5 ms·

I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governm

by doix 1y ago

I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governments just block well known VPN providers and a small individual server is fine. It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use.

bryanlarsen 1y ago
We've had success using wireguard over wstunnel in places where wireguard is blocked. https://github.com/erebe/wstunnel https://github.com/erebe/wstunnel
- vehemenz 1y ago
  This looks great, thanks.
  - bryanlarsen 1y ago
    I should have mentioned that our use case isn't avoiding government firewalls, it's transiting through broken network environments.
daveidol 1y ago
Wow, kinda crazy to think about a government blocking a protocol that just simply lets two computers talk securely over a tunnel.
- roscas 1y ago
  That is how you know they haven't got a clue on what they're doing.
  - tsimionescu 1y ago
    On the contrary, it shows that they know very well what they're doing. Their goal is censorship. If that disrupts connectivity for some niche but valid use cases, so be it. The vast majority of people have never used a WireGuard tunnel, so they are unimpacted. Some corporate use cases that even that government would approve of are disrupted, but they can either lie with that or have a whitelist. Most non-corporate use of this and other similar protocols is not something the government would allow. So, given their nefarious goal, they are doing a great job by blocking WireGuard (and similar protocols, presumably).
- mikestorrent 1y ago
  Well, think about it - almost every other interaction you can have with an individual in another country is mediated by government. Physical interaction? You need to get through a border and customs. Phone call? Going through their exchanges, could be blocked, easy to spy on with wiretaps. Letter mail? Many cases historically of all letters being opened before being forwarded along. We lived through the golden age of the Internet where anyone was allowed to open a raw socket connection to anyone else, anywhere. That age is fading, now, and time may come where even sending an email to someone in Russia or China will be fraught with difficulty. Certainly encryption will be blocked. We're going to need steganographic tech that uses AI-hallucinated content as a carrier, or something.
aabdelhafez 1y ago
Same in Egypt.
VTimofeenko 1y ago
WireGuard by itself has a pretty noticeable network pattern and I don't think they make obfuscating it a goal. There are some solutions that mimic the traffic and, say, route it through 443/TCP.
Flere-Imsaho 1y ago
> surprised that wireguard as a protocol is just blocked. Honestly this is the route I'm sure the UK will decide upon in the not too distant future. The job of us hackers is going to become even more important...
sintezcs 1y ago
Same in Russia
slt2021 1y ago
how can they detect it is wireguard, I thought the traffic is encrypted? how does it differ from regular TLS 1.3 traffic?
- dmantis 1y ago
  It's UDP, not TCP (like TLS) and has a distinguishable handshake. Wireguard is not designed as a censorship prevention tool, it's purely a networking solution. The tunnel itself is encrypted, but the tunnel creation and existence is not obfuscated.
dmantis 1y ago
XRay protocol based VPN worked for me in Uzbekistan when I were travelling there. Wireguard is indeed blocked.
- akho 1y ago
  xray is a proxy. They may have needed an actual VPN.
wereHamster 1y ago
A year ago I was traveling through Uzbekistan while also partly working remotely. IKEv2 VPN was blocked but thankfully I was able to switch to SSL VPN which worked fine. I didn't expect that, everything else (people, culture) in the country seemed quite open.
atmosx 1y ago
Cloak + wireguard should work fine on the server side. The problem is that I didn't find any clients for Android and I doubt there are clients for iOs that can (a) open a cloak tunnel and then (b) allow wireguard to connect to localhost...
- akho 1y ago
  AmneziaWG is obfuscated, wireguard-based, and has clients for whatever.
  - atmosx 1y ago
    I'll give it a shot, thanks!
deleted 1y ago
[deleted]
varenc 1y ago
Is it the protocol that's blocked as a result of DPI, or just the default 51820 UDP port that's blocked? If the latter, just changing your Wireguard server's port might work.
- doix 1y ago
  It's DPI, I run on a non standard port.
  - varenc 1y ago
    Damnnn, wonder what hardware you need to run DPI on a nation's internet.
    - doix 1y ago
      I think the hardware doesn't keep up. Uzbekistan has the worst internet compared to Kazakhstan and Kyrgyzstan whilst the infrastructure in general is much better (in my fairly uneducated opinion). I expected to have the best internet until I got around to trying to use it.

