16 ms·

Russia Starts Blocking VPN Protocols

166 points by 0xDEF 3y ago

0xDEF 3y ago
Most VPN services are already blocked in Russia by both mobile and landline providers. Many also block Tor. However now it seems like Russian mobile providers are blocking not just VPN services but even the underlying VPN protocols (WireGuard, OpenVPN). Interestingly Telegram is still not blocked in Russia.
- drbig 3y ago
  > Interestingly Telegram is still not blocked in Russia. Could that be taken as a sign that it is not blocked _for a reason_, or is it already too much tinfoil on the head?
  - dijit 3y ago
    It caused a lot of issues for Russians when they tried to block it, because they basically blocked entire sections of AWS and GCP. The real tinfoil hat is assuming that they allow it because it's compromised; the founder of Telegram has absolutely no love lost for the Russian state, they basically seized his company (VK; a hugely popular facebook-like which also has a music player and such) and all his assets that were in the country after trying to exert control over him (and his desire not to be controlled); that's why telegram was founded in the first place. Of course, I have no first-hand account except watching as my video game became unplayable for Russians while the Telegram blocking was happening and my GCP rep explaining it to me, and that I had an Estonian girlfriend for 7 years who was giving me the play-by-play on what was happening.
    - baybal2 3y ago
      While he maintained an office in Russia, for everyone to see, while denying that publicly.
      - dijit 3y ago
        Possibly the easiest thing to exist in error or for the state to fabricate and yet you didn’t even provide a citation. tsk Dude is literally living in exile, yet you claim allegiance by him being affiliated with Russia, when his only crime here was being born in there and thus having some ties. Seems crazy to me. Like, cold-war propaganda crazy. this idea that Telegram is somehow nebulously “the enemy” and signal is “the virtuous” is so patently and clearly a propaganda campaign and we fall right into it.
        throwaway473825 3y ago
        The point of Signal having end-to-end encryption is to avoid trust. Telegram, on the other hand, relies on trust. Obviously that's going to attract more criticism.
        dijit 3y ago
        That argument doesn't work when you cant reliably distribute and run your own clients and given that they (Signal) have hidden updates for over a year to work on mobilecoin in the dark (proving their willingness and ability to do this) it leaves little left for that argument; theres also a bunch of other stuff but that is meaningless to get into. The point is that Signal mostly also boils down to: “trust us”. On the other hand, while you are totally right about Telegram being quite a bit “trust us”; but they have better UX and are not at all hostile to third party clients and alternative implementations of their “secure” messaging protocol. Which is also the subject of a lot of controversy of course, because (*puts on tinfoil hat*) it was originally handrolled and not US cryptographer approved. (always get downvoted when I point out that Signal is doing weird stuff which only serves really to solidify my stance)
    - littlestymaar 3y ago
      > the founder of Telegram has absolutely no love lost for the Russian state No need to have any love, strong-arming people is usually where mafias shine.
    - Kretinsky 3y ago
      It's likely a government honeypot with backdoors, the French have reportedly access to the convos: https://archive.is/1LGkG https://archive.is/1LGkG In french but you translate it. It can also be a case of convenient incompetence from the telegram team.
  - deleted 3y ago
    [deleted]
  - dgellow 3y ago
    For reasons, yes, but not the nefarious ones you seem to imply. They tried multiple times in the past and created lot of problems for other services as a side effect. Also, a large portion of the Russian population and military use telegram for communication.
  - drbig 3y ago
    To clarify: I did not intend to to imply nefarious reasons. I guess using the "tinfoil" implied it? I had the impression Telegram has also, even if not fully official, "state" users. Thanks for point out the "...and we have broken other stuff too" angle!
- K5EiS 3y ago
