7 ms·

I have the fortune to reside in Russia-controlled Donbas. Over here they have been blocking all WireGuard connections for a long time. OpenVPN seems to be block

I have the fortune to reside in Russia-controlled Donbas. Over here they have been blocking all WireGuard connections for a long time. OpenVPN seems to be blocked selectively depending on the host. The government and commerce must need it more than WireGuard. It isn't consistent. Different ISPs block different hosts and protocols at different times. I assume we are a kind of test and staging environment for censorship in Russia. In the interest of anonymity I am not going to respond to your questions.

jvanderbot 3y ago
How, technically, can they block wire guard? It can operate as pure UDP on any port. Are we referring to wireguard vendors like tailscale here?
- hotpotamus 3y ago
  This is what I was wondering. I don’t understand these VPNs too deeply (though I do occasionally administer an OpenVPN setup), but I was under the impression that they’re sending encrypted packets over UDP on arbitrary ports. That seems quite tough to analyze and block.
  - 15457345234 3y ago
    > That seems quite tough to analyze and block. Why analyze when you can whitelist?
    - jvanderbot 3y ago
      Ok fair. The approach might be block everything except https/tcp. In which case what we need is https side channel VPNs.
- eptcyka 3y ago
  Wireguard headers are fingerprintable.
- blibble 3y ago
  I would have thought psk mode would have encrypted the entirety of the initial handshake maybe not
- computerfriend 3y ago
  This is the first (that I know of) public conversation about this and goes into detail about the various problems with obfuscating WireGuard. https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184...
  - jvanderbot 3y ago
    The reply https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185... ... is pretty informative. There is a PSK mode, which really should be essentially indistinguishable from random UDP packets. But I haven't read deeply enough. I do PSK on all my networks, but that has its own disadvantages. I honestly thought that was the only way to do wireguard.
- mrshadowgoose 3y ago
  The protocol has a defined structure (check out 5.4.6 in [1]), and can therefore be detected and blocked. It's probably easier to block than a TLS VPN, which has a lot of typical TLS noise to hide in. [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
  - GrabbinD33ze69 3y ago
    What about something like udp over tcp?
- ytch 3y ago
  China uses statistics, entropy of packets and other DPI-like methods[1], also HN discussions of it[2]: [1] https://gfw.report/publications/usenixsecurity23/en/ https://gfw.report/publications/usenixsecurity23/en/ [2] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485
eptcyka 3y ago
OpenVPN looks more similar to regular https traffic, hence its a bit more difficult to fingerprint.
- gruez 3y ago
  Even though openvpn uses TLS, AFAIK it's used on top of some wrapper which makes it trivial to detect and block. At least in my experience it's the one of the first protocols to get blocked.
- jokowueu 3y ago
  Openvpn is trivial to see , what you need to do is wrap it in stunnel
  - EasyMark 3y ago
    Yeah I suspect they know they can never block everything but if they can block 98% of "casual users" they've probably reached their goal. They will just put out propaganda that the other 2% technically apt people who get around it are conspiracy nuts, western civ sympathizers, traitors to mother russia, etc.
cf1241290841 3y ago
Thank you so much for posting this. If anyone else has any educated guesses about the mechanism, please do share!
- mmastrac 3y ago
  My guess is that it's cat and mouse with various providers and upgrades and research are inconsistent.
dang 3y ago
[stub for offtopicness]
- ir77 3y ago
  serious question -- your first sentence: is it sarcasm or do you really consider yourself to be fortunate?
  - jncfhnb 3y ago
    That is obviously sarcasm
  - meepmorp 3y ago
    Fortune is like fate or luck here. There's good or bad, but it's still ones lot in life.
- wiseowise 3y ago
  > I have the fortune to reside in Russia-controlled Donbas. My condolences. Hope Ukraine and allies can can sustain enough pressure to free those lands.
- libertine 3y ago
  Stay strong, hopefully, Russia will collapse and you'll be free - I may be naive but I still think there are enough Russians who can see this tragedy as the doing of a man who wants to continue to live the life of a king, and it's probably his only way of survival after so many murdering and prosecution.
  - srackey 3y ago
    [flagged]
    - kevin_thibedeau 3y ago
      They're all spoonfed a propaganda stream that makes the czar look like a nice guy trying his best to protect the motherland.
Lendal 3y ago
You might see some confused faces. To most English speakers "fortune" mostly means good, unless it is preceded by something that specifies that it is bad fortune, like "ill fortune" or misfortune.
- edot 3y ago
  Their English is actually good enough to properly use sarcasm. “I had the fortune of getting food poisoning last week” would be understood as a joking way of taking about misfortune.
  - deleted 3y ago
    [deleted]
  - Lendal 3y ago
    It is. But just because you speak English doesn't mean you use sarcasm constantly. Sarcasm is a lazy way of communicating in almost any language. It reveals lazy thinking and poor vocabulary. I never assume someone is using sarcasm when they could actually be speaking intelligently, albeit with a common grammatical error.
- askonomm 3y ago
  It's called sarcasm.
  - Lendal 3y ago
    The circumstances suggest that it's probably just a simple error and not sarcasm. Not everyone in the world really loves sarcasm so much. People who use it frequently are usually trying to mask a poor imagination and small vocabulary. So I prefer to believe it's just a simple mistake. No big deal.
    - deleted 3y ago
      [deleted]
    - koonsolo 3y ago
cracrecry 3y ago
They called the Chinese to help with their experience like 6 months after the start of the war as they realised some young people could access news outside the official channels. They have been testing it since then. In China once their AI systems or whatever decides that you are using a VPN you will be punished by increasingly blocking your Internet for more and more time.
- physicles 3y ago
  > In China once their AI systems or whatever decides that you are using a VPN you will be punished by increasingly blocking your Internet for more and more time. This isn’t true. VPN use is widespread here, but I’ve never heard of anyone’s internet getting wholesale blocked because of it. Selling VPN services, however, is a big no-no.
deleted 3y ago
[deleted]

jvanderbot 3y ago

How, technically, can they block wire guard? It can operate as pure UDP on any port. Are we referring to wireguard vendors like tailscale here?