by doix 1y ago

bryanlarsen 1y ago

We've had success using wireguard over wstunnel in places where wireguard is blocked. https://github.com/erebe/wstunnel https://github.com/erebe/wstunnel

vehemenz 1y ago
This looks great, thanks.
- bryanlarsen 1y ago
  I should have mentioned that our use case isn't avoiding government firewalls, it's transiting through broken network environments.

daveidol 1y ago

Wow, kinda crazy to think about a government blocking a protocol that just simply lets two computers talk securely over a tunnel.

roscas 1y ago
That is how you know they haven't got a clue on what they're doing.
- tsimionescu 1y ago
  On the contrary, it shows that they know very well what they're doing. Their goal is censorship. If that disrupts connectivity for some niche but valid use cases, so be it. The vast majority of people have never used a WireGuard tunnel, so they are unimpacted. Some corporate use cases that even that government would approve of are disrupted, but they can either lie with that or have a whitelist. Most non-corporate use of this and other similar protocols is not something the government would allow. So, given their nefarious goal, they are doing a great job by blocking WireGuard (and similar protocols, presumably).
mikestorrent 1y ago
Well, think about it - almost every other interaction you can have with an individual in another country is mediated by government. Physical interaction? You need to get through a border and customs. Phone call? Going through their exchanges, could be blocked, easy to spy on with wiretaps. Letter mail? Many cases historically of all letters being opened before being forwarded along. We lived through the golden age of the Internet where anyone was allowed to open a raw socket connection to anyone else, anywhere. That age is fading, now, and time may come where even sending an email to someone in Russia or China will be fraught with difficulty. Certainly encryption will be blocked. We're going to need steganographic tech that uses AI-hallucinated content as a carrier, or something.

aabdelhafez 1y ago

Same in Egypt.

VTimofeenko 1y ago

WireGuard by itself has a pretty noticeable network pattern and I don't think they make obfuscating it a goal. There are some solutions that mimic the traffic and, say, route it through 443/TCP.

Flere-Imsaho 1y ago

> surprised that wireguard as a protocol is just blocked. Honestly this is the route I'm sure the UK will decide upon in the not too distant future. The job of us hackers is going to become even more important...

sintezcs 1y ago

Same in Russia

slt2021 1y ago

how can they detect it is wireguard, I thought the traffic is encrypted? how does it differ from regular TLS 1.3 traffic?

dmantis 1y ago
It's UDP, not TCP (like TLS) and has a distinguishable handshake. Wireguard is not designed as a censorship prevention tool, it's purely a networking solution. The tunnel itself is encrypted, but the tunnel creation and existence is not obfuscated.

dmantis 1y ago

XRay protocol based VPN worked for me in Uzbekistan when I were travelling there. Wireguard is indeed blocked.

akho 1y ago
xray is a proxy. They may have needed an actual VPN.

wereHamster 1y ago

A year ago I was traveling through Uzbekistan while also partly working remotely. IKEv2 VPN was blocked but thankfully I was able to switch to SSL VPN which worked fine. I didn't expect that, everything else (people, culture) in the country seemed quite open.

atmosx 1y ago

Cloak + wireguard should work fine on the server side. The problem is that I didn't find any clients for Android and I doubt there are clients for iOs that can (a) open a cloak tunnel and then (b) allow wireguard to connect to localhost...

akho 1y ago
AmneziaWG is obfuscated, wireguard-based, and has clients for whatever.
- atmosx 1y ago
  I'll give it a shot, thanks!

deleted 1y ago

[deleted]

varenc 1y ago

Is it the protocol that's blocked as a result of DPI, or just the default 51820 UDP port that's blocked? If the latter, just changing your Wireguard server's port might work.

doix 1y ago
It's DPI, I run on a non standard port.
- varenc 1y ago
  Damnnn, wonder what hardware you need to run DPI on a nation's internet.
  - doix 1y ago
    I think the hardware doesn't keep up. Uzbekistan has the worst internet compared to Kazakhstan and Kyrgyzstan whilst the infrastructure in general is much better (in my fairly uneducated opinion). I expected to have the best internet until I got around to trying to use it.