  Probably because the Russian army uses Telegram. Even their MoD has a channel posting updates and propaganda
  - tokai 3y ago
    It has been wild to see Russians soldiers request air/artillery support over Telegram.
    - tibbydudeza 3y ago
      Not very bright. Was wondering about those friendly fire incidents that keeps cropping up from Russian units - one unit got arty on them by the Ukrainians and then they requested counter-fire but their own side dropped it on them instead.
      - Kretinsky 3y ago
        Or a Ukrainian unit could get access to a Russian telegram account and then send malicious requests.
        tibbydudeza 3y ago
        At least they would use code words but with the NSA supplying intelligence and most new units deployed are full of mobiks , have little hope for them.
        LegitShady 3y ago
        9r they could get access to the requesting account and send artillery.
  - stefan_ 3y ago
    Probably because Telegram is a state-level honeypot. The chances a place like Russia would have its population (and lots of people in what they consider their "ex-colonies") communicate over a platform that they can't intercept and monitor are zero. Add a track record of technical incompetence and an absurd backstory of the founder that escapes from state control to .. Cyprus of all places.
- AlfeG 3y ago
  It's been blocked, and now officially unblocked
NoZebra120vClip 3y ago
How the great firewall of China detects and blocks fully encrypted traffic [pdf] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485
est 3y ago
sadly, wireguard/openvpn does not not provide any obfuscation mechanism at protocol level
- fruitreunion1 3y ago
  I think this is a good thing. Apply obfuscation on top of WireGuard, that way you can have the functionality and security of the WireGuard tunnel and swap between different obfuscation techniques as needed.
  - est 3y ago
    Is there a mechanism to apply obfuscation on top of wireguard on latest Ubuntu stable? AFAIK wireguard is built inside the kernel.
    - fruitreunion1 3y ago
      The idea is you connect to the wireguard UDP port from one of the obfuscation tunnels. laptop -> obfuscation tunnel (udp2raw/iodine/ssh/tor/wstunnel/etc.) -> wireguard UDP port. Though some protocols like ssh or tor only support TCP, so you have to run an additional tunnel in the machine to get to wireguard (udp-over-tcp).
      - est 3y ago
        tunnel on top of another tunnel works, but at the cost of speed and ops complexity.
nabogh 3y ago
I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocking at the protocol level" is a bit misleading since they can't actually see the packet contents. Wireguard for example is just UDP packets. They have to infer from other patterns that the traffic is Wireguard and drop packets that meet those criteria.
- inrussianow 3y ago
  Im in Russia now posting this over on a wireguard vpn, using a landline ISP. So far no problems, havent tried on mobile.
  - zikduruqe 3y ago
    Are you using port 51820 or a different port for your Wireguard endpoint? Just curious as I have read where others have used different ports to circumvent DPI.
    - inrussianow 3y ago
      Yes im using 51820, but good idea to change it. I actually have 2 setups. One is a home router within a wireguard server builtin, the second is my Tailscale mesh network using an exit node at home in USA.
      - zikduruqe 3y ago
        Ha. I run WireGuard and a Tailscale network also. I've read that some people have used port 853 to mimic encrypted DNS or other ports less than 1024 to circumvent some WireGuard limits. I've yet to run into that. Might want to check out https://yggdrasil-network.github.io https://yggdrasil-network.github.io for fun. I used to use it to connect to various networks.
gsa 3y ago
I have been researching VPN protocols that work in China and found that Xray [0] is the most recommended route to escape the GFW. An ideal VPN setup is one where packets appear as normal https traffic. Some VPN setups take it a step further and proxy the traffic through Cloudflare. Setting all this up is nowhere as easy as Wireguard. Coincidentally, I came across this project on Github earlier today which is an obfuscation proxy for Wireguard [1], but I haven't found any information about how well it works. [0] https://github.com/XTLS/Xray-core https://github.com/XTLS/Xray-core [1] https://github.com/database64128/swgp-go https://github.com/database64128/swgp-go
