Looking for a self-hosted method to evade web censorship reddit / selfhosted ---------------------------------------------------------------------- pureexe · 2023-12-17 14:41 **TLDR:** I want a software suggestion that acts like a VPN that runs on TCP protocol only and can run fast enough to utilize 300Mbps network speed on an old PC. \------------------------ Let's me explain my situation first. I moved to a university dorm that censored the internet. So, right now, i have to remote desktop back to a mini PC that runs at my parent's home to access the censor website. This solution is hard to use on a mobile phone. So, i looking for other solution. For self-hosed VPN, my ISP currently allows for TCP port forwarding to the public internet (For security camera sharing, but I can repurpose it as a VPN), but OpenVPN over TCP is really slow, like 10-20mbps. Note that my home internet is 300Mbps, and the university dorm is using 1Gbps. Any suggestion for my situation? ​ ---------------------------------------------------------------------- Casseiopei · 2023-12-17 14:48 I prefer OpenVPN but WireGuard offers faster speed and takes less processing power. ---------------------------------------------------------------------- pureexe · 2023-12-17 14:50 If understood correctly, Wireguard uses UDP. And my ISP only forwards TCP port. I already tried Wireguard, and it was unsuccessful to connect over the internet (but It can connect within the same local network) ---------------------------------------------------------------------- Casseiopei · 2023-12-17 15:03 True, my bad. Perhaps SoftEther? ---------------------------------------------------------------------- wit2008 · 2023-12-17 15:05 You could run any of the FOSS http proxy services out there over TCP and configure your browser to use that. Just make sure you use one that supports authentication. Another option would be to run a small $5/mo instance in Linode or similar and use a more performant UDP-based VPN like Wireguard to route all traffic. ---------------------------------------------------------------------- pureexe · 2023-12-17 15:15 Do you have any suggest proxy software? I tried one called CCProxy and it still failed to evade and get censored by the university? For a small instance, I have concerns about the bandwidth. they likely limit bandwidth to around 1TB and I likely go over that. So, I'm looking for selfhost solution. Note that ISP at my parent's home has no datacap. ---------------------------------------------------------------------- survivallama · 2023-12-17 15:28 Just use tailscale. ---------------------------------------------------------------------- Geoffman05 · 2023-12-17 15:31 I would just spin up a VPN at home and call it good. What’s the upload speeds back home? I’m assuming the blocked websites are going to be porn and streaming, both of which don’t use much bandwidth. ---------------------------------------------------------------------- QzSG · 2023-12-17 15:45 How exactly is the website censored? Why do you insist on self- hosting? ---------------------------------------------------------------------- OkOk-Go · 2023-12-17 15:45 I was going to say Tor, but I was thinking of communist-regime levels of censorship. For college, use a Wireguard VPN, you’ll be fine. If that gets flagged, get your own VPS and host it there, use weird ports and encapsulations. Tor does this, they even have ones that look like OneDrive. I wonder if there is something like that for a generic UDP socket. PS, your college is treating you like a child. When dealing with them, never forget you’re an adult (with full privileges and responsibilities). My college used to do this when you had to make any type of claim, cause you’re mommy’s kid in their mind. Then it’s the other way round for their grad students, cause all of them pay with their own money. Fuck that, I went to a different place for grad school. ---------------------------------------------------------------------- HoustonBOFH · 2023-12-17 15:51 Or OcServ. (Open Connect Server) ---------------------------------------------------------------------- ithilelda · 2023-12-17 15:55 why are there so many colleges censoring stuff? If tailscale works, then use it. If not, then you need specific proxies designed to circumvent censorship. there are several I constantly mention in older posts, like shadowsocks, trojan, v2ray, etc. You could try any of them until you succeed. ---------------------------------------------------------------------- hiddengiggles · 2023-12-17 16:11 There isn't a TCP or UDP port. Those are communication protocols. This comment doesn't make sense. Your ISP should block all UDP packets its a common protocol. ---------------------------------------------------------------------- mrmacedonian · 2023-12-17 16:21 In OpenVPN's config, set it to TCP and port 443; open 443 at your parents' and point it at the OpenVPN server. Almost no one unilaterally will block :443 traffic, only thing would be if they identify it as VPN and block at a higher layer, but I've never seen this implemented myself. ---------------------------------------------------------------------- pureexe · 2023-12-17 16:22 Thank you for suggestion, i will tried tailscale ---------------------------------------------------------------------- pureexe · 2023-12-17 16:26 My ISP provides a port forwarding service that I can forward 10 ports from home to outside the internet without charge. They intend for a Security camera but this seems to work with a TCP service like webserver or OpenVPN (TCP). I tried OpenVPN (UDP) and wireguards. it failed to