Tailscale saved my ass reddit / selfhosted ---------------------------------------------------------------------- sbbh1 · 2023-11-07 13:26 I'm currently in China with a 24h layover and of course shit hit the fan at work while being here behind The Great Firewall. Couldn't access anything, Proton and Mullvad not connecting, no way to google workarounds either. Nothing worked. Made me realize how utterly paralyzed I am without basic internet access.. Luckily, my home server is set up as an exit node on Tailscale and I can access everything through my home network now. Just a heads up, if you ever find yourself in this part of the world, Tailscale (or the likes) can be your saviour. ---------------------------------------------------------------------- Heuristics · 2023-11-07 13:53 I was just visiting the inlaws in mainland China and had prepared by installing wireguard on my home server and downloaded their ios app. Unfortunately it did not work very well, most sites were still blocked. There also appeared to be a large difference on what could be accessed depending on if I was using the inlaws wifi or if I was using my cell phone network. ---------------------------------------------------------------------- sbbh1 · 2023-11-07 13:59 I wonder how that works. As long as I'm connected to my network, I seem to be able to access everything I need. I also tried Youtube, WhatsApp, Plex, Instagram, etc. without any issues. ---------------------------------------------------------------------- ElevenNotes · 2023-11-07 14:14 He probably forgot to use DNS via Wireguard. ---------------------------------------------------------------------- ithilelda · 2023-11-07 14:22 no. Wireguard traffic is very easy to recognize and readily blocked by the GFW. tailscale has some more layers on top. However I doubt that OP is capable of accessing the outside simply because he is in a better place in China. GFW has geodiscrimination lol. ---------------------------------------------------------------------- ithilelda · 2023-11-07 14:32 Sorry most of us don't spread the words out before you came here lol. It's very lucky of you to have your homelab setup beforehand. Usually tailscale is not enough to bypass GFW because the protocol signature is pretty obvious. maybe GFW is having a good time that day lol. Most of us use providers with shadowsocks, v2ray or trojan. They masquerade the packets, not just encrypting them. If you are visiting here often, you may need to find a provider with those services in case your homelab gets blocked too. ---------------------------------------------------------------------- sbbh1 · 2023-11-07 14:38 Hah, you're probably right. I don't know enough about the internet situation so take my advice with a grain of salt. I'm happy it's working for me at least. I'm going to read more about it when I'm back home, it's a fascinating (yet sad) reality with all the censorship here. ---------------------------------------------------------------------- LoonyGnoll · 2023-11-07 14:50 I've been switching away from tailscale because of that, somewhat. Tailscale's main focus is to provide a network, not censorship circumvension (simple? signature, no split tunnelling), and on android it kinda interferes with running another VPN that can do that. ---------------------------------------------------------------------- fullinator4 · 2023-11-07 14:56 Wireguard worked perfectly for me in China. Everything I read said it didn’t work and I prepared for a fun vacation unplugged from the internet. Then I tried for fun and a basic wireguard tunnel worked and I could access everything. ---------------------------------------------------------------------- Significant-Neat7754 · 2023-11-07 16:12 Weirdly, whenever I use Tailscale, I can connect to my servers alright, but not to the wider internet. Is this expected behaviour? ---------------------------------------------------------------------- devzwf · 2023-11-07 16:23 you need to set it up as exit node. ---------------------------------------------------------------------- cybrian · 2023-11-07 16:27 Check on your subnet routing and exit nodes. If you don’t have any subnet routes or exit nodes, you cannot access the internet through Tailscale and it’ll just go on your main clearnet connection. If you do have self-managed exit nodes or subnet routes set up but they’re not working properly, connections to the greater internet will likely just fail entirely. If you want to access resources as if you’re physically at another location that you have control over, set up an exit node there. If you just want to be able to access the internet somewhat anonymously Tailscale will sell you access to Mullvad VPN exit nodes, so that if you choose a Mullvad exit node your internet gateway becomes Mullvad VPN. ---------------------------------------------------------------------- Significant-Neat7754 · 2023-11-07 16:31 Ah! Thank you. I checked it and it seems the exist node software isn't mature enough on Android yet (according to their [documentation](https://tailscale.com/kb/1103/exit- nodes/?tab=android)). > Running an exit node on an Android device is not performant—it may be too slow for most cases. ---------------------------------------------------------------------- Significant-Neat7754 · 2023-11-07 16:36 Thank you for helping. You're right, I do have to set up exit nodes. ---------------------------------------------------------------------- skelleton_exo · 2023-11-07 17:00 My last time in China was 2019 so I'm sure