- cross-posted to:
- technews@radiation.party
- cross-posted to:
- technews@radiation.party
You must log in or register to comment.
Is OpenVPN not just SSL traffic?
They can block the default port and IP addresses owned by VPN service providers, but is there any way to block the protocol without block all encrypted web traffic?
Blocking all encrypted traffic… fantastic suggestion comrade, I’ll forward this on to the Kremlin. Also, you’ve been drafted.
I suppose with “comrade” you are hinting at Soviet customs, but Russia isn’t the USSR and couldn’t be further from being socialist
Settle down, it was a joke
what
Oh please. In all the ways that matter, it is identical.
Russia isn’t the USSR but it is heading towards the USSR ways, and it’s already there in many aspects. It’s not just on a technical definition, a lot of pro-war and nationalist rhetoric is rooted in the old USSR culture.
The USSR wasn’t socialist, it was communist. And yes I know, it wasn’t real communism because real communism is a utopia.
Russia isn’t implementing maternal paid leave, a good universal healthcare system, guaranteed housing, food, education, and a job, so it’s not heading for the ‘USSR ways’ and the USSR was socialist
It’s a custom protocol that uses SSL/TLS for key exchange and such, so it can be detected. It’s actually causing huge problems for many large Russian companies, as it’s common to use those protocols for remote access, work, etc.
As mentioned in the article you need something like “Shadowsocks” to avoid protocl blocking, since it fully disguises the traffic as standard SSL/TLS. Which was created for, and is still used to circumvent this type of blocking in “the great firewall of china”.
https://security.stackexchange.com/questions/187649/is-it-possible-to-detect-vpn-in-the-network
tl;dr: You can infer that OpenVPN is used from the key exchange somehow.
SSL is a higher layer thing, isn’t it? A VPN is just encapsulating an IP packet in another IP packet and getting it the tunnel endpoint. Unless the whole of the IP packet is encrypting, the service provider could just sniff your packets and block anything that looks like an IP packet in the outer packet payload?
Unless the whole of the inner IP packet is encrypted,
It is, because they’re inside an encrypted stream of data.
The way OpenVPN works is this:
-
OpenVPN establishes a TLS connection to the OpenVPN server.
-
Your computer’s kernel generates an IP packet.
-
OpenVPN sucks that up, shoves it into the TLS connection. That connection is encrypted, so the network provider cannot see inside it, know whether the data is IP packets or anything else, though I suppose maybe traffic analysis might let one classify a connection as probably being a VPN.
-
The data in that connection is broken up into IP packets, went to the OpenVPN server.
-
The OpenVPN server decrypts the data in the TLS stream, pulls the original IP packets out.
So the original packets are always encrypted when the network sees them. Only the OpenVPN server can see the unencrypted packet you originally sent.
What @raltoid is saying sounds plausible, though I can’t confirm it myself off-the-cuff – that OpenVPN is detected by looking at somehing unique in the initial handshake.
-
Yes there is a difference between https traffic.
Is OpenVPN not just SSL traffic?
It’s not, it’s an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it’s not the same protocol and can be differentiated that way.
A way around this would be to run an SSLVPN with a landing page where you log in instead of using an IPSec VPN or a dedicated SSLVPN client.
Another way around it would be to create a reverse SSH tunnel on a VM/VPC in another country/state and send all your traffic through that.
Is OpenVPN not just SSL traffic?
It’s not, it’s an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it’s not the same protocol and can be differentiated that way.
I think that either I’m misunderstanding what you’re aiming to say, or that this is incorrect.
OpenVPN can run over UDP or TCP, but it’s not IPSec, not even when running over UDP. IPSec is an entirely separate protocol.
Shithole country
Worse: shithole country that turns everything they touch into shit too.
Bootlicking simply comes naturally to the Russian culture.
Racism comes naturally the Anglo brainpan.
Edit: My apologies to my Anglo brothers and sisters still fighting the good fight and blowing up US government property.
1: Russian isn’t a race, I’m actually being jingoist, you damn racist.
