Server access from China

Submitted ⁨⁨2⁩ ⁨weeks⁩ ago⁩ by ⁨abies_exarchia@lemmy.dbzer0.com⁩ to ⁨selfhosted@lemmy.world⁩

From North America, and I’m going on vacation in china for a few weeks. I wonder if anyone knows if I’ll be able to access any of my self-hosted services over zerotier while I’m abroad?

source

Comments

Sort:hotnew top

possiblylinux127@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
I wouldn’t access anything nor would I take any tech with you.

Don’t risk it

source
- Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
  What are the risks, if you aren’t intending on doing anything illegal?
  
  source
  - YiddishMcSquidish@lemmy.today ⁨2⁩ ⁨weeks⁩ ago
    They can load in spyware that follows you outside the country. Also the whole “of you aren’t intending to do anything illegal” but really reads like all the piece of shit bootlicking conservatives after George Floyd.
    
    source
    -> View More Comments
  - possiblylinux127@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
    China isn’t exactly know for rule of law. They could simply decide you are a criminal. When traveling international it is better to play it safe.
    
    source
    -> View More Comments
  - BCsven@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
    You have to install an app on your phone and keep it their during your visit. Some people said they had a full phone scan done on entry. Don’t bring your regular phone bring a burner and don’t login to any of your accounts
    
    source
    -> View More Comments
  - Vanilla_PuddinFudge@infosec.pub ⁨2⁩ ⁨weeks⁩ ago
    *What aren’t
    
    source
philpo@feddit.org ⁨2⁩ ⁨weeks⁩ ago
It depends. Very much. And this is the main problem: There isn’t “one” solution, you will need a few.

The thing with the PRC is: Their great firewall isn’t “one big uniform block”. It’s fairly “variable”.

For example: In Beijing,even 10 years ago, I could access google maps and Facebook without any issues(back then highly blocked) as long as my mobile phone was roaming. The second I was on wifi of course it was blocked. But even the cheapo VPN my colleague had did work out fine. Until the day the police started to prepare for the party convention - then suddenly my colleague couldn’t get out, neither could I with our company wifi and even my carefully crafted wire guard over HTTPs didn’t work - unless I was in the wifi of the hotel or our host company. There it did. Party congress over? Back to normal operations.

If you travel through the country you will find that in one place solution A works, in another solution B. Generally the more rural (or closer to Tibet/Xinjiang/Myanmar) you get, the more restrictive it seems to be.

Personally I would simply get there different commercial VPNs to make sure you have a choice to get out at all - there are various ones with a good PRC reputation. Most providers have trials as well. And then double tunnel through that if you can’t directly reach your usual VPN at home

source
CCMan1701A@startrek.website ⁨2⁩ ⁨weeks⁩ ago
tailscale worked some times, but seemed to depend on the location of the moon relative to the air speed of a nearby sparrow and it was really slow.

source
- MysteriousSophon21@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  Zerotier is similiar - works sometimes but China’s firewall is constantly changing which ports/protocols it blocks, so setup a wireguard server on port 443 as backup (looks like normal https traffic) and test both before you go.
  
  source
alcasa@lemmy.sdf.org ⁨2⁩ ⁨weeks⁩ ago
Look into shadowsocks, or just normal vpn.

Pandafan was quite reliable for me. You might also be able to diy with hk, sg or sk vps instances, but it was a lot of work and a misconfiguration will cut you off.

source
- iopq@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  Normal VPN doesn’t work because they don’t mask themselves. Even Tor bridges don’t work because they are blocked.
  
  Shadowsocks is like 2018 advice, go directly to xray and forget about legacy software
  
  source
  - alcasa@lemmy.sdf.org ⁨2⁩ ⁨weeks⁩ ago
    Yes, xray is better. Forgot about that. I think there had been a couple newer ones.
    
    The thing with gfw circumvention is that even older approaches work surprisingly often, as detection methods change and often detection depends on the amount of suspicious traffic. I had most success with a more conventional setup on a vps, but that was more for testing out stuff. Found commericial providers to be more reliable.
    
    VPNs work surprisingly often from what others tell me. They only block these occasionally. I think astrill and express often work. Just know that the ones that work, probably have chinese govt access.
    
    Yes, tor never works.
    
    source
  - Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
    They worked for me most of the time. They cut off after like an hour of use. So I just switch between them.
    
    source
    -> View More Comments
socsa@piefed.social ⁨2⁩ ⁨weeks⁩ ago
At first, it will probably work. But you will likely lose access after a few days and your servers will be scanned for exploits, so make sure your shit it up to date.

Source: hosted an XMPP server which was summarily banned after 2 days of access from, China and then probed/attacked repeatedly until I took it offline.

source
- GreenKnight23@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  almost like going to China is a mistake…
  
  source
ag10n@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
What you’re asking is illegal where you’re going

Best of luck to you

source
- abies_exarchia@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
  Is it illegal to backup my photos to the NAS in my house? I’m not even attempting to access banned services
  
  source
  - ag10n@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Bypassing the GFW is illegal
    
    source
  - greyfox@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Unauthorized VPNs (non government approved) are illegal in China. If a business needs their own they can get approval but they have to apply for those exceptions.
    
    It isn’t really enforced, probably especially so for non citizens, but if you do something they don’t like it is something they could use against you.
    
