH on port 443 is pretty incriminating :/

JonChesterfield 4y ago
ssh over 443 is likely to be rather common since most firewalls leave 443 alone

LinuxBender 4y ago

If the datacenter had been using SSH on port 22 to AWS in the past, I would just stick with that. The less changes the less obvious something is out of place. It sounds like they can still egress the datacenters for now. The connection to the residence would be the last hop in the SSH proxy foward chain meaning that all Iran will see is Datacenter -> AWS. Then it is AWS -> residence. Iran would not have visibility into AWS egress traffic, rather Five-Eyes [1] would see everything in and out of AWS. Datacenter -> Non-Iranian-AWS Region -> Non-Iranian Residence -> Internet. The flow from the DC to AWS is all they would see. [1] - https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes

4m1rk 4y ago
Just a side note: I guess it still can be suspicious as AWS is banned for Iranian. Irainians usually use other VPS providers.
- LinuxBender 4y ago
  Ah I was unaware. In that case they should use whatever VPS they normally use that is outside of Iran. Hopefully some of them are outside of the country.