2: I’m Suomi/Celt. Slavs and Germanics can all get fucked, ancestrally speaking, you slaving imperialist pigs.
3:That was clearly a joke, go grow some sunflowers.
using a vpn is also illegal in russia since 2017 😅
But also laws don’t really matter in Russia.
I’d appreciate a source for that statement. :o
This is not accurate information. VPN usage is not banned.
Using is not illegal
if you want to use it in its original purpose it’s illegal. If you use a vpn not registered with Roskomnadzor, it’s illegal because you can access stuff that putin does not want you to see.
therefore using a vpn with its normal purpose to create your private tunnel and access what you want is in fact illegal in russia.
annnd another dictatorship box checked off the list… wont be long now
Until what? Until Russia is a dictatorship? That ship sailed a long time ago.
Won’t be long before Putin catches up to Kim Jong Un in the Oppression Olympics
No drug testings pls
Still wouldn’t be able to catch up with the US, they are gold medalists
This is utter nonsense. If the US was a dictatorship, I wouldn’t be scared to death of the upcoming elections.
Ask anyone who lived in a US controlled military dictatorship if they are scared of the upcoming elections. (Read the Jakarta Method by Vincent Bevins). Besides, both parties are bought out by the bourgeoisie of you country, so nothing is ‘dangerous’, about voting since it will serve the same interests either ways.
I have never before encountered someone who used the word “bourgeoisie” unironically. So cute! Now say something about the proletariat and the means of production!
How about I say that your country will collapse in the next 30ish years, while the rest of the world celebrates. Hopefully you can enjoy the horrors of war that you inflicted in so many places.
Until he stops pretending?
But how are their propaganda farms going to be able to pretend they are in your country now?
They still get to operate don’t worry!!
official companies are still able to use vpn 😏
Exemptions that only apply rules to the common people. Maybe device registration with an exception using ipv6 address
Maybe they don’t actually have all those propaganda farms that the dems were crying about, did that thought cross your mind?
They exist. Inform yourself on the Internet Research Agency, one of Russia’s state sponsored troll farms. A handful of their activities are well documented in factual records. ‘Dems’ weren’t crying about it, every rational person who doesn’t want foreign interference and disinformation flooding our spaces is concerned about it. This should not be a partisan issue whatsoever.
Yeah, I don’t even really have a problem with RT, as long as it’s labeled so that people understand that it’s the Russian state speaking. But a lot of forums rely more-or-less on the idea that people are more-or-less good faith actors. Very large scale efforts to have people pretend to be someone else and make non-good-faith arguments is something that I think that a lot of our forums can’t today handle well.
Arguably, that’s a technical problem that needs to be fixed in some way.
Maybe, but get fucking real.
I live in Russia and I have vps with wireguard vpn in Netherlands. At the current moment it works for me pretty well except the some connection failures two days ago. But they were very short. But I don’t know how long my vps will be accessible with these fucking blocking.
You might want to sign up with astrill. Greetings from China, we’ve been dealing with this shit for decades.
Thanks for advice. I didn’t hear about it before. It will be my backup plan.
Can you confirm that it is still working fine on normal home internet but not on cellular data? Have been back to Russia multiple times per year (family reasons) and none vpn ever works on cellular network. Some work at home and places.
My own vpn is to my house in different country. Wireguard. That has always been working over home wifi here (not cellular). Even until now.
For now it works in mobile data and home provider both. My mobile operator Tinkoff. The home Internet provider - City Telekom. But sometimes it losses connection to several minutes. But generally it works well.
Proton vpn has a feature that can be turned on for oppressive governments, ‘alternate routing’ I believe. Would that be sufficient or no?
Theoretically, yes, since there are options other than WG/OVPN available through Smart Protocol, which Alternate Routing leverages.
Now comes the Great Russian Firewall.
The Copper Curtain?
I don’t think they can afford copper at the moment. Try cotton maybe.
I am pretty confused by the article.
