3 ms·

> WireGuard uses UDP and a small handshake footprint, making detection and blocking via DPI harder. Not quite true. Wireguard is already actively detected and

> WireGuard uses UDP and a small handshake footprint, making detection and blocking via DPI harder. Not quite true. Wireguard is already actively detected and suppressed if necessary. There's already a fork that employs basic changes to improve the protocol in this regard. AmneziaWG was shown to be more robust to detection for now. https://docs.amnezia.org/documentation/amnezia-wg/ https://docs.amnezia.org/documentation/amnezia-wg/ Too bad managing WG is such a pain and Tailscale/Netbird don't support this protocol yet. The following two issues need attention: https://github.com/tailscale/tailscale/issues/10696 https://github.com/tailscale/tailscale/issues/10696 https://github.com/netbirdio/netbird/issues/1096 https://github.com/netbirdio/netbird/issues/1096

dongcarl 1y ago
At Obscura we just tunnel WireGuard over QUIC's unreliable datagram mechanism to make it look like HTTP/3 (for DPI): https://github.com/Sovereign-Engineering/obscuravpn-client/blob/fae9cda990ff2b4296feed5e45cf99abddd63716/rustlib/src/quicwg.rs https://github.com/Sovereign-Engineering/obscuravpn-client/b... We just upstreamed our patch to quinn-rs that pads Datagrams to MTU: https://github.com/quinn-rs/quinn/pull/2274 https://github.com/quinn-rs/quinn/pull/2274
- antonkochubey 1y ago
  Some DPIs just flat out block HTTP/3 already.
  - zinekeller 1y ago
    > Some DPIs just flat out block HTTP/3 already. Actually, some DPIs just straight-up reject UDP (and since DNS and NTP are UDP-based*, just straight-up interception-and-redirect). * TCP DNS exists but practically not used for most "normal" tasks, and at this point the censor is trying to block anything anyways.
znano 1y ago
True. but based on my researches don't use DPI on the NIN, so you might be able to use WG or OpenVpn on a VPS inside Iran but not to a VPS on let's say digital ocean. They can also selectively increase the or decrease the strength of their DPI as well, for example a range of IP can be graylisted and nothing will work on it, or they put more active probing effort on some ranges of IPs.
ninjin 1y ago
> Too bad managing [Wireguard] is such a pain[.] It is? My clients on OpenBSD need about ten lines in /etc/hostname.wg[0-9]+ and that includes the routes!
- ZoomZoomZoom 1y ago
  If hub-and-spoke does it for you, it's manageable.

dongcarl 1y ago

At Obscura we just tunnel WireGuard over QUIC's unreliable datagram mechanism to make it look like HTTP/3 (for DPI): https://github.com/Sovereign-Engineering/obscuravpn-client/blob/fae9cda990ff2b4296feed5e45cf99abddd63716/rustlib/src/quicwg.rs https://github.com/Sovereign-Engineering/obscuravpn-client/b... We just upstreamed our patch to quinn-rs that pads Datagrams to MTU: https://github.com/quinn-rs/quinn/pull/2274 https://github.com/quinn-rs/quinn/pull/2274

antonkochubey 1y ago
Some DPIs just flat out block HTTP/3 already.
- zinekeller 1y ago
  > Some DPIs just flat out block HTTP/3 already. Actually, some DPIs just straight-up reject UDP (and since DNS and NTP are UDP-based*, just straight-up interception-and-redirect). * TCP DNS exists but practically not used for most "normal" tasks, and at this point the censor is trying to block anything anyways.

znano 1y ago

True. but based on my researches don't use DPI on the NIN, so you might be able to use WG or OpenVpn on a VPS inside Iran but not to a VPS on let's say digital ocean. They can also selectively increase the or decrease the strength of their DPI as well, for example a range of IP can be graylisted and nothing will work on it, or they put more active probing effort on some ranges of IPs.

ninjin 1y ago

> Too bad managing [Wireguard] is such a pain[.] It is? My clients on OpenBSD need about ten lines in /etc/hostname.wg[0-9]+ and that includes the routes!

ZoomZoomZoom 1y ago
If hub-and-spoke does it for you, it's manageable.