it has changed by now, but back then OpenVPN on TCP port 443 usually worked for a couple of days before they blocked it. And the block was somewhat local when I changed from one city to another it worked again for a couple of nights. Also they did far less blocking on western phones. So you could get around a lot of the blocking by using your Phone as hotspot instead of whatever wifi they had available. ---------------------------------------------------------------------- BigLan2 · 2023-11-07 17:40 It's been a long time since I was in mainland China, but I got the impression there was different filtering applied to different users. Standard home connection for natives was the most locked down, expat apartments weren't filtered as much, the international school's connection was pretty open (though they had their own filtering.) It would vary geographically too with cities in the pearl River Delta having more open connections than the central or northern cities. Honestly, the great firewall is fascinating to me - I'd love to see a really detailed technical analysis of it but the CCP obviously don't want people to know what it does. ---------------------------------------------------------------------- Spectre_two · 2023-11-07 17:55 I was also in China for 4 weeks back in June staying in a fairly typical Chinese business hotel in Shanghai (I think there were only 2 other westerners we saw there). Our 2 VPNs just didn't work at all, and many of my colleagues VPNs were also not working at the time either. Thankfully I had setup a Tailscale exit node on my home network and that was the only thing that worked. 1 month in china with no tv access would have driven us nuts! ---------------------------------------------------------------------- SamSausages · 2023-11-07 18:01 I have been able to access resources by running my own VPN on port 443. Works much better when you aren't on a public VPN that these places blacklisted! ---------------------------------------------------------------------- SamSausages · 2023-11-07 18:02 private (self hosted) vpn on port 443 works well for me. As they don't have my IP blacklisted (like most public VPN) and 443 is rarely blocked and encrypted anyway. ---------------------------------------------------------------------- SamSausages · 2023-11-07 18:06 In my experience depends what port you run it on. I run it on 443 because 443 is rarely blocked and looks less suspicious. ---------------------------------------------------------------------- ElevenNotes · 2023-11-07 18:42 So is tailscale traffic which my firewall blocks. ---------------------------------------------------------------------- fisheess89 · 2023-11-07 19:21 yeah my tailscale also magically work when I was back in China in July. But I can't add a friend to my net. After registering with my invitation he never really connect to tailscale. ---------------------------------------------------------------------- cynix · 2023-11-07 19:28 Wouldn’t it be _more_ suspicious that you’re running non-HTTPS traffic over port 443? ---------------------------------------------------------------------- SamSausages · 2023-11-07 19:36 They are both encrypted, so it's not just unencrypted on HTTPS. I'm sure if someone wanted to DPI it they could figure out it's not actually HTTPS, but I don't think it's immediately obvious and it requires more sophisticated methods to detect. And even if they detect it, it's not going to be easy to stop it because it's not practical to just block 443. ---------------------------------------------------------------------- ErebusBat · 2023-11-07 19:39 I was wondering about this as well. Is it possible that the GFW only blocks the tailscale control servers but the client had public node IPs cached so that is why it succeeded? And IF that is the case... why on earth does it not block wire guard tunnels (as you said the signature should be pretty easy to match). Very interesting. ---------------------------------------------------------------------- ErebusBat · 2023-11-07 19:41 It the GFW... yes I would think so. To "domestic" (meaning anything outside of China in this discussion) I would say that is a pretty good bet (to use 443). ---------------------------------------------------------------------- ErebusBat · 2023-11-07 19:41 > Honestly, the great firewall is fascinating to me - I'd love to see a really detailed technical analysis of it but the CCP obviously don't want people to know what it does. Same. It really is a feat of modern engineering. ---------------------------------------------------------------------- ErebusBat · 2023-11-07 19:42 AND set your client to use that exit node... two step process. ---------------------------------------------------------------------- ErebusBat · 2023-11-07 19:43 > Also they did far less blocking on western phones. So you could get around a lot of the blocking by using your Phone as hotspot instead of whatever wifi they had available. Fascinating... One would think they did a lot less blocking, but perhaps more inspection... ---------------------------------------------------------------------- xXAzazelXx1 · 2023-11-07 20:09 Wireguard by that logic would also work ---------------------------------------------------------------------- DazzlingTap2 · 2023-11-07 20:20 > Couldn't access anything, Proton and Mullvad not connecting That sounds dystopian AF. When two of the arguably best paid VPN services won't work. That'll probably delay my plan to China for the forseeable future. Last time I've been