What I’d expected based on what I’ve seen so far was that the Kremlin would not care what protocols are used, just whether the a given VPN provider was in Russia and whether it provided the government with access to monitor traffic in the VPN.
So, use whatever VPN protocol you want to talk to a VPN provider where we can monitor or block traffic by seeing inside the VPN. You don’t get to talk to any VPN providers for which we can’t do that, like ones outside Russia, and the Russian government will do what it can to detect and block such protocols when they pass somewhere outside of Russia.
But that doesn’t seem to fit with what the article says is happening.
The media in Russia reports that the reason behind this is that the country isn’t banning specific VPNs. Instead, it’s putting restrictions on the protocols these services use.
According to appleinsider.ru, the two protocols that are subject to the restrictions are:
- OpenVPN
- WireGuard
A Russian VPN provider, Terona VPN, confirmed the recent restrictions and said its users are reporting difficulties using the service. It’s now preparing to switch to new protocols that are more resistant to blocking.
I don’t see what blocking those protocols internal to Russia buys the Kremlin – if Terona conformed to Russian rules on state access to the VPN, I don’t see how the Kremlin benefits from blocking them.
And I don’t see why Russia would want to permit through other protocols, though maybe there are just the only protocols that they’ve gotten around to blocking.
EDIT: Okay, maybe Terona doesn’t conform to state rules or something and there is whitelisting of VPN providers in Russia actually happening. Looking at their VK page, it looks like Terona’s top selling point is “VPN access to free internet” and they have a bunch of country flags of countries outside of Russia. So maybe Russia is blocking VPN connectivity at the point that it exits Russia, and it’s affecting Terona users who are trying to use a VPN to access the Internet outside Russia, which would be in line with what I would have expected.
Your edit makes sense, it would be possible to block all VPN traffic but just whitelist traffic from trusted IP addresses (like those in Russia). But I don’t think we have enough info to say for sure that’s what’s happening.
ProtonVPN has a “stealth” protocol. Does anyone know if that breaks through?
protonvpn hasn’t worked here at all for a long time now lol
It doesn’t work in China, if that’s any indication.
Absolutely doesn’t. Even tried to go like 100 servers to see.
But nothing related to proton get through
deleted by creator
It was not working 2 day on mobile operators, now waiting full shutdown
yup. kinda same experience. tele2. complete shutdown on my vpn.
Russia is a terrorist state. #SlavaUkraini #ArmUkraineForVictory
I love all my fellow Russians and Ukrainians who rise above the brainwashing that this commenter is demonstrating.
Fuck patriotism and slogans, that’s what politicians want you to do to die for them. All wars would be over in a day if people just realized this as politicians can’t fight their wars without people like this commenter.
Russia is less terrorist than Azerbaijan, but the latter isn’t even being sanctioned (and there’s been an ICJ decision against them, but everybody ignores it) for starving out a little country of 120k people right now in a medieval siege, and openly stating that they are doing exactly that.
I don’t think Ukraine has lots of problems. At least the aggressor there is recognized for what it is and the victim is recognized for what it is and armed by half the world.
I don’t think Ukraine deserves any attention, in fact, since in Artsakh they support Azerbaijan. Support of now finally actual genocide happening is what makes me think that.
Russian likes to threaten the world with nukes - nuclear war would inevitably lead to a nuclear holocaust that would cause the near extinction of the human species.
I don’t give a flying fuck about Azerbaijan. Russia is terrorizing the entire species of humanity. Until you’re threatening to wipe out the entire planet, you are not a terrorist on the same level as Russia.
Russian likes to threaten the world with nukes
Tactical nukes usually.
nuclear war would inevitably lead to a nuclear holocaust that would cause the near extinction of the human species.
If you use tactical nukes, then it’s not much more significant than using thermobaric ordnance or cassettes or even chemical weapons or anything else kinda nasty and non-conventional.
It won’t lead to a global thermonuclear war and thus a nuclear holocaust any more than use of sarin in Syria did.