connect. ---------------------------------------------------------------------- pureexe · 2023-12-17 16:26 Thank for suggestion, i will give it a try. ---------------------------------------------------------------------- pureexe · 2023-12-17 16:28 I don't know how this exactly works. As far as I know from the block page it said "palo alto networks" so, it seems some kind of firewall. It blocks both HTTP and HTTPS, changing DNS doesn't help. ---------------------------------------------------------------------- wit2008 · 2023-12-17 16:29 Squid seems popular. I use TinyProxy along with OpenVPN so I can have more than 5 devices connected to my Mullvad VPN instance. Maybe try SOCKS5 as the proxy type instead of HTTP? Not sure what your school's network is doing to effectuate the censorship. Maybe try using different DNS servers too ([9.9.9.9](https://9.9.9.9), 1.1.1.1). ---------------------------------------------------------------------- pureexe · 2023-12-17 16:31 At home the upload speed is 300Mbps, and the University dorm is 1Gbps internet. VPN sounds great. But only the VPN service that I successfully ran was OpenVPN (TCP) which has a throughput of about 10-20Mbps that less than my internet speed. I'm looking for some other solution that might improve the speed situation. ---------------------------------------------------------------------- pureexe · 2023-12-17 16:43 I tried to change DNS. It still got block. I also tried Mullvad VPN. Speed is quite bad here, which is around 50mbps. The Closest Mullvad server is in Singapore (1000 Km from my university), while another VPN provider has a server in Bangkok (200 km from my university). Other VPN provider that I have tried is ExpressVPN, about 300Mbps, and Surfshark about 500Mbps. But i looking for self-hosted solution first to save money. ---------------------------------------------------------------------- pureexe · 2023-12-17 16:45 Thank you for listing names of multiple software. I will try them. ---------------------------------------------------------------------- pureexe · 2023-12-17 16:49 OpenVPN over TCP is work for me. Tor might be a bit overkill (and slower). So, i don't think I need Tor. VPS is one of the option for me in case i didn't have better alternative than OpenVPN over TCP ---------------------------------------------------------------------- Geoffman05 · 2023-12-17 17:06 Big numbers are great… do you experience any buffering issues at 10-20? The only issue I see is downloading new game updates but that could be started before you go to bed. ---------------------------------------------------------------------- useless_mlungu · 2023-12-17 17:08 Or even setup that home PC as a Tailscale exit node, and then use your phone/dorm PC with that exit node. At least in my understanding that should get ypu around the censoring... It does for me at the school I work at. ---------------------------------------------------------------------- Anrudhga2003 · 2023-12-17 17:41 Try a shadowsocks proxy? ---------------------------------------------------------------------- steveiliop56 · 2023-12-17 18:15 Tailscale is the best option. ---------------------------------------------------------------------- FabrizioR8 · 2023-12-17 19:01 curious… what ISP and what equipment are they leasing you that “only” works with tcp forwarding? ---------------------------------------------------------------------- pureexe · 2023-12-17 19:35 The ISP is name 3BB ([https://3bb.co.th](https://3bb.co.th)) The device is a Huawei HG8145X6. There is an option to forward UDP in the device. but my internet plan doesn't have a public IP. (There is a plan that have public IP but will cost more) With the current internet plan, they are allowed to forward 10 TCP ports through their DDNS system. The forwarded port will show up at (somedomain).3bbddns.com ---------------------------------------------------------------------- poultryinmotion1 · 2023-12-17 19:37 Have you tried Wireguard as opposed to openvpn? You'll be limited to the upload speed of the network but it's secure. You also might want to check out Twingate and KASM. Twingate is a proxy technically, but I think it's pretty neat. ---------------------------------------------------------------------- pureexe · 2023-12-17 19:40 I tried Wireguard. But it doesn't work since ISP allows to forward only the TCP to the public internet but wireguard is using UDP. By the way, i will look into Twingate. Thank for suggestion ---------------------------------------------------------------------- uc50ic4more · 2023-12-17 19:43 I have seen Tailscale recommended already and will add that I have a GCP Free Tier VM running Tailscale as an Exit Node and use that as a quasi-VPN. My wife is a high school teacher and I have two teenage daughters in high school; and all have to deal with school board firewalls. In addition, from time to time we are geo-restricted from U.S.