- 0xDEF 3y ago
  I have noticed many new security and privacy oriented projects use Go and even C/C++. Wasn't Rust supposed to be the language that should be used to write all security-critical software? What happened? Are crates like rustls/ring still intentionally sabotaging Rust's cryptographic ecosystem with their "we will always be pre-1.0.0 and never have a stable API" philosophy?
  - simfoo 3y ago
    What if "C/C++" is not actually a thing and modern software engineering practices is what actually makes software safe? Writing modern C++ with good test coverage, sanitizers deployed and wrapping critical/unsafe parts into safe interfaces gets you _very_ far.
    - pdimitar 3y ago
      "Just don't write bugs", eh? :P I don't necessarily disagree with you about C/C++ (or even Brainfuck) but some languages have the tendency to push you in the right direction and I've come to appreciate those more with time.
    - bluGill 3y ago
      Unfortunately far too many people writing C++ are not writing modern C++. Most writing C with classes. You can write memory unsafe code in rust, including memory management if you want - you just have to wrap it in unsafe which at least clues others in to watch this area carefully. In C++ you can put unsafe code anywhere. Sometimes unsafe is really needed, rust makes it hard enough to write unsafe code that you will only do that where you must and then jump back to safe code. In C++ you are likely to mix safe and unsafe code all over and that makes audits harder.
Elhana 3y ago
Both my wireguard and openvpn works fine on mobile atm. They test things sometimes, which is probably the case now too.
- sintezcs 3y ago
  My WireGuard was not working during 1.5 days. Today it also works fine.
Trias11 3y ago
In russian - setting up ShadowSocks protocol to bypass kremlin efforts to block VPN: https://t.me/whackdoor/5657 https://t.me/whackdoor/5657
glintik 3y ago
Old news, guys. This was just a test for couple days. No any blocks now.
- notpushkin 3y ago
  ...for now. :^)
- YuccaGloriosa 3y ago
  No problems here just the test. See what kind of response we get for known work arounds so we can bring out a more comprehensive blocking program in the future.
Multrex 3y ago
Can someone ELI5 how they identify VPN at the protocol level?
- vbezhenar 3y ago
  DPI. Popular VPN protocols are easily identified by first connection packet signature.
  - littlestymaar 3y ago
    Wasn't Wireguard explicitly designed to avoid that? (IIRC it took lots of inspiration from state of the art data exfiltration methods used by malware)
    - bogantech 3y ago
      IDK but Wireshark has no problem identifying it so there must be something that gives it away
      - Aissen 3y ago
        They even have a nice comment explaining the heuristic: https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63aa8638076ec81dc9482972e9/epan/dissectors/packet-wireguard.c#L1618-L1625 https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63... * Heuristics to detect the WireGuard protocol: * - The first byte must be one of the valid four messages. * - The total packet length depends on the message type, and is fixed for * three of them. The Data type has a minimum length however. * - The next three bytes are reserved and zero in the official protocol. * Cloudflare's implementation however uses this field for load balancing * purposes, so this condition is not checked here for most messages. * It is checked for data messages to avoid false positives.
    - Starmina 3y ago
      Not at all, WireGuard is secure, but very easily identifiable.
cutler 3y ago
Please refuse to use sites like this which blatantly flaunt data privacy regulations.
romanzubenko 3y ago
I set up WireGuard server for my family back in Russia in the first days of the war and since then provided VPN access to a few more families. It’s been a lot more stable than relying on popular VPN providers who get banned one after another. Any advice on alternatives to WireGuard, if Russian gov manages to ban it on protocol level with DPI?
- mnw21cam 3y ago
