4 ms·
OpenVPN, Strongswan, Tinc, Wireguard and even Tor without obfuscation modules and without private entry nodes are all trivial to detect and block. Assuming one
by LinuxBender 4y ago
OpenVPN, Strongswan, Tinc, Wireguard and even Tor without obfuscation modules and without private entry nodes are all trivial to detect and block. Assuming one can reach a VPS provider outside of the country, the most likely solution would be an HTTPS enabled proxy using SNI and a wildcard cert that makes it look like one is just pushing code to a git repo. HAProxy could peel off the default traffic to an actual Gitea git repo and forward the proxy traffic to a Squid SSL-Bump proxy. Create a VM somewhere, give it a DNS name like "git.yourdomain.tld" and then proxy through that HTTPS connection from a different SNI name like "artifacts.yourdomain.tld". This isn't perfect but may work.
Another option if SSH is still permitted to VPS providers, one could tunnel over SOCKS connections through a VPS VM initially as the first hop, then through a friends home in that same region outside of Iran as the second hop to minimize the number of CATPCHA's one is subjected to. SSH can make multiple hops transparent to the client. Ensure DNS resolution in the browser is set to use the upstream SOCKS connection. As with the previous proposal, try to make the VM look like a git repo or something else work related.
One could find some examples of both of the above ideas on SuperUser, StackExchange and ServerFault.
Here [1] is a previous discussion on the topic or Iran internet lock-down.
[1] - https://news.ycombinator.com/item?id=33025954 https://news.ycombinator.com/item?id=33025954
- psyfi 4y agoCONNECT requests in Squid or similar proxies are very easy to detect as they happen before encryption I would suggest using Outline (based on Shadowsocks but with easy interface) Or set up OpenConnect Server on Cisco Anyconnect mode, it is based on HTTPS and it looks exactly as https on the wire
- LinuxBender 4y agoCONNECT is not required if using a Squid SSL Bump MiTM proxy. Squid can intercept HTTPS requests provided one generates a cert on the proxy and installs it in the OS or browser. The one thing that might stand out to the adversary is that this is a self signed certificate but that is not uncommon for developers to create. If people are interested I can post the config that includes commented steps for generating the certs. I'm not sure if it will fit in a HN comment however. Either way, I agree Shadowsocks is another great option. The more options people have the better. Outline on the other hand appears to be a service that someone would have to trust and pay for. Commercial VPN providers are a great targets for swooping up large swaths of dissenting citizens. I believe people should stick with tools they can entirely host themselves. Using a VPN provider is probably fine for things like Netflix region selection but very much not for subverting a states control. It's risky enough to pay for a VM. People outside of Iran could contribute VM's for this purpose.
- LinuxBender 4y agoI should also add for clarification that if going the Squid SSL Bump route, the VPS VM should only be hosting HAProxy using a Layer 4 TCP VIP and nothing else. HAproxy should be routing the Squid Intercept to a private home in the region of the VPS provider and outside of Iran. Using Squid from a VPS directly nearly guarantees one will experience non-stop Captchas. Iranian HTTPS Client with cert installed -> HAProxy Layer 4 TCP listener on a VPS VM -> Squid SSL Bump running on a home router at someones house or business. Also important is to not do any of this from a cell phone.