<story><title>How great is the great firewall? Measuring China’s DNS censorship [pdf]</title><url>https://www.usenix.org/system/files/sec21-hoang.pdf</url></story><parent_chain><item><author>dmos62</author><text>I was setting up a self-hosted VPN to work-around GFW. I tried everything. Some solutions would sort of work, but unreliably, with extremely minimal bandwidth and would suddenly stop working after some time. I can&amp;#x27;t remember the combinations of transport and obfuscation tech that I tried, but they were considered best bets at the time. I would be very interested in finding out how commercial offerings do it. I&amp;#x27;m not comfortable using them, since chances are that they&amp;#x27;re honeypots.&lt;p&gt;Funnily enough I traveled to another part of China then, and the Airbnb wifi had practically no GFW-type blocking. GFW is made up of local or provider-specific implementations that vary a lot. It was a small, rural town.</text></item></parent_chain><comment><author>nirui</author><text>The ecosystem of secure proxies are pretty advanced in China (Thanks to, you know ...), you can setup a home router that selectively reroute traffic through different proxies automatically and transparently based on latency, target IP and domain etc.&lt;p&gt;Since Airbnb is international, I guess if someone (assuming it&amp;#x27;s a small private operation) is offering rental service there, they might as well setup a proxy for foreign guests.&lt;p&gt;&amp;gt; Some solutions would sort of work, but unreliably, with extremely minimal bandwidth and would suddenly stop working after some time&lt;p&gt;The sad part is, anti proxy technology is also fairly advanced. Most of well-known VPN protocols such as OpenVPN, AnyConnect, IPSec and Wireguard etc can be identified via traffic analyze, once GFW detects suspicious traffic, it may launch probes to further investigate the service. That&amp;#x27;s why Chinese people use Shadowsocks, Clan and V2Ray, those proxies are designed to protect itself from these situations.&lt;p&gt;Shadowsocks and V2Ray require some know-hows to correctly setup. Notably, Shadowsocks requires AEAD ciphers to be relatively safe, and you should never run Tor through it due to flaws in it&amp;#x27;s transport protocol. As for V2Ray, avoid VMESS protocol since it&amp;#x27;s is known to be vulnerable to probe attacks.</text></comment>
<story><title>How great is the great firewall? Measuring China’s DNS censorship [pdf]</title><url>https://www.usenix.org/system/files/sec21-hoang.pdf</url></story><parent_chain><item><author>dmos62</author><text>I was setting up a self-hosted VPN to work-around GFW. I tried everything. Some solutions would sort of work, but unreliably, with extremely minimal bandwidth and would suddenly stop working after some time. I can&amp;#x27;t remember the combinations of transport and obfuscation tech that I tried, but they were considered best bets at the time. I would be very interested in finding out how commercial offerings do it. I&amp;#x27;m not comfortable using them, since chances are that they&amp;#x27;re honeypots.&lt;p&gt;Funnily enough I traveled to another part of China then, and the Airbnb wifi had practically no GFW-type blocking. GFW is made up of local or provider-specific implementations that vary a lot. It was a small, rural town.</text></item></parent_chain><comment><author>mrjin</author><text>Your description of the symptom was more or less the same with my personal experience, but the conclusion might be a little bit off IMO. I first tried to deploy proxies to google app engine and use PAC scripts to auto switch between them. It was super fast and worked for ONE day. I really meant one day here, the whole thing stopped working the next day obviously the maneuver was detected and busted. Then I tried both public and commercial VPN services but all of which were either unstable or slow, or even both. At the same time, I almost never had any problems with corporate VPNs but I did not want personal stuff to go through company networks so I hardly used them unless had no choice. Things did not change much until AWS&amp;#x2F;Azure emerged. I almost immediately deployed an Azure VM dedicated for VPN when it&amp;#x27;s available to my MSDN subscription. I was pretty comfortable with it as even if my VM got blocked, I could actually redeploy it to a different region in minutes. It turned out I worried too much, I never had any drama with it since I kept very low profile and the VPN was really for myself only.&lt;p&gt;DNS pollution was for sure only one means of the blocking. Even if the IP address of the site got resolved correctly, the site could not reached as a result of &amp;quot;Connection reset&amp;quot; or &amp;quot;Remote host closed the connection&amp;quot; errors. I thought the blocking was all the time and everywhere until I accidentally realized that I had just access some site without VPN connected and such state could last for from hours to days, as long as I did not access contents deemed sensitive, sites did not seem to matter that much as blocking would not be triggered until I clicked some links. HTTPS did not seem to help at all, so GFW must have the ability to do deep packet analysis. Such behaviors make sense to me as the network traffics in China are enormous even the government would not have enough resource to monitor everything all the time, so the practical approach would be using a little bit of heuristics and commencing blocking only when certain signals were triggered. Also I encountered a couple of times man-in-the-middle attacks as I noticed my browser were not happy with the site&amp;#x27;s certificates. Such attack might be carried out by the ISP as the certificates were self signed.</text></comment>