  Most of these nation-state-run blocking attempts tend to block known VPNs but allow ssh through. So, my suggestion would be ppp over ssh. See https://tldp.org/HOWTO/pdf/ppp-ssh.pdf https://tldp.org/HOWTO/pdf/ppp-ssh.pdf for more details. You'll need a Linux-ish server, and you'll need to fiddle with routing tables on both the server and the client to get the incoming VPN connections to be able to contact the wider internet. But it's probably the least likely to be blocked.
  - justsomehnguy 3y ago
    It's quite trivial to tell if this SSH connection is just a tty or serves as a passthrough for something else, just by usage patterns.
- deleted 3y ago
  [deleted]
- dijit 3y ago
  SOCKS5 SSH has been my go-to for years. ssh -D9050 <somehost>; point your browser to localhost:9050 and bobs-your-uncle.
  - dontdoxxme 3y ago
    That approach, while convenient is not safe. It does not guarantee non-TCP traffic will be proxied. (You can test with a “WebRTC leak tester”.)
    - anthk 3y ago
Avamander 3y ago
I hope that someone writes an HTTP/3 layer for SSH and Wireguard. In theory they could all run on the same port in separate streams and be more difficult to differentiate.
- Triangle9349 3y ago
  they blocked QUIC a long time ago
codedokode 3y ago
All decent VPN protocols should masquerade as HTTP/2 or HTTP/3. For this reason WireGuard is pretty useless as it can be easily detected (and it is not secure because requires running code at the kernel).
- fruitreunion1 3y ago
  I disagree. I think it's good that implementing a secure network tunnel and obfuscation are separate. WireGuard can handle the secure tunnel functionality while I can apply any sort of obfuscation protocol on top of it without worrying about its security or having to reconfigure the network, like udp2raw, iodine, shadowsocks, websockets, etc.
askonomm 3y ago
Ah, of course. Good ol' Russia furthering its reach of state propaganda and brain washing its people into truly believing that Russia doesn't invade, but instead saves other countries. Source: Am from Estonia, and a lot of Russians living here very much believe this.
- saikia81 3y ago
  Don't mention the Americans in the middle east.
  - TheCoelacanth 3y ago
    The US did nothing to suppress free speech with regards to those wars. It was very unpopular to criticize them in the post-9/11 fervor, but there was no legal suppression of those viewpoints.
dsign 3y ago
Bear with me on this one. Look at Cuba, and North Korea. Those two suffer famines, crippling blackouts, and the harrowing and pervading stench of failed civilization. Yet, the citizens of none those countries are trying to topple their government. How do they manage? Massive brainwashing, which is in turn made possible by controlling access to information. Cuba, the case I'm most familiar with, it's very interesting because (so far) it doesn't limit much the access to outside information using the Internet[^2], but only official newspapers, books, radio and TV programs are allowed. I have this view that the information that the citizens of a country consume is like the regulatory signals of an organism. For a healthy organism, those signals must be coherent, otherwise some terrible disease will consume the organism. Of course, as a creature of the enlightenment, I hate that notion. I want my information to be free. But in the big scheme of things, the way I feel about it just doesn't matter. It's enough that states that police the information their citizens consume live longer than states that not. How to get from now to then is an open problem in some cases, but everybody is trying. CP and terrorism, and the vague term of "national security," are the vanguard which is being used to rive down the door on privacy in the Western countries, though the battle is already lost in much of the rest of the world. [^2]: Except on those occasions when the citizens actually dare to riot, e.g. https://en.wikipedia.org/wiki/2021_Cuban_protests#cite_ref-134 https://en.wikipedia.org/wiki/2021_Cuban_protests#cite_ref-1...
- bnt 3y ago
  I’ll just leave this here and see myself out https://www.youtube.com/watch?v=ksb3KD6DfSI https://www.youtube.com/watch?v=ksb3KD6DfSI
- throwoutway 3y ago
  The asymmetry in DPRK prevents overthrow by the citizenry. It would need to happen by a coup / military overthrow. Read a book by an escapee and you'll see that DPRK will execute people in the streets which keeps the populace under control.
alam2000 3y ago
[dead]