-based content. The GCP VM is in Iowa (my family is in Canada) and so whenever anyone needs to circumvent a firewall or give the outward impression of being present in the U.S. they simply open the Tailscale app and choose the Exit Node. ---------------------------------------------------------------------- zfa · 2023-12-17 19:53 Shadowsocks with Cloak/Xray, as used by prior to bypass the Great Firewall of China. Set up a server on a VPS such as a freebie from Oracle. If the filter adjusts to the traffic pattern, route via a cdn such as Cloudflare. ---------------------------------------------------------------------- adamshand · 2023-12-17 20:10 If you are restricted to only TCP tunnels, and you can ssh to a computer on your home network, this is all you need. `laptop> ssh -D 1080 server.home` Then setup your laptop/browser to use `localhost:1080` as a SOCK5 proxy (make sure you include DNS). All traffic will now be routed over the SSH connection and go to the internet via your home network. ---------------------------------------------------------------------- adamshand · 2023-12-17 20:10 If WireGuard didn't work for you, Tailscale won't work either (it's just layers on top of WireGuard). ---------------------------------------------------------------------- Cynyr36 · 2023-12-17 20:30 The advantage of tailscale in this case is not needing to punch a udp hole in a firewall on a isp router that seems to only support tcp holes. Outbound udp will surely work just fine. ---------------------------------------------------------------------- FabrizioR8 · 2023-12-17 20:31 Your service includes a public IPv6, yes? I looked at the Broadband24 service terms and conditions (first one I browsed to… Term #7 says they provide a public IPv6. Not sure what service tier you have, but check the T&C. https://www.ais.th/en/consumers/fibre/package/broadband24 If so, have you tried registering an IPv6 port forward and setting up WireGuard with IPv6? https://www.ais.th/content/dam/ais/consumer/pdf/fibre/THDDNS_Public.pd f ---------------------------------------------------------------------- pureexe · 2023-12-17 20:54 Yes, they do provide public IPv6. But the university dorm internet doesn't have IPv6. So, I cannot connect to the home from the dorm using IPv6 ---------------------------------------------------------------------- Comakip · 2023-12-17 21:07 It's better to get something like Mullvad if you got $5 to spare. ---------------------------------------------------------------------- wit2008 · 2023-12-17 21:08 There was another comment that Mullvad wasn’t fast enough and didn’t have close enough servers. ---------------------------------------------------------------------- x0rgat3 · 2023-12-17 21:21 Just use an SSH tunnel with socks proxy. Maybe you need to run ssh on port 443. If it is a deep packet inspection firewall this can still be blocked. ---------------------------------------------------------------------- jackyes_89 · 2023-12-17 22:22 trojan-go https://github.com/p4gefau1t/trojan-go ---------------------------------------------------------------------- AllTheModzAreCancer · 2023-12-17 23:51 College (for at least the past 50 years) isn't about learning information and developing the skills to objectively come to your own conclusions. Apparently, college is about brainwashing newer generations into becoming docile and obedient voters and consumers. Think about it... when was the last time you saw a "college educated" Redditor come up with an opinion that they didn't hear somewhere else first? Informed opinion making happens when you absorb a massive amount of information on a particular topic and then cross reference all of it as much as possible. These days, though, colleges just want you to absorb and regurgitate pre-formed opinions. ---------------------------------------------------------------------- yarmak · 2023-12-18 00:03 Try [this](https://dev.to/iarmak/spin-up-secure-https-proxy-in-less- than-10-minutes-kf2) one. ---------------------------------------------------------------------- hiddengiggles · 2023-12-18 00:17 I guess that's a bias on my part. My ISPs have always had public IPs so I havent had to deal with them restricting portfording so much. My best suggestion is to do a tcp tunnel. There are projects like https://github.com/rfc1036/udptunnel. It'll wrap your udp packets in a tcp connection so you can do typical vpns like wireguard using TCP. The performance will not be great, but no VPN over tcp will be great. Your throughput should suffer less than your latency delay. ---------------------------------------------------------------------- BoneChilling-Chelien · 2023-12-18 01:44 Shadowsocks sounds like something that would work. ---------------------------------------------------------------------- yakultisawesome · 2023-12-18 02:29 This is a very niche tool that I noticed a while ago called v2ray ([website](https://www.v2fly.org/en_US/)). It's apparently used by people in China to get around the country's internet censorship and has been in active development for a long time. Based on the information and blogs that I could find, seems to be extremely promising. If all else fails, this might be worth a shot. ---------------------------------------------------------------------- riortre · 2023-12-18 03:58 Tor doesn’t work in communist-regime levels. It works in “democratic”-regimes only. You need specialized anti-DPI software. Start googling from vless and v2ray ---------------------------------------------------------------------- PaulEngineer-89 · 2023-12-18 05:24 The problem with sshtunnel and similar systems is really that TCP over TCP has horrible performance. Essentially the inner TCP gets confused by the outer TCP and creates retransmits and reduces speeds. The solution is to use UDP2RAW. It disguises UDP by making it look like TCP. https://github.com/wangyu-/udp2raw/wiki ---------------------------------------------------------------------- Trigus_ · 2023-12-18 06:03 If you want to setup some really solid anti-censorship tools, I'd recommend sing-box https://sing-box.sagernet.org/ on a free (Oracle) or cheap VPS ---------------------------------------------------------------------- SwissOS · 2023-12-18 12:45 Tailscale uses Wireguard which is UDP based, so this is not a solution to OP's request for " a VPN that runs on TCP protocol only"