hotpotamus 3y ago
This is what I was wondering. I don’t understand these VPNs too deeply (though I do occasionally administer an OpenVPN setup), but I was under the impression that they’re sending encrypted packets over UDP on arbitrary ports. That seems quite tough to analyze and block.
- 15457345234 3y ago
  > That seems quite tough to analyze and block. Why analyze when you can whitelist?
  - jvanderbot 3y ago
    Ok fair. The approach might be block everything except https/tcp. In which case what we need is https side channel VPNs.
eptcyka 3y ago
Wireguard headers are fingerprintable.
blibble 3y ago
I would have thought psk mode would have encrypted the entirety of the initial handshake maybe not
computerfriend 3y ago
This is the first (that I know of) public conversation about this and goes into detail about the various problems with obfuscating WireGuard. https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184...
- jvanderbot 3y ago
  The reply https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185... ... is pretty informative. There is a PSK mode, which really should be essentially indistinguishable from random UDP packets. But I haven't read deeply enough. I do PSK on all my networks, but that has its own disadvantages. I honestly thought that was the only way to do wireguard.
mrshadowgoose 3y ago
The protocol has a defined structure (check out 5.4.6 in [1]), and can therefore be detected and blocked. It's probably easier to block than a TLS VPN, which has a lot of typical TLS noise to hide in. [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
- GrabbinD33ze69 3y ago
  What about something like udp over tcp?
ytch 3y ago
China uses statistics, entropy of packets and other DPI-like methods[1], also HN discussions of it[2]: [1] https://gfw.report/publications/usenixsecurity23/en/ https://gfw.report/publications/usenixsecurity23/en/ [2] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485

eptcyka 3y ago

OpenVPN looks more similar to regular https traffic, hence its a bit more difficult to fingerprint.

gruez 3y ago
Even though openvpn uses TLS, AFAIK it's used on top of some wrapper which makes it trivial to detect and block. At least in my experience it's the one of the first protocols to get blocked.
jokowueu 3y ago
Openvpn is trivial to see , what you need to do is wrap it in stunnel
- EasyMark 3y ago
  Yeah I suspect they know they can never block everything but if they can block 98% of "casual users" they've probably reached their goal. They will just put out propaganda that the other 2% technically apt people who get around it are conspiracy nuts, western civ sympathizers, traitors to mother russia, etc.

cf1241290841 3y ago

Thank you so much for posting this. If anyone else has any educated guesses about the mechanism, please do share!

mmastrac 3y ago
My guess is that it's cat and mouse with various providers and upgrades and research are inconsistent.

dang 3y ago

[stub for offtopicness]

ir77 3y ago
serious question -- your first sentence: is it sarcasm or do you really consider yourself to be fortunate?
- jncfhnb 3y ago
  That is obviously sarcasm
- meepmorp 3y ago
  Fortune is like fate or luck here. There's good or bad, but it's still ones lot in life.
wiseowise 3y ago
> I have the fortune to reside in Russia-controlled Donbas. My condolences. Hope Ukraine and allies can can sustain enough pressure to free those lands.
libertine 3y ago
Stay strong, hopefully, Russia will collapse and you'll be free - I may be naive but I still think there are enough Russians who can see this tragedy as the doing of a man who wants to continue to live the life of a king, and it's probably his only way of survival after so many murdering and prosecution.
- srackey 3y ago
  [flagged]
  - kevin_thibedeau 3y ago
    They're all spoonfed a propaganda stream that makes the czar look like a nice guy trying his best to protect the motherland.

Lendal 3y ago

You might see some confused faces. To most English speakers "fortune" mostly means good, unless it is preceded by something that specifies that it is bad fortune, like "ill fortune" or misfortune.

edot 3y ago
Their English is actually good enough to properly use sarcasm. “I had the fortune of getting food poisoning last week” would be understood as a joking way of taking about misfortune.
- deleted 3y ago
  [deleted]
- Lendal 3y ago
  It is. But just because you speak English doesn't mean you use sarcasm constantly. Sarcasm is a lazy way of communicating in almost any language. It reveals lazy thinking and poor vocabulary. I never assume someone is using sarcasm when they could actually be speaking intelligently, albeit with a common grammatical error.
askonomm 3y ago
It's called sarcasm.
- Lendal 3y ago
  The circumstances suggest that it's probably just a simple error and not sarcasm. Not everyone in the world really loves sarcasm so much. People who use it frequently are usually trying to mask a poor imagination and small vocabulary. So I prefer to believe it's just a simple mistake. No big deal.
  - deleted 3y ago
    [deleted]
  - koonsolo 3y ago

cracrecry 3y ago

They called the Chinese to help with their experience like 6 months after the start of the war as they realised some young people could access news outside the official channels. They have been testing it since then. In China once their AI systems or whatever decides that you are using a VPN you will be punished by increasingly blocking your Internet for more and more time.

physicles 3y ago
> In China once their AI systems or whatever decides that you are using a VPN you will be punished by increasingly blocking your Internet for more and more time. This isn’t true. VPN use is widespread here, but I’ve never heard of anyone’s internet getting wholesale blocked because of it. Selling VPN services, however, is a big no-no.

deleted 3y ago

[deleted]