166 points by 0xDEF 3y ago

Most VPN services are already blocked in Russia by both mobile and landline providers. Many also block Tor. However now it seems like Russian mobile providers are blocking not just VPN services but even the underlying VPN protocols (WireGuard, OpenVPN). Interestingly Telegram is still not blocked in Russia.

drbig 3y ago
> Interestingly Telegram is still not blocked in Russia. Could that be taken as a sign that it is not blocked _for a reason_, or is it already too much tinfoil on the head?
- dijit 3y ago
  It caused a lot of issues for Russians when they tried to block it, because they basically blocked entire sections of AWS and GCP. The real tinfoil hat is assuming that they allow it because it's compromised; the founder of Telegram has absolutely no love lost for the Russian state, they basically seized his company (VK; a hugely popular facebook-like which also has a music player and such) and all his assets that were in the country after trying to exert control over him (and his desire not to be controlled); that's why telegram was founded in the first place. Of course, I have no first-hand account except watching as my video game became unplayable for Russians while the Telegram blocking was happening and my GCP rep explaining it to me, and that I had an Estonian girlfriend for 7 years who was giving me the play-by-play on what was happening.
  - baybal2 3y ago
    While he maintained an office in Russia, for everyone to see, while denying that publicly.
    - dijit 3y ago
      Possibly the easiest thing to exist in error or for the state to fabricate and yet you didn’t even provide a citation. tsk Dude is literally living in exile, yet you claim allegiance by him being affiliated with Russia, when his only crime here was being born in there and thus having some ties. Seems crazy to me. Like, cold-war propaganda crazy. this idea that Telegram is somehow nebulously “the enemy” and signal is “the virtuous” is so patently and clearly a propaganda campaign and we fall right into it.
      - throwaway473825 3y ago
        The point of Signal having end-to-end encryption is to avoid trust. Telegram, on the other hand, relies on trust. Obviously that's going to attract more criticism.
        dijit 3y ago
        That argument doesn't work when you cant reliably distribute and run your own clients and given that they (Signal) have hidden updates for over a year to work on mobilecoin in the dark (proving their willingness and ability to do this) it leaves little left for that argument; theres also a bunch of other stuff but that is meaningless to get into. The point is that Signal mostly also boils down to: “trust us”. On the other hand, while you are totally right about Telegram being quite a bit “trust us”; but they have better UX and are not at all hostile to third party clients and alternative implementations of their “secure” messaging protocol. Which is also the subject of a lot of controversy of course, because (*puts on tinfoil hat*) it was originally handrolled and not US cryptographer approved. (always get downvoted when I point out that Signal is doing weird stuff which only serves really to solidify my stance)
  - littlestymaar 3y ago
    > the founder of Telegram has absolutely no love lost for the Russian state No need to have any love, strong-arming people is usually where mafias shine.
  - Kretinsky 3y ago
    It's likely a government honeypot with backdoors, the French have reportedly access to the convos: https://archive.is/1LGkG https://archive.is/1LGkG In french but you translate it. It can also be a case of convenient incompetence from the telegram team.
- deleted 3y ago
  [deleted]
- dgellow 3y ago
  For reasons, yes, but not the nefarious ones you seem to imply. They tried multiple times in the past and created lot of problems for other services as a side effect. Also, a large portion of the Russian population and military use telegram for communication.
- drbig 3y ago
  To clarify: I did not intend to to imply nefarious reasons. I guess using the "tinfoil" implied it? I had the impression Telegram has also, even if not fully official, "state" users. Thanks for point out the "...and we have broken other stuff too" angle!
K5EiS 3y ago
Probably because the Russian army uses Telegram. Even their MoD has a channel posting updates and propaganda
- tokai 3y ago
  It has been wild to see Russians soldiers request air/artillery support over Telegram.
  - tibbydudeza 3y ago
    Not very bright. Was wondering about those friendly fire incidents that keeps cropping up from Russian units - one unit got arty on them by the Ukrainians and then they requested counter-fire but their own side dropped it on them instead.
    - Kretinsky 3y ago
      Or a Ukrainian unit could get access to a Russian telegram account and then send malicious requests.
      - tibbydudeza 3y ago
        At least they would use code words but with the NSA supplying intelligence and most new units deployed are full of mobiks , have little hope for them.
      - LegitShady 3y ago
        9r they could get access to the requesting account and send artillery.
- stefan_ 3y ago
  Probably because Telegram is a state-level honeypot. The chances a place like Russia would have its population (and lots of people in what they consider their "ex-colonies") communicate over a platform that they can't intercept and monitor are zero. Add a track record of technical incompetence and an absurd backstory of the founder that escapes from state control to .. Cyprus of all places.
AlfeG 3y ago
It's been blocked, and now officially unblocked

NoZebra120vClip 3y ago

How the great firewall of China detects and blocks fully encrypted traffic [pdf] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485

est 3y ago

sadly, wireguard/openvpn does not not provide any obfuscation mechanism at protocol level

fruitreunion1 3y ago
I think this is a good thing. Apply obfuscation on top of WireGuard, that way you can have the functionality and security of the WireGuard tunnel and swap between different obfuscation techniques as needed.
- est 3y ago
  Is there a mechanism to apply obfuscation on top of wireguard on latest Ubuntu stable? AFAIK wireguard is built inside the kernel.
  - fruitreunion1 3y ago
    The idea is you connect to the wireguard UDP port from one of the obfuscation tunnels. laptop -> obfuscation tunnel (udp2raw/iodine/ssh/tor/wstunnel/etc.) -> wireguard UDP port. Though some protocols like ssh or tor only support TCP, so you have to run an additional tunnel in the machine to get to wireguard (udp-over-tcp).
    - est 3y ago
      tunnel on top of another tunnel works, but at the cost of speed and ops complexity.

nabogh 3y ago

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocking at the protocol level" is a bit misleading since they can't actually see the packet contents. Wireguard for example is just UDP packets. They have to infer from other patterns that the traffic is Wireguard and drop packets that meet those criteria.

