3 ms·

How, technically, can they block wire guard? It can operate as pure UDP on any port. Are we referring to wireguard vendors like tailscale here?

hotpotamus 3y ago
This is what I was wondering. I don’t understand these VPNs too deeply (though I do occasionally administer an OpenVPN setup), but I was under the impression that they’re sending encrypted packets over UDP on arbitrary ports. That seems quite tough to analyze and block.
- 15457345234 3y ago
  > That seems quite tough to analyze and block. Why analyze when you can whitelist?
  - jvanderbot 3y ago
    Ok fair. The approach might be block everything except https/tcp. In which case what we need is https side channel VPNs.
eptcyka 3y ago
Wireguard headers are fingerprintable.
blibble 3y ago
I would have thought psk mode would have encrypted the entirety of the initial handshake maybe not
computerfriend 3y ago
This is the first (that I know of) public conversation about this and goes into detail about the various problems with obfuscating WireGuard. https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184...
- jvanderbot 3y ago
  The reply https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185... ... is pretty informative. There is a PSK mode, which really should be essentially indistinguishable from random UDP packets. But I haven't read deeply enough. I do PSK on all my networks, but that has its own disadvantages. I honestly thought that was the only way to do wireguard.
mrshadowgoose 3y ago
The protocol has a defined structure (check out 5.4.6 in [1]), and can therefore be detected and blocked. It's probably easier to block than a TLS VPN, which has a lot of typical TLS noise to hide in. [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
- GrabbinD33ze69 3y ago
  What about something like udp over tcp?
ytch 3y ago
China uses statistics, entropy of packets and other DPI-like methods[1], also HN discussions of it[2]: [1] https://gfw.report/publications/usenixsecurity23/en/ https://gfw.report/publications/usenixsecurity23/en/ [2] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485

hotpotamus 3y ago

This is what I was wondering. I don’t understand these VPNs too deeply (though I do occasionally administer an OpenVPN setup), but I was under the impression that they’re sending encrypted packets over UDP on arbitrary ports. That seems quite tough to analyze and block.

15457345234 3y ago
> That seems quite tough to analyze and block. Why analyze when you can whitelist?
- jvanderbot 3y ago
  Ok fair. The approach might be block everything except https/tcp. In which case what we need is https side channel VPNs.

eptcyka 3y ago

Wireguard headers are fingerprintable.

blibble 3y ago

I would have thought psk mode would have encrypted the entirety of the initial handshake maybe not

computerfriend 3y ago

This is the first (that I know of) public conversation about this and goes into detail about the various problems with obfuscating WireGuard. https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184...

jvanderbot 3y ago
The reply https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185... ... is pretty informative. There is a PSK mode, which really should be essentially indistinguishable from random UDP packets. But I haven't read deeply enough. I do PSK on all my networks, but that has its own disadvantages. I honestly thought that was the only way to do wireguard.

mrshadowgoose 3y ago

The protocol has a defined structure (check out 5.4.6 in [1]), and can therefore be detected and blocked. It's probably easier to block than a TLS VPN, which has a lot of typical TLS noise to hide in. [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf

GrabbinD33ze69 3y ago
What about something like udp over tcp?

ytch 3y ago

China uses statistics, entropy of packets and other DPI-like methods[1], also HN discussions of it[2]: [1] https://gfw.report/publications/usenixsecurity23/en/ https://gfw.report/publications/usenixsecurity23/en/ [2] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485