Hacker News new | ask | show | jobs
by rsy96 3905 days ago
How is this different from a VPN over UDP, like OpenVPN or Cisco Anyconnect?
4 comments
fenesiistvan 3905 days ago
In some countries all VPN is blocked (so the ISP will simple block the stream if standard VPN headers are detected).

These kind of tunnels allows custom, obfuscated protocols.

link
A010 3905 days ago
> It's useful to avoid Internet restrictions

It's used to bypass DPI where known VPN softwares are already filtered.

link
eps 3905 days ago
How many providers have DPI filtering for select apps on unauthenticated connections? Exactly zero.
link
A010 3905 days ago
I don't know. But where I'm working, I have to register my company's VPN traffic (DST IP addr) to pass their (state owned company) filter. Edit: Not in China.
link
PinguTS 3905 days ago
Exactly, that was my first thought. I have an OpenVPN endpoint on different ports over UDP and TCP available.

My experience is, that UDP is also blocked like TCP. The only possible work around is then IP over DNS, which works but with very very limited bandwidth.

link
noselasd 3905 days ago
On cellular networks, my experience is that everything on port 53 is hijacked and shipped off to a telco DNS server though.
link
fenesiistvan 3905 days ago
> The only possible work around is then IP over DNS

What about tunnel over HTTP? That can be much better obfuscated. Tunnel over DNS can be easily filtered out by just checking for the traffic amount (for example to block VoIP the ISP should just degrade DNS if traffic amount is above a treshold for a user)

link
callesgg 3905 days ago
It is easier to hack and make small changes i presume.
link