inrussianow 3y ago
Im in Russia now posting this over on a wireguard vpn, using a landline ISP. So far no problems, havent tried on mobile.
- zikduruqe 3y ago
  Are you using port 51820 or a different port for your Wireguard endpoint? Just curious as I have read where others have used different ports to circumvent DPI.
  - inrussianow 3y ago
    Yes im using 51820, but good idea to change it. I actually have 2 setups. One is a home router within a wireguard server builtin, the second is my Tailscale mesh network using an exit node at home in USA.
    - zikduruqe 3y ago
      Ha. I run WireGuard and a Tailscale network also. I've read that some people have used port 853 to mimic encrypted DNS or other ports less than 1024 to circumvent some WireGuard limits. I've yet to run into that. Might want to check out https://yggdrasil-network.github.io https://yggdrasil-network.github.io for fun. I used to use it to connect to various networks.

gsa 3y ago

I have been researching VPN protocols that work in China and found that Xray [0] is the most recommended route to escape the GFW. An ideal VPN setup is one where packets appear as normal https traffic. Some VPN setups take it a step further and proxy the traffic through Cloudflare. Setting all this up is nowhere as easy as Wireguard. Coincidentally, I came across this project on Github earlier today which is an obfuscation proxy for Wireguard [1], but I haven't found any information about how well it works. [0] https://github.com/XTLS/Xray-core https://github.com/XTLS/Xray-core [1] https://github.com/database64128/swgp-go https://github.com/database64128/swgp-go

0xDEF 3y ago
I have noticed many new security and privacy oriented projects use Go and even C/C++. Wasn't Rust supposed to be the language that should be used to write all security-critical software? What happened? Are crates like rustls/ring still intentionally sabotaging Rust's cryptographic ecosystem with their "we will always be pre-1.0.0 and never have a stable API" philosophy?
- simfoo 3y ago
  What if "C/C++" is not actually a thing and modern software engineering practices is what actually makes software safe? Writing modern C++ with good test coverage, sanitizers deployed and wrapping critical/unsafe parts into safe interfaces gets you _very_ far.
  - pdimitar 3y ago
    "Just don't write bugs", eh? :P I don't necessarily disagree with you about C/C++ (or even Brainfuck) but some languages have the tendency to push you in the right direction and I've come to appreciate those more with time.
  - bluGill 3y ago
    Unfortunately far too many people writing C++ are not writing modern C++. Most writing C with classes. You can write memory unsafe code in rust, including memory management if you want - you just have to wrap it in unsafe which at least clues others in to watch this area carefully. In C++ you can put unsafe code anywhere. Sometimes unsafe is really needed, rust makes it hard enough to write unsafe code that you will only do that where you must and then jump back to safe code. In C++ you are likely to mix safe and unsafe code all over and that makes audits harder.

Elhana 3y ago

Both my wireguard and openvpn works fine on mobile atm. They test things sometimes, which is probably the case now too.

sintezcs 3y ago
My WireGuard was not working during 1.5 days. Today it also works fine.

Trias11 3y ago

In russian - setting up ShadowSocks protocol to bypass kremlin efforts to block VPN: https://t.me/whackdoor/5657 https://t.me/whackdoor/5657

glintik 3y ago

Old news, guys. This was just a test for couple days. No any blocks now.

notpushkin 3y ago
...for now. :^)
YuccaGloriosa 3y ago
No problems here just the test. See what kind of response we get for known work arounds so we can bring out a more comprehensive blocking program in the future.

Multrex 3y ago

Can someone ELI5 how they identify VPN at the protocol level?

vbezhenar 3y ago
DPI. Popular VPN protocols are easily identified by first connection packet signature.
- littlestymaar 3y ago
  Wasn't Wireguard explicitly designed to avoid that? (IIRC it took lots of inspiration from state of the art data exfiltration methods used by malware)
  - bogantech 3y ago
    IDK but Wireshark has no problem identifying it so there must be something that gives it away
    - Aissen 3y ago
      They even have a nice comment explaining the heuristic: https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63aa8638076ec81dc9482972e9/epan/dissectors/packet-wireguard.c#L1618-L1625 https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63... * Heuristics to detect the WireGuard protocol: * - The first byte must be one of the valid four messages. * - The total packet length depends on the message type, and is fixed for * three of them. The Data type has a minimum length however. * - The next three bytes are reserved and zero in the official protocol. * Cloudflare's implementation however uses this field for load balancing * purposes, so this condition is not checked here for most messages. * It is checked for data messages to avoid false positives.
  - Starmina 3y ago
    Not at all, WireGuard is secure, but very easily identifiable.

cutler 3y ago

Please refuse to use sites like this which blatantly flaunt data privacy regulations.

