4 ms·

Tell HN: Tailscale is giving 451s within Russia

9 points by Humorist2290 2y ago

A friend who lives in Russia was using Tailscale to connect to an exit node placed elsewhere to communicate with family via Signal etc. Now when they connect to the control server the requests give a 451 'unavailable for legal reasons' error. Probably a self-hosted control server like Headscale might circumvent this censorship for some time, but the friend is not technical enough (and understandably afraid) to manage this.

bez00m 2y ago
Can confirm. Many paid VPNs are not reliable enough as Roskomnadzor is successfully targeting them. I though that by deploying Tailscale exit node on my own server I could overcome this. Alas, not anymore.
- u_sama 2y ago
  For a functional VPN with all the telecom companies you should set up a v2ray/Xray node on a close VPS in a country near your area. It is functional as I had to set up some for some people, if you need help I can guide you through it as there are not many good English guides.
  - bez00m 2y ago
    Thanks for an advice, I'll have a look. Was planning to setup a Wireguard server, but things are moving in this area.
- deleted 2y ago
  [deleted]
- borschkharcho 2y ago
  I successfully got Headscale working on a digital ocean droplet and all is back to normal for me. It’s not too difficult lmk if you need tips.
  - denis0 2y ago
    Me too, but I cannot find a field for Alternate Coordination Server on client Tailscale for IOS 1.74.0
    - borschkharcho 2y ago
      I have 1.74.2 and it’s in the actual Tailscale app settings (not iOS settings) under Login -> top right toolbar button
atlasduo 2y ago
This has been going on for a while. A year or so ago I remember Tailscale was blocking downloads of their applications from Russian IPs. HTTP 451 means "unavailable for legal reasons" so I imagine this is Tailscale trying to cover its soft spots.
- chupasaurus 2y ago
  They deployed the 451 during the last 2 days of August 2023 [1][2]. [1] https://github.com/tailscale/tailscale/issues/9158 https://github.com/tailscale/tailscale/issues/9158 [2] https://www.reddit.com/r/Tailscale/comments/1672n6k/ https://www.reddit.com/r/Tailscale/comments/1672n6k/
  - dipierro 2y ago
    DERP and login/control servers reply with 451 since yesterday. Previously, only pkgs were affected.
deleted 2y ago
[deleted]
randomopining 2y ago
Wait so can't you just use an encrypted connection to a physical host somewhere outside of russia and then basically haave access to everything?
- chupasaurus 2y ago
  DPI there detects and blocks a good number of VPN protocols.
- Humorist2290 2y ago
  Sometimes this is possible, but generally VPNs are illegal (at least that's what I was told) in Russia. The government has become increasingly active in identifying and locking users out of them, and of course users risk being dragged into the Russian criminal system. Doing some sort of SSH tunnel to a VPS hosted elsewhere might work, might not. Plain old wireguard might work, might not. Consumer tools for technically novice users seem to be the government's priority.

9 points by Humorist2290 2y ago

bez00m 2y ago

Can confirm. Many paid VPNs are not reliable enough as Roskomnadzor is successfully targeting them. I though that by deploying Tailscale exit node on my own server I could overcome this. Alas, not anymore.

u_sama 2y ago
For a functional VPN with all the telecom companies you should set up a v2ray/Xray node on a close VPS in a country near your area. It is functional as I had to set up some for some people, if you need help I can guide you through it as there are not many good English guides.
- bez00m 2y ago
  Thanks for an advice, I'll have a look. Was planning to setup a Wireguard server, but things are moving in this area.
deleted 2y ago
[deleted]
borschkharcho 2y ago
I successfully got Headscale working on a digital ocean droplet and all is back to normal for me. It’s not too difficult lmk if you need tips.
- denis0 2y ago
  Me too, but I cannot find a field for Alternate Coordination Server on client Tailscale for IOS 1.74.0
  - borschkharcho 2y ago
    I have 1.74.2 and it’s in the actual Tailscale app settings (not iOS settings) under Login -> top right toolbar button

atlasduo 2y ago

This has been going on for a while. A year or so ago I remember Tailscale was blocking downloads of their applications from Russian IPs. HTTP 451 means "unavailable for legal reasons" so I imagine this is Tailscale trying to cover its soft spots.

chupasaurus 2y ago
They deployed the 451 during the last 2 days of August 2023 [1][2]. [1] https://github.com/tailscale/tailscale/issues/9158 https://github.com/tailscale/tailscale/issues/9158 [2] https://www.reddit.com/r/Tailscale/comments/1672n6k/ https://www.reddit.com/r/Tailscale/comments/1672n6k/
- dipierro 2y ago
  DERP and login/control servers reply with 451 since yesterday. Previously, only pkgs were affected.

deleted 2y ago

[deleted]

randomopining 2y ago

Wait so can't you just use an encrypted connection to a physical host somewhere outside of russia and then basically haave access to everything?

chupasaurus 2y ago
DPI there detects and blocks a good number of VPN protocols.
Humorist2290 2y ago
Sometimes this is possible, but generally VPNs are illegal (at least that's what I was told) in Russia. The government has become increasingly active in identifying and locking users out of them, and of course users risk being dragged into the Russian criminal system. Doing some sort of SSH tunnel to a VPS hosted elsewhere might work, might not. Plain old wireguard might work, might not. Consumer tools for technically novice users seem to be the government's priority.