to China it's 6 years ago, all I had to do is install an app and works everytime. Maybe it's time to setup an exit node and read up on all the options to consistently a d reliable bypass the gfw before I go there again. ---------------------------------------------------------------------- CrazyEnginer · 2023-11-07 20:38 Actually I'm surprised it worked at all since wireguard protocol is easily detected and blocked. At least in Russia it's no longer an option. Is it possible that you stayed in tourist area where GFW restrictions are eased? ---------------------------------------------------------------------- EriksonEnterprises · 2023-11-07 21:03 What about something like TeamViewer? Having your computer left on at home and then just using TeamViewer to view and use something that isn't restricted haha ---------------------------------------------------------------------- nav13eh · 2023-11-07 21:13 If you are connecting to a WG VPN and have it configured to route all traffic through the tunnel, there is no possible way for a firewall to selectively block traffic inside the VPN. It either allows the VPN in its entirety or not at all. The OP must have had routing or DNS misconfigured. ---------------------------------------------------------------------- nav13eh · 2023-11-07 21:15 It's easy to see if traffic is HTTPS or something else. It does not require un encryption of anything. ---------------------------------------------------------------------- SamSausages · 2023-11-07 21:22 Like I said, if you DPI it you can find it. Does the GFW? I don't know. What I do know is that it's not standard and most standard automated systems and observers will not catch it. So it does take additional steps to look for it and more steps to stop it. ---------------------------------------------------------------------- froli · 2023-11-07 21:23 You can't have multiple VPN connections on Android/iOS. That's not a tailscale thing. The way I found around that is to use straight wireguard, download the config files from mullvad and add my homelab as a peer. This way on my phone I can connect to both my "privacy VPN" and my homelab and it still counts as just one VPN connection. ---------------------------------------------------------------------- MonetHadAss · 2023-11-07 21:48 You can't have multiple VPN that utilizes the VPN API on Android, but if you have root and a new enough phone or a supported kernel, you can have multiple Wireguard tunnels at the same time. That is what I have been doing for some time now. 10.10.60.0/24 to my own private Wireguard network, all other routes go through Mullvad configured through the official Wireguard app. ---------------------------------------------------------------------- Mailstorm · 2023-11-07 22:26 Luckily you didn't get black bagged by officials for circumvention ---------------------------------------------------------------------- Underknowledge · 2023-11-07 22:34 ? that should not work, at least not for long. Wireguard packages are very unique and therefore easy to spot/block. The GFW should also abort connections that have a "Long lifespan" ---------------------------------------------------------------------- AlexKLMan · 2023-11-07 22:44 Is it? I thought WireGuard was blocked as well but for some reason it was just because I used the QR code to connect if I use the actual file it works within China ---------------------------------------------------------------------- archover · 2023-11-07 22:46 Curious if a socks5 firefox proxy and a ssh tunnel would've worked for you, also. ---------------------------------------------------------------------- edthesmokebeard · 2023-11-07 23:10 "and of course shit hit the fan at work while being here behind The Great Firewall." This is a work problem, not yours. ---------------------------------------------------------------------- sbbh1 · 2023-11-07 23:15 I'm surprised as well. It should be easy to detect. I am staying at fairly big airport hotel chain, so that could be why. That said, I do know that Tailscale is a bit more obfuscated than plain old wireguard and openvpn. ---------------------------------------------------------------------- Sajjad-Pourali · 2023-11-08 01:18 Have you tried Narrowlink? It uses the HTTP/S protocol and QUIC for P2P communications, and it should work in China as well. ---------------------------------------------------------------------- Reverent · 2023-11-08 01:55 Tailscale falls back on wireguard over TLS via a DERP server when it can't connect, so it simulates HTPS traffic. ---------------------------------------------------------------------- skinnylatte · 2023-11-08 01:56 The only thing that worked reliably for me was just using something like Google Fi and roaming ---------------------------------------------------------------------- ithilelda · 2023-11-08 02:49 no. it doesn't need dpi to distinguish between https and wireguard. there are unencrypted packets required for handshakes, and wireguard's those packets are distinctively different than those of tls, you can easily spot it even just with packet length inspection. GFW has reinforced learning AI to help it identify traffic too. So anything not https over port 443 is identifiable. It just depends on the location. If it is a tourist heavy or trade heavy area, it lifts its inspection a little. ---------------------------------------------------------------------- ithilelda · 2023-11-08 02:54 GFW is a black box. We only know partially by deducing from what it has done. the most likely