Tell HN: Russia has started blocking OpenVPN/WireGuard connections

[itvision]

For the past three days Russians have been unable to use their VPN services working via OpenVPN/WireGuard protocols, and some even have reported that in certain situations SSH connections have stopped working.

The prospect of an isolated Russian interweb has become oh so real.

As a person currently residing in Russia I can confirm that I've been unable to connect to my favourite VPN provider for the past three days, not even its official application works.

I've not seen any discussions on the English-peaking Internet, not it's been in the news for some reasons despite its importance in preserving freedom of information and opinions.

In the Russian internet it's being hotly debated here: https://habr-com.translate.goog/ru/companies/xeovo/articles/...

More on the topic: https://torrentfreak.com/tag/russia/

[someotherperson]

Unfortunately, thanks to the Great Firewall of China, there has been a lot of resources put in to fingerprint VPNs and block them by state actors.

Fortunately, however, there is equally years of some of the smartest minds on the planet working to bypass Chinese censorship, so there are some great OpenVPN alternatives.

I really encourage you to look into something like Shadowsocks which Chinese people have found great success in using over the last several years.

In your case, however, it's worth mentioning that if you can't connect at all then it's likely they've blocked the commercial IPs of the VPN nodes.

It's quite sad that projects like Streisand[0] were archived, but I'm sure there are other alternatives that might make it just as easy to roll onto a server.

[0] https://github.com/StreisandEffect/streisand

[circularfoyers]

Outline (https://getoutline.org) is even easier to deploy than Streisand in my experience and uses Shadowsocks.

[erebe__]

Shameless plug, there is also wstunnel (i am its author) https://github.com/erebe/wstunnel/, hope you enjoy.

[feedforward]

Should point out when people go into the Sturm und Drang of the Great Firewall, that it was largely built by corporate America.

https://www.wired.com/2008/05/leaked-cisco-do/

[8organicbits]

What's the current legal risk of using a VPN in China or Russia these days? I found a couple articles about people getting charged, but none I know to be reputable or particularly well written.

[yellow_lead]

Can anyone confirm Shadowsocks works anymore? When I tried to use it a few years ago, it got blocked in a few days.

To be honest, I think they are blocking anything that exchanges a lot of data with oversesas IPs, after hitting a certain threshold.

[EasyMark]

I imagine that is something that is not "top secret" that Xi can easily share with Putin and something that could be applied almost immediately to routers in Russia. That sucks that Russians can't see other perspectives. It doesn't seem to matter a lot since 80% of Russians still support him mindlessly, but those other 20% can help set a seed of doubt on his atrocities and autocratic lies but not if they can't get info.

[KomoD]

v2ray is a great alternative

[throwbas]

I have the fortune to reside in Russia-controlled Donbas. Over here they have been blocking all WireGuard connections for a long time. OpenVPN seems to be blocked selectively depending on the host. The government and commerce must need it more than WireGuard.

It isn't consistent. Different ISPs block different hosts and protocols at different times. I assume we are a kind of test and staging environment for censorship in Russia.

In the interest of anonymity I am not going to respond to your questions.

[cracrecry]

They called the Chinese to help with their experience like 6 months after the start of the war as they realised some young people could access news outside the official channels.

They have been testing it since then.

In China once their AI systems or whatever decides that you are using a VPN you will be punished by increasingly blocking your Internet for more and more time.

[jvanderbot]

How, technically, can they block wire guard? It can operate as pure UDP on any port. Are we referring to wireguard vendors like tailscale here?

[eptcyka]

OpenVPN looks more similar to regular https traffic, hence its a bit more difficult to fingerprint.

[cf1241290841]

Thank you so much for posting this.

If anyone else has any educated guesses about the mechanism, please do share!

[dang]

[stub for offtopicness]

[Lendal]

You might see some confused faces. To most English speakers "fortune" mostly means good, unless it is preceded by something that specifies that it is bad fortune, like "ill fortune" or misfortune.

[MrDisposable]

Russian here, living in Russia.

My paid VPN provider stopped working months ago. Then my self-hosted Outline server stopped working. Then my self-hosted OpenVPN stopped working too. Both were hosten on Digital Ocean (Frankfurt).

What currently works for me is self-hosted Outline running on an US server, but I suspect that won't last long.

Looks like I have no choice but to learn how to self-host XRay. A smart friend told me that it still works and is hard to block, but unfortunately he has no personal experience with it -- and no need for it anymore, since he emigrated to another country.

Does anyone here have any experience with XRay / XTLS-Reality?

[pilosus]

I’ve written an Ansible playbook [1] to automate XRay installation on a Linux machine. Some people say XRay works well, but I don’t have personal experience.

[1]: https://github.com/pilosus/Xray-ansible

[mmastrac]

As a curiosity, how do you pay for an EU VPS given the sanctions?

[keddad]

I don't believe it is true. They might block commercial solutions, but i'm using Wiregiard with exit point in Netherlands right now, works fine (although on certain providers, I've seen some throttling, but that could just be coincidental)

UPD: I asked some friends, some of them have faced probmes. I guess it is not protocol block, but instead combination of protocol and "suspicious" server. Mine has stuff other then VPN running on it, so it might have flown under the radar.

[_ncyj]

Hey there! Lots of experience with this having lived in China for 2 years. I recommend you look into xray-core or v2ray.

https://github.com/v2fly/v2ray-core

https://github.com/XTLS/Xray-core

Here are my configs: https://github.com/acheong08/notes/tree/main/xray

Why this over WireGuard or OpenVPN or commercial solutions? Because it’s obfuscated and you’re much less likely to get caught. Try hosting a small game server on the same machine as well so the traffic doesn’t look too out of place.

