[HN Gopher] Tell HN: VPN Situation in Iran
___________________________________________________________________
Tell HN: VPN Situation in Iran
I am an Iranian and have a family member in Iran. As you now the
internet is currently shut off from outside or very slow. Over the
past years, I would create a OpenVPN server with a port other than
default OpenVPN port (1194) and share the connection with my family
member in Iran. Using a random port was needed because default
OpenVPN is blocked in Iran for sometime (probably since 2010). But
recently [after the recent internet shutdown] I notice a change. My
family member cannot even connect to a server IP address or
(private) domain using any port so VPN doesn't work anymore.
Instead they are only able to connect to the outside world using
locally paid VPNs but applications that have end-to-end encryption
doesn't work anymore with these VPNs (Telegram, WhatsApp and etc).
So my theory is they cut off the connection to outside and people
are only able to connect with outside world using certain VPNs that
are probably made by the government. Not really sure.
Author : amir734jj
Score : 21 points
Date : 2022-10-11 19:20 UTC (3 hours ago)
| sweetbitter wrote:
| You could set up a Tor bridge with an obfs4 pluggable transport.
| That works even in China, because it resists DPI and probing.
| Does your VPN protocol resist probing? If not, that may be how
| they are blocking it. Also if the government goes hard enough on
| manually requesting Tor bridges, you will have to distribute
| bridges yourself (which you seem to already be doing with VPN
| server addresses).
| LinuxBender wrote:
| OpenVPN, Strongswan, Tinc, Wireguard and even Tor without
| obfuscation modules and without private entry nodes are all
| trivial to detect and block. Assuming one can reach a VPS
| provider outside of the country, the most likely solution would
| be an HTTPS enabled proxy using SNI and a wildcard cert that
| makes it look like one is just pushing code to a git repo.
| HAProxy could peel off the default traffic to an actual Gitea git
| repo and forward the proxy traffic to a Squid SSL-Bump proxy.
| Create a VM somewhere, give it a DNS name like
| "git.yourdomain.tld" and then proxy through that HTTPS connection
| from a different SNI name like "artifacts.yourdomain.tld". This
| isn't perfect but may work.
|
| Another option if SSH is still permitted to VPS providers, one
| could tunnel over SOCKS connections through a VPS VM initially as
| the first hop, then through a friends home in that same region
| outside of Iran as the second hop to minimize the number of
| CATPCHA's one is subjected to. SSH can make multiple hops
| transparent to the client. Ensure DNS resolution in the browser
| is set to use the upstream SOCKS connection. As with the previous
| proposal, try to make the VM look like a git repo or something
| else work related.
|
| One could find some examples of both of the above ideas on
| SuperUser, StackExchange and ServerFault.
|
| Here [1] is a previous discussion on the topic or Iran internet
| lock-down.
|
| [1] - https://news.ycombinator.com/item?id=33025954
| Trouble_007 wrote:
| does this work? -> OnionShare 2.6 - Released - (October 9, 2022)
| : https://news.ycombinator.com/item?id=33155721
|
| FYI: Tor Browser (Bundle) 11.5.4 - (All Platforms) release is
| due, probably within a few hours
|
| _Help people in Iran reconnect to Signal - a request to our
| community_ : https://www.signal.org/blog/run-a-proxy/
|
| Also, what DNS are they using, is DoH or DoT able to be used?
| devKnight wrote:
| does TOR work ?
| w0rst wrote:
| Try shadowsocks.
___________________________________________________________________
(page generated 2022-10-11 23:02 UTC)