undefined | Better HN

0 pointsbeefsack11y ago0 comments

TCP over TCP for VPN is pretty useful in places where deep packet inspection blocks UDP by default, eg. GFW in China.

0 comments

6 comments · 2 top-level

droopyEyelids11y ago· 2 in thread

Do you have any idea why the GFW blocks UDP by default? I can imagine that for corporate networks, but as far as I know, uninspectable UDP streams only recently came into existence with Google's QUIC (which assumes pre-negotiated encryption keys are still valid)

Why block all streams if you can inspect them (or at least their handshake)?

duskwuff11y ago

Probably because they determined that most of it was VPN or other encrypted traffic, and that blocking it was easier than trying to inspect it.

beefsackOP11y ago

While practically no official information exists publicly, this appears to be the reason. My gut tells me that the lack of structure in UDP makes it a little harder to inspect too.

rahimnathwani11y ago· 2 in thread

Do you have any information you can share about this? A few years ago, I could reliably use OpenVPN over UDP, as long as I switched ports out frequently. Some time ago (I don't remember when), this ceased to be the case, and I switched to PPTP and, more recently, Shadowsocks.

What has been your experience with UDP over GFW?

beefsackOP11y ago

UDP used to work (~3 years ago) but currently it's blocked wholesale. OpenVPN over TCP gets throttled and blocked thanks to DPI too, an obfuscation layer is required because OpenVPN traffic is identifiable due to a fairly unique encryption fingerprint.

http://blog.strongvpn.asia/china-blocking-udp-ports/

rahimnathwani11y ago

Thanks. This is totally consistent with my experience, and it's good to know that it's not just me :)

j / k navigate · click thread line to collapse

0 comments

6 comments · 2 top-level

droopyEyelids11y ago· 2 in thread

Do you have any idea why the GFW blocks UDP by default? I can imagine that for corporate networks, but as far as I know, uninspectable UDP streams only recently came into existence with Google's QUIC (which assumes pre-negotiated encryption keys are still valid)

Why block all streams if you can inspect them (or at least their handshake)?

duskwuff11y ago

Probably because they determined that most of it was VPN or other encrypted traffic, and that blocking it was easier than trying to inspect it.

beefsackOP11y ago

While practically no official information exists publicly, this appears to be the reason. My gut tells me that the lack of structure in UDP makes it a little harder to inspect too.

rahimnathwani11y ago· 2 in thread

Do you have any information you can share about this? A few years ago, I could reliably use OpenVPN over UDP, as long as I switched ports out frequently. Some time ago (I don't remember when), this ceased to be the case, and I switched to PPTP and, more recently, Shadowsocks.

What has been your experience with UDP over GFW?

beefsackOP11y ago

UDP used to work (~3 years ago) but currently it's blocked wholesale. OpenVPN over TCP gets throttled and blocked thanks to DPI too, an obfuscation layer is required because OpenVPN traffic is identifiable due to a fairly unique encryption fingerprint.

http://blog.strongvpn.asia/china-blocking-udp-ports/

rahimnathwani11y ago

Thanks. This is totally consistent with my experience, and it's good to know that it's not just me :)

j / k navigate · click thread line to collapse