[shebnik]

What is interesting is that since 2022 a lot of sites and host services decided to ban access from Russia. Quite often to a very simple things - nothing related to technology. And I don't remember anybody outside Russia found it crazy. (I am too lazy for VPN and accessed through web.archive.org to the most of the stuff). So, when Russia closes some access it is an attack on the freedom. And when West blocks access from Russia it is protection of the freedom :)

For example, I found about some 'world oldest tree' competition through the news that it banned trees from Russia. Curious enough, I found their site and.... it rejected me by IP.

[lobocinza]

> What is interesting is that since 2022 a lot of sites and host services decided to ban access from Russia.

Same from Brazil though probably way less. I blame Cloudflare, overzealous sysadmins and paranoid Wordpress security plugins.

[khzw8yyy]

"That's different" (tm)

We are supposed to go overthrow Putin to get LinkedIn and Spotify back (or something).

[monday_]

Typing this from Moscow, over OpenVPN. I have been around the country over the last year and am yet to experience protocol-level blocks (although there are credible reports this happened, just not in my experience). It seems like the current wave is about blocking popular providers. Folks with own server, like myself, are not a target so far.

I'd expect the government to cool down expansive internet censorship until the "elections" in March, since hitting the preapproved outcome figures will be harder this way.

[asdffdasasdf]

their heuristics is probably looking for long time connections.. you're scaping by moving the client around

[erebe__]

You can use wstunnel to bypass firewall. I had many feedbacks from chinese/turkish/iranian people using it with success. Easy to setup also with static binaries.

https://github.com/erebe/wstunnel/

[cassepipe]

Maybe it's the right place to advertise Snowflake. It's a browser extension that allows people to bypass Tor censorship if I understood correctly : https://snowflake.torproject.org/

[sega_sai]

Because of the issues with OpenVPN/Wireguard blocking, a few months ago I completely switched to shadowsocks which I think mostly works. But it looks like https://github.com/amnezia-vpn/amneziawg-go -- is the way to go, which is an obfuscated wireguard.

[cedws]

It's worth mentioning that the Russian government has a plan to completely detach the country from the wider Internet. This system has already been tested and is available at the flick of a switch.

Unfortunately, it's probably a matter of time until this system is activated for real and the Iron Curtain drops to the floor. Then Putin will find some way to blame the West and rally against us.

[pinochet2021]

Try SquareX's disposable browser - works for me in China and is basically Remote Browser Isolation but for consumers. It seems free right now - https://www.sqrx.com

[vbezhenar]

Working around DPI blocks is possible as long as you can get your hands on foreign VPS. Just invent your own protocol and use it for yourself. Wrap it with HTTPS or even HTTP, nobody's has resources to analyse every single website protocol.

However some huge ingress/egress traffic to unknown website with few random pages looks very suspiciously. So it's possible to select those websites using statistics analysis.

Now the question to hackers: how do I hide tunnelled traffic so its statistics does not look suspicious?

Ideally one would use some CDN webserver (like cloudflare or amazon), however without encrypted SNI, host is extractable with DPI.

[dijit]

FWIW I stumbled upon the fact that AnyConnect (VPN from Cisco) about 10 years ago could walk over our HTTPS/DPI proxies/firewalls at Ubisoft. Which was mostly interesting because it was Ubi itself using AnyConnect.

In my efforts to use Linux (which is not supported by Cisco) I found "OpenConnect" and it's partner: "OCServe"; which are open source compatible client & server software (respectively) for the protocol

On the wire traffic looks like normal HTTPS traffic, and without the SSL "CONNECT" header which DPI loves to drop as it's known used for proxies and vpn solutions.

YMMV, but it's worked for me with aggressive HTTP proxies in other companies too. :)

[anticensor]

> Working around DPI blocks is possible as long as you can get your hands on foreign VPS. Just invent your own protocol and use it for yourself. Wrap it with HTTPS or even HTTP, nobody's has resources to analyse every single website protocol.

Some firewalls will simply drop those protocols.

[wiml]

That's what "domain fronting" was: you put an innocuous domain in the SNI but a different domain in the Host: header and in some circumstances with some CDNs this would work.

[notarget137]

And here I am writing this post via Wireguard VPN through my home router marking traffic to an outside VPN gate with ease.

[kgeist]

I haven't been able to use my OpenVPN server since August 2023. All connections are reset. Surprised someone could still use it. Perhaps it was rolled out on a per-ISP basis.

[cf1241290841]

Might be a case of me being too stupid to use ctrl + f

But its very much worth mentioning that Russia has totalitarian laws that criminalize the use of vpns.

[azkwxm]

Hello, this project can help you solve some problems, but the problems you have are far more complicated than we imagined, so there may not be a good solution for you.

https://github.com/Useful-open-source-project/Share-vpn-buil...

  OpenVPN/WireGuard, a protocol similar to VPN, has been identified. What we use now is a proxy protocol. It is not probabilistically recognized by VPN protocol operators or firewalls. After all, they can also enter AI to help them improve their firewalls, so we  We also have to find ways to resist or improve our agency agreement so that he is no longer afraid of the firewall.

[jnwatson]

I had a friend recently visit China and he needed access to the real internet and the VPN providers he had used before were blocked.

It took me all of 10 minutes to set up a OpenVPN server in East Asia on DigitalOcean. The container even comes with a client installer that has the parameters preloaded.

Worked fine.

[pvaldes]

Most probably related with the revolts started in the Russian republic of Bashkortostan the last week.

[genman]

The play of elections is also coming.