3 ms·
TCP over TCP for VPN is pretty useful in places where deep packet inspection blocks UDP by default, eg. GFW in China.
by beefsack 12y ago
TCP over TCP for VPN is pretty useful in places where deep packet inspection blocks UDP by default, eg. GFW in China.
- droopyEyelids 12y agoDo you have any idea why the GFW blocks UDP by default? I can imagine that for corporate networks, but as far as I know, uninspectable UDP streams only recently came into existence with Google's QUIC (which assumes pre-negotiated encryption keys are still valid) Why block all streams if you can inspect them (or at least their handshake)?
- duskwuff 12y agoProbably because they determined that most of it was VPN or other encrypted traffic, and that blocking it was easier than trying to inspect it.
- beefsack 12y agoWhile practically no official information exists publicly, this appears to be the reason. My gut tells me that the lack of structure in UDP makes it a little harder to inspect too.
- rahimnathwani 12y agoDo you have any information you can share about this? A few years ago, I could reliably use OpenVPN over UDP, as long as I switched ports out frequently. Some time ago (I don't remember when), this ceased to be the case, and I switched to PPTP and, more recently, Shadowsocks. What has been your experience with UDP over GFW?
- beefsack 12y agoUDP used to work (~3 years ago) but currently it's blocked wholesale. OpenVPN over TCP gets throttled and blocked thanks to DPI too, an obfuscation layer is required because OpenVPN traffic is identifiable due to a fairly unique encryption fingerprint. http://blog.strongvpn.asia/china-blocking-udp-ports/ http://blog.strongvpn.asia/china-blocking-udp-ports/
- rahimnathwani 12y agoThanks. This is totally consistent with my experience, and it's good to know that it's not just me :)