romanzubenko 3y ago

I set up WireGuard server for my family back in Russia in the first days of the war and since then provided VPN access to a few more families. It’s been a lot more stable than relying on popular VPN providers who get banned one after another. Any advice on alternatives to WireGuard, if Russian gov manages to ban it on protocol level with DPI?

mnw21cam 3y ago
Most of these nation-state-run blocking attempts tend to block known VPNs but allow ssh through. So, my suggestion would be ppp over ssh. See https://tldp.org/HOWTO/pdf/ppp-ssh.pdf https://tldp.org/HOWTO/pdf/ppp-ssh.pdf for more details. You'll need a Linux-ish server, and you'll need to fiddle with routing tables on both the server and the client to get the incoming VPN connections to be able to contact the wider internet. But it's probably the least likely to be blocked.
- justsomehnguy 3y ago
  It's quite trivial to tell if this SSH connection is just a tty or serves as a passthrough for something else, just by usage patterns.
deleted 3y ago
[deleted]
dijit 3y ago
SOCKS5 SSH has been my go-to for years. ssh -D9050 <somehost>; point your browser to localhost:9050 and bobs-your-uncle.
- dontdoxxme 3y ago
  That approach, while convenient is not safe. It does not guarantee non-TCP traffic will be proxied. (You can test with a “WebRTC leak tester”.)
  - anthk 3y ago

Avamander 3y ago

I hope that someone writes an HTTP/3 layer for SSH and Wireguard. In theory they could all run on the same port in separate streams and be more difficult to differentiate.

Triangle9349 3y ago
they blocked QUIC a long time ago

codedokode 3y ago

All decent VPN protocols should masquerade as HTTP/2 or HTTP/3. For this reason WireGuard is pretty useless as it can be easily detected (and it is not secure because requires running code at the kernel).

fruitreunion1 3y ago
I disagree. I think it's good that implementing a secure network tunnel and obfuscation are separate. WireGuard can handle the secure tunnel functionality while I can apply any sort of obfuscation protocol on top of it without worrying about its security or having to reconfigure the network, like udp2raw, iodine, shadowsocks, websockets, etc.

askonomm 3y ago

Ah, of course. Good ol' Russia furthering its reach of state propaganda and brain washing its people into truly believing that Russia doesn't invade, but instead saves other countries. Source: Am from Estonia, and a lot of Russians living here very much believe this.

saikia81 3y ago
Don't mention the Americans in the middle east.
- TheCoelacanth 3y ago
  The US did nothing to suppress free speech with regards to those wars. It was very unpopular to criticize them in the post-9/11 fervor, but there was no legal suppression of those viewpoints.

dsign 3y ago

Bear with me on this one. Look at Cuba, and North Korea. Those two suffer famines, crippling blackouts, and the harrowing and pervading stench of failed civilization. Yet, the citizens of none those countries are trying to topple their government. How do they manage? Massive brainwashing, which is in turn made possible by controlling access to information. Cuba, the case I'm most familiar with, it's very interesting because (so far) it doesn't limit much the access to outside information using the Internet[^2], but only official newspapers, books, radio and TV programs are allowed. I have this view that the information that the citizens of a country consume is like the regulatory signals of an organism. For a healthy organism, those signals must be coherent, otherwise some terrible disease will consume the organism. Of course, as a creature of the enlightenment, I hate that notion. I want my information to be free. But in the big scheme of things, the way I feel about it just doesn't matter. It's enough that states that police the information their citizens consume live longer than states that not. How to get from now to then is an open problem in some cases, but everybody is trying. CP and terrorism, and the vague term of "national security," are the vanguard which is being used to rive down the door on privacy in the Western countries, though the battle is already lost in much of the rest of the world. [^2]: Except on those occasions when the citizens actually dare to riot, e.g. https://en.wikipedia.org/wiki/2021_Cuban_protests#cite_ref-134 https://en.wikipedia.org/wiki/2021_Cuban_protests#cite_ref-1...

bnt 3y ago
I’ll just leave this here and see myself out https://www.youtube.com/watch?v=ksb3KD6DfSI https://www.youtube.com/watch?v=ksb3KD6DfSI
throwoutway 3y ago
The asymmetry in DPRK prevents overthrow by the citizenry. It would need to happen by a coup / military overthrow. Read a book by an escapee and you'll see that DPRK will execute people in the streets which keeps the populace under control.

alam2000 3y ago

[dead]