case is that OP is in a lifted area where foreign trades and tourists are most common. It is so because we have reports from different regions of China stating absolutely different findings. some can easily bypass it, some cannot even use the latest masquerading protocols. Who knoes what the fk the government is thinking... ---------------------------------------------------------------------- satchm0h · 2023-11-08 03:22 DPI refers to any inspection of the payload (i.e. beyond the IP & TCP/UDP headers). It does not imply decryption. That said, I agree that the GFW most certainly does DPI according to this definition. ---------------------------------------------------------------------- Alt_Lightning · 2023-11-08 03:40 Underrated comment right here ---------------------------------------------------------------------- banerxus · 2023-11-08 06:11 My brother was in China for a week and asked me to find a solution to have whatstapp access and I ended up installing NordVpn on his phone and it worked out very well. No issues accessing all western services. ---------------------------------------------------------------------- cynix · 2023-11-08 07:08 > Does the GFW? I don't know. It absolutely does. ---------------------------------------------------------------------- hansarsch · 2023-11-08 07:57 From Android or a generic Linux box? ---------------------------------------------------------------------- Tone866 · 2023-11-08 09:10 Where did you found that shadowsocks masquerade the packets? Ans masquerade as what? HTTPS? I've read it's basically an encrypted SOCKS5. And could you send a link to trojan, it's incredible hard to google.. ---------------------------------------------------------------------- ithilelda · 2023-11-08 11:54 no you are right, it doesn't. nor does v2ray. Trojan is the only one masquerading as https. I usually list them all because they are the most popular among providers, and I just use the word masquerade to show that their intention is not vpn, but bypassing GFW lol. It's not accurate. I also list these names just to help search readily available providers. if you want to self host, use more modern protocols. Trojan as well as the other two is 100% detectable by AI since October, 2022, so there is no need to bother hosting one yourself (those providers have domestic relay servers in special locations where censorship is lifted, so those protocols are still fine). modern protocols to search for: (they are all on github) - xray, project x, search xray-core, by xtls. - reality, also by xtls. - naive, search naiveproxy, by klzgrad. - hysteria 2. just search hysteria, by apernet. trojan is searched by the name trojan on github. by trojan-gfw. ---------------------------------------------------------------------- archover · 2023-11-08 12:52 I have not explored the technique under Android, only from Linux. I'm more of a laptop vs mobile person :-) ---------------------------------------------------------------------- sasukefan01234 · 2023-11-08 15:36 So much this ---------------------------------------------------------------------- ErebusBat · 2023-11-08 18:05 Honestly it makes a lot of sense to not censor foreigners as much... "The GFW wasn't _that_ bad when I was there... people are just exaggerating" ---------------------------------------------------------------------- lolappapalol · 2023-11-09 06:07 There shouldn't be any difference between QR and file if the QR code is setup correctly. The QR code was likely missing some URL or port information. Wireguard doesn't work in China very well, but it's highly dependent on traffic amount and also you can use it for work purposes by registering it. But the way it blocks traffic generally is that it will work for a bit and then slowly degrade over time. ---------------------------------------------------------------------- lolappapalol · 2023-11-09 06:15 Someone explained this above but Tailscale will fallback to DERP servers over HTTPS which is why this is likely to work. Wireguard doesn't even attempt to hide itself and can easily identified the GFW, so it still has the issue in China where it doesn't work at all. ---------------------------------------------------------------------- lolappapalol · 2023-11-09 06:16 There are a few providers that work in China pretty well, you just have to do research. ---------------------------------------------------------------------- sbbh1 · 2023-11-09 06:41 Same thing unfortunately when you're self-employed ---------------------------------------------------------------------- sbbh1 · 2023-11-09 06:48 Does that actually happen? Note: I did make it out. Unrelated: I also found it very suspicious that when connecting to airport wifi, they require you to download and install WifiPassword.apk ---------------------------------------------------------------------- PogPotato43 · 2023-11-09 16:37 Probably spyware ngl ---------------------------------------------------------------------- PogPotato43 · 2023-11-09 16:38 I’ve heard they’ll ratelimit SSH sessions if you proxy through them. ---------------------------------------------------------------------- archover · 2023-11-09 21:46 Not so far for my server company ionos.com. I use the proxy continuously. ---------------------------------------------------------------------- ilikestreet · 2023-11-11 16:51 I have tried self hosted shodowsocks is way better Tailscale, if only want to access outside world behind the great firewall. For accessing home server network, tailscale is the best for now