[HN Gopher] Tell HN: VPN Situation in Iran
       ___________________________________________________________________
        
       Tell HN: VPN Situation in Iran
        
       I am an Iranian and have a family member in Iran. As you now the
       internet is currently shut off from outside or very slow.  Over the
       past years, I would create a OpenVPN server with a port other than
       default OpenVPN port (1194) and share the connection with my family
       member in Iran. Using a random port was needed because default
       OpenVPN is blocked in Iran for sometime (probably since 2010). But
       recently [after the recent internet shutdown] I notice a change. My
       family member cannot even connect to a server IP address or
       (private) domain using any port so VPN doesn't work anymore.
       Instead they are only able to connect to the outside world using
       locally paid VPNs but applications that have end-to-end encryption
       doesn't work anymore with these VPNs (Telegram, WhatsApp and etc).
       So my theory is they cut off the connection to outside and people
       are only able to connect with outside world using certain VPNs that
       are probably made by the government. Not really sure.
        
       Author : amir734jj
       Score  : 21 points
       Date   : 2022-10-11 19:20 UTC (3 hours ago)
        
       | sweetbitter wrote:
       | You could set up a Tor bridge with an obfs4 pluggable transport.
       | That works even in China, because it resists DPI and probing.
       | Does your VPN protocol resist probing? If not, that may be how
       | they are blocking it. Also if the government goes hard enough on
       | manually requesting Tor bridges, you will have to distribute
       | bridges yourself (which you seem to already be doing with VPN
       | server addresses).
        
       | LinuxBender wrote:
       | OpenVPN, Strongswan, Tinc, Wireguard and even Tor without
       | obfuscation modules and without private entry nodes are all
       | trivial to detect and block. Assuming one can reach a VPS
       | provider outside of the country, the most likely solution would
       | be an HTTPS enabled proxy using SNI and a wildcard cert that
       | makes it look like one is just pushing code to a git repo.
       | HAProxy could peel off the default traffic to an actual Gitea git
       | repo and forward the proxy traffic to a Squid SSL-Bump proxy.
       | Create a VM somewhere, give it a DNS name like
       | "git.yourdomain.tld" and then proxy through that HTTPS connection
       | from a different SNI name like "artifacts.yourdomain.tld". This
       | isn't perfect but may work.
       | 
       | Another option if SSH is still permitted to VPS providers, one
       | could tunnel over SOCKS connections through a VPS VM initially as
       | the first hop, then through a friends home in that same region
       | outside of Iran as the second hop to minimize the number of
       | CATPCHA's one is subjected to. SSH can make multiple hops
       | transparent to the client. Ensure DNS resolution in the browser
       | is set to use the upstream SOCKS connection. As with the previous
       | proposal, try to make the VM look like a git repo or something
       | else work related.
       | 
       | One could find some examples of both of the above ideas on
       | SuperUser, StackExchange and ServerFault.
       | 
       | Here [1] is a previous discussion on the topic or Iran internet
       | lock-down.
       | 
       | [1] - https://news.ycombinator.com/item?id=33025954
        
       | Trouble_007 wrote:
       | does this work? -> OnionShare 2.6 - Released - (October 9, 2022)
       | : https://news.ycombinator.com/item?id=33155721
       | 
       | FYI: Tor Browser (Bundle) 11.5.4 - (All Platforms) release is
       | due, probably within a few hours
       | 
       |  _Help people in Iran reconnect to Signal - a request to our
       | community_ : https://www.signal.org/blog/run-a-proxy/
       | 
       | Also, what DNS are they using, is DoH or DoT able to be used?
        
       | devKnight wrote:
       | does TOR work ?
        
       | w0rst wrote:
       | Try shadowsocks.
        
       ___________________________________________________________________
       (page generated 2022-10-11 23:02 UTC)