undefined | Better HN

0 pointslwtve1y ago0 comments

I've not tested protocols that are available on iOS "out of the box" (guessing L2TP, IPSec?), but here's my two cents:

1. It differs from ISP to ISP. Right now I'm using a major ISP and I have no problems connecting to a Hetzner IP via:

- plain WG

- OpenVPN

- Shadowsocks

My mobile operator blocks OpenVPN, other methods work.

2. Time could also play a role - there seem to be "tests" about how the government could block some protocols without affecting business etc. - these happen bi-monthly and last ~2-5 days. My friend uses a different major ISP and he reported broken Shadowsocks this week, though it started working again.

3. The endpoint also matters (obvious in hindsight). "Internal" endpoint seem to "break" very rarely, if at all. Obvious, if you consider that a lot of people need to remote into their corp nets.

0 comments

votkon1y ago

The main difference there is right now is that mobile operators have much better hardware because it's newer. That makes it easier for them to implement government-requested blocks including using DPI. The landscape is changing right now, that's true as each provider got it's own issues and tech abilities.

They can block services by IPs, but that the game they failed miserably while trying to block telegram. Also most modern VPNs(well at least Le VPN does it) rotate their IPs to avoid blocks. It's a lot of work, but that's a lot of work for those who try to block them too..

They can also block ports, but that's easy to change.

I saw them blocking the domain names, to kill the API communication of VPN apps, but that's a pathetic move too - you just buy another domain, push the update and that's it.

I'd recommend using Wireguard with Amnezia modification. It obfuscate the WG handshake as well as transport channel.