    You would probably be less breaking the law to just directly open up SSH and access that instead of tunneling through a VPN. Even though SSH can do tunneling of its own.
    
    source
  - kristoff@infosec.pub ⁨2⁩ ⁨weeks⁩ ago
    You mean "copy the photos you have taken but you not want in your device if you would get checked on your way back out to a server in a hostile country " ?
    
    99.99% if the normal tourists do not have a personal server to store their photos. They use a commercial cloud. By using your personal server, you behave differently from 99.99% of the tourists.
    
    " Why do you keep your images to your personal server and not the cloud? What do you have to hide? "
    
    source
- iopq@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  You realize not only Google is blocked, but also Brave search, duckduckgo, everything but Russian and Chinese search engines? You can’t find anything on them except scams and SEO spam
  
  source
  - ag10n@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Yes, I do know and realize that. Why it’s probably not a good idea to try connecting to your homelab lol
    
    source
    -> View More Comments
  - Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
    I found deepseek was good for using as a search engine. Lol.
    
    source
- Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
  Not really. It’s a grey area. They don’t care about foreigners using vpns at all. It’s kind of expected. Foreign SIMs don’t even face blocks on mobile networks. If you’re going to a sensitive province of China, I think they’ll care slightly more, but as long as you’re not using the VPN to do something illegal, you’ll be okay.
  
  source
BaroqueInMind@piefed.social ⁨2⁩ ⁨weeks⁩ ago
People posting here don't realize that CN gov IDs and allows certain traffic to get rerouted through a certain VLAN so they can do DPI and record every packet through a beefy expensive tap device to analyze the telemetry and build a case against you. If they so choose.

Don't bring in any tech, don't access your personal net back home, don't expect any level of actual privacy or good intentions. Just do your business and keep your digital digital persona minimal while there.

source
- BuoyantCitrus@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
  
  they likely have the capability to trivially decrypt TLS
  
  Whoa. Anywhere to read more about this? Had not been paying close attention, didn’t realise that was so starkly the case.
  
  source
  - BaroqueInMind@piefed.social ⁨2⁩ ⁨weeks⁩ ago
    China blocks newer TLS and forces a TLS downgrade of a version they have decryption capabilities of - https://www.f5.com/labs/articles/threat-intelligence/the-2021-tls-telemetry-report
    
    More info - https://gfw.report/publications/usenixsecurity23/en/
    
    More - https://www.scmp.com/news/china/politics/article/2167240/chinese-police-get-power-inspect-internet-service-providers
    
    Chinese cryptography law mandates packet inspection and supervison of all foreign telemetry - https://link.springer.com/chapter/10.1007/978-3-031-11252-2_4 https://en.m.wikipedia.org/wiki/Cryptography_law
    
    source
    -> View More Comments
- Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
  Case against you for doing what exactly? Just don’t break the law. It’s not hard.
  
  source
  - BaroqueInMind@piefed.social ⁨2⁩ ⁨weeks⁩ ago
    Extremely privileged of you to think that one can simply live a routine life thinking they are safe, while immigrants in the US aren't breaking the law and still getting rounded up into concentration camps.
    
    source
    -> View More Comments
  - SheeEttin@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
    Or would be a useful hostage to trade for a Chinese person held in OP’s country.
    
    en.wikipedia.org/…/Detention_of_Michael_Spavor_an…
    
    source
    -> View More Comments
- amino@lemmy.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
  as long as you factory reset a google pixel before leaving, why wouldn’t you bring that with you?
  
  AFAIK it’s possible to detect government tampering by using GrapheneOS’ Auditor
  
  source
Ptsf@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Bringing non-disposable technology to China is a mistake in most circumstances.

source
TehNomad@piefed.social ⁨2⁩ ⁨weeks⁩ ago
As another user posted, how strict the firewall is depends on where you are (and if there are any special events). I heard that Wireguard doesn't work because of deep packet inspeciton, but I was able to use Tailscale to my home network without problems when I was there last year. I also set up a xray vless-reality proxy on a VPS and Outline servers on Google cloud and those worked too.

But the easiest method is to buy an HK eSIM for roaming (I used 3HK). I bought a month of LetsVPN but they booted me from the service for some random reason, so I changed to Mullvad which also worked too.

source
Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
If you will be using roaming for mobile data in China, you won’t face any blocking.

Accessing over cloudflare tunnels or just a normal exposed server works.

VPNs work sometimes

source
Konraddo@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Don’t make any connection to your home server, period.

source
yaroto98@lemmy.org ⁨2⁩ ⁨weeks⁩ ago
From what I’ve read if you use a VPN it’s pretty simple to get past the great firewall of china. It’s also only technically illegal, and not really punished.

source
- iopq@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  Well, no, if you open a wireguard connection it well just get dropped in a minute. You need to do a lot more work than that
  
  source
- alteredEnvoy@sopuli.xyz ⁨2⁩ ⁨weeks⁩ ago
  Doesnt it also depend on the type of VPN and the providers?
  
  source
Treczoks@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
I would not try to access a server from China. Can’t you let someone else take care of the machine in the meantime? It’s always a good idea to have some backup admin just in case.

source
real_jiakai@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Maybe it is possible, maybe not. GFW may interfere with zerotier connections.

If that doesn’t work, you can consider using Alibaba Cloud’s HK server for transit.

source