However! If you don’t give a flying fuck about a smaller holocaust then I don’t give one about your bigger one even if it involves me, I just don’t care.
If you don’t give a flying fuck about a smaller holocaust then I don’t give one about your bigger one even if it involves me, I just don’t care.
Sure, Russia threatens the entire human species, but if it doesn’t suit your liberal virtue-signalling for some marginalized minority, then it’s fine with you.
What’s the survival of humanity vs your imaginary liberal internet points.
Sure, Russia threatens the entire human species,
Your life is worth at best as much as any Artsakhi farmer’s life. In fact much less, if by “the entire human species” you mean yourself.
Now, Russia can’t threaten anybody, I’d be surprised if any of those strategic nukes are still operational. I happen to live in Russia and know how things are usually done here. That aside, Russia’s regime consists of thieves and murderers, not some Hollywood fascist hardliners. They care for their lives very much.
but if it doesn’t suit your liberal virtue-signalling for some marginalized minority
At this point I’d actually prefer that somebody nukes the miserable being you are.
And people of Artsakh are very much the majority in their land, however they are besieged and dying from hunger.
But, well, it’s good to know that you care about Ukraine only because of being afraid that, again, somebody nukes you.
Also my ancestors on paternal side happen to be from a certain valley in the province of Tayq, Western Armenia, currently occupied by a certain genocidal NATO country. I won’t buy your bullshit. I’ll care about Ukraine and somebody, again, nuking you personally when enough people care about that, which is never.
The people of Artsakh are also people of the world. Russia is threatening them with extinction too. You don’t actual care about them. You’re a fake and a liar begging for liberal minority points online.
Russia is threatening them in much more material way, with all its deals with Azerbaijan (which would be something sanction-worthy for the latter if it were, I don’t know, Georgia), but it isn’t killing them right now.
You don’t actual care about them.
I very definitely do, my aunt’s husband is from there and a participant of the first war.
You’re a fake and a liar
Judging by your use of the words “liberal” and “minority”, I’d say your opinion on the matter is not worth much, neither are you as a whole.
It won’t lead to a global thermonuclear war and thus a nuclear holocaust any more than use of sarin in Syria did.
You didn’t mention the escalation policy of either of those countries during a war event.
Escalation policies tend to become very elastic when implemented by humans.
They really can get to some limited strategic exchange, but after that point some countries are democratic and that demos which supposedly rules them will tear into pieces everybody preventing the cessation of hostilities, and others are authoritarian, and their authority cares about its lives and well-being the most.
I mean, NATO officials have become much more modest with words about “any attack on NATO territory is an attack on NATO” after a few stray missiles have landed on Polish territory, for example.
Escalation policies tend to become very elastic when implemented by humans.
I’m talking about the Rules of Engagement during wartime. Especially when it comes to the release of nuclear weapons. These rules are very un-elastic.
Each use of nuclear force is responded to by an escalated nuclear force reply. This can keep happening until all the missiles are in the air, flying to their destinations.
Is it possible to bypass this block? Say, embedding VPN packets within a different protocol?
I don’t know why some moron downvoted you, but the answer is maybe. For reference, I have always bypassed SSH firewall blocking by sneaking SSH packets within https.
The only way this won’t be possible is if the government enforces installing a certificate to use the internet, so that they can do a man-in-the-middle-attack. I heard this is already being done in Afghanistan.
For simple web browsing or streaming over https you can use a socks proxy.
For full VPN function you could try something like IPSec or L2TP, as they’re not listed in the protocols Russia is targeting.
Is this just address/port blocking, or DPI of some kind? I’m wondering what they can trigger off?
Interesting read: https://www.ntkernel.com/how-to-bypass-egypts-wireguard-ban/
vpn traffic isnt directly hidden, but it can be helped along.
youd need to encapsulate your vpn traffic in a different protocol, make sure you shape your traffic to expected values for that protocol and then avoid known vpn endpoints.
Shadowsocks/ShadowsocksR/vmess/vless/trojan:
