Open Menu
AllLocalCommunitiesAbout
lotide
AllLocalCommunitiesAbout
Login

Russia starts blocking VPN at the protocol (WireGuard, OpenVPN) level

⁨1031⁩ ⁨likes⁩

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨simple@lemm.ee⁩ to ⁨technology@lemmy.world⁩

https://vpncentral.com/russia-starts-blocking-vpn-protocols/

source

Comments

Sort:hotnewtop
  • cman6@lemmy.world ⁨1⁩ ⁨year⁩ ago

    In case anyone wondered how to potentially get around this…

    • Pay for a server in another country that gives you SSH access
    • Create SSH SOCKS tunnel: ssh -N -D 8008 your-server-ip
    • Open your browser and set the SOCKS server to localhost:8008 (in Chromium/Firefox you can search for this in Settings)
    source
    • tal@kbin.social ⁨1⁩ ⁨year⁩ ago

      So, that's definitely better than nothing, but your browser isn't the only thing -- though these days, it is a very important thing -- that talks to the Internet. If, for example, you're using a lemmy client to read this, I'd bet that it's good odds that it doesn't have SOCKS support.

      Though I wouldn't be surprised if someone has made VPN software that intercepts connections and acts as a proxy SOCKS client, which would make it work more like a traditional VPN, though maybe with a performance hit.

      googles

      Yeah, okay, looks like stunnel can do this on Linux.

      source
      • SpaceCowboy@lemmy.ca ⁨1⁩ ⁨year⁩ ago

        North Korea does prove that it’s possible to take a society there.

        I don’t think NK took themselves there, they were already there when the internet was invented. Easier to limit access to few people when you have draconian measures in place when access becomes possible.

        Having a society that already widely has access to one that has extremely limited access is a lot more difficult.

        source
        • -> View More Comments
    • petrich0r@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Unfortunately it would be trivial to block an SSH tunnels like this. I recall reading news 10 years ago (maybe even earlier) some foreign journalist tried this at a Beijing hotel room and got shut down in minutes. That was when people are still using PPTP and L2TP protocols to get around censorship, Wireguard and shadowsocks wouldn’t be born for another couple years.

      source
      • MooseBoys@lemmy.world ⁨1⁩ ⁨year⁩ ago

        trivial to block an ssh tunnel like this

        Far from trivial unless you’re willing to brick ssh completely, or at least cripple a bunch of non-VPN uses for tunneling. Of course it’s trivial to just block ssh outright, or block tunneling above a certain bandwidth. But that would also block, as an example, most remote IDE sessions, loopback-only server management frontends, etc.

        source
        • -> View More Comments
    • DefinitelyNotBirds@lemmy.world ⁨1⁩ ⁨year⁩ ago

      This is actually pretty interesting, thanks for sharing. Although i live in a third world country that doesnt care about anything at all including piracy, but this tunneling thing looks pretty handy

      source
    • Jaysyn@kbin.social ⁨1⁩ ⁨year⁩ ago

      I'm not 100%, but I think you could set this up for free with an Oracle AlwaysFree tier VM.

      (Boo Oracle, yes I know. Still very handy.)

      source
      • DAMunzy@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Just looked up Oracle Always Free… Good to know about, thanks!

        source
    • droans@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Couldn’t you also just set the VPN to use port 443?

      source
  • eran_morad@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Shithole country

    source
    • SpicyPeaSoup@kbin.social ⁨1⁩ ⁨year⁩ ago

      Worse: shithole country that turns everything they touch into shit too.

      source
      • DragonTypeWyvern@literature.cafe ⁨1⁩ ⁨year⁩ ago

        Bootlicking simply comes naturally to the Russian culture.

        source
        • -> View More Comments
  • neuromancer@lemmy.world ⁨1⁩ ⁨year⁩ ago
    [deleted]
    source
    • fluxion@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Blocking all encrypted traffic… fantastic suggestion comrade, I’ll forward this on to the Kremlin. Also, you’ve been drafted.

      source
      • raytch@lemmy.world ⁨1⁩ ⁨year⁩ ago

        I suppose with “comrade” you are hinting at Soviet customs, but Russia isn’t the USSR and couldn’t be further from being socialist

        source
        • -> View More Comments
    • raltoid@lemmy.world ⁨1⁩ ⁨year⁩ ago

      It’s a custom protocol that uses SSL/TLS, so it can be detected. It’s actually causing huge problems for many large Russian companies, as many use those protocols for remote access, work, etc.

      As mentioned in the article you need something like “Shadowsocks”, which fully disguises the traffis as standard SSL/TLS.

      source
    • ladel@feddit.uk ⁨1⁩ ⁨year⁩ ago

      SSL is a higher layer thing, isn’t it? A VPN is just encapsulating an IP packet in another IP packet and getting it the tunnel endpoint. Unless the whole of the IP packet is encrypting, the service provider could just sniff your packets and block anything that looks like an IP packet in the outer packet payload?

      source
      • tal@kbin.social ⁨1⁩ ⁨year⁩ ago

        Unless the whole of the inner IP packet is encrypted,

        It is, because they're inside an encrypted stream of data.

        The way OpenVPN works is this:

        1. OpenVPN establishes a TLS connection to the OpenVPN server.

        2. Your computer's kernel generates an IP packet.

        3. OpenVPN sucks that up, shoves it into the TLS connection. That connection is encrypted, so the network provider cannot see inside it, know whether the data is IP packets or anything else, though I suppose maybe traffic analysis might let one classify a connection as probably being a VPN.

        4. The data in that connection is broken up into IP packets, went to the OpenVPN server.

        5. The OpenVPN server decrypts the data in the TLS stream, pulls the original IP packets out.

        What @raltoid is saying sounds plausible, though I can't confirm it myself -- that OpenVPN is detected by looking at somehing unique in the initial handshake.

        source
        • -> View More Comments
    • tool@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Is OpenVPN not just SSL traffic?

      It’s not, it’s an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it’s not the same protocol and can be differentiated that way.

      A way around this would be to run an SSLVPN with a landing page where you log in instead of using an IPSec VPN or a dedicated SSLVPN client.

      source
      • tal@kbin.social ⁨1⁩ ⁨year⁩ ago

        Is OpenVPN not just SSL traffic?

        It’s not, it’s an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it’s not the same protocol and can be differentiated that way.

        I think that either I'm misunderstanding what you're aiming to say, or that this is incorrect.

        OpenVPN can run over UDP or TCP, but it's not IPSec.

        source
    • zerbey@lemmy.world ⁨1⁩ ⁨year⁩ ago

      There’s still headers and it’s fairly trivial to block using packet analysis. Using other protocols such as SSH tunneling may work (until they try to ban that I suppose). There’s always way around these kind of blocks, it’s a cat and mouse game.

      source
    • AES@lemmy.ronsmans.eu ⁨1⁩ ⁨year⁩ ago

      Yes there is a difference between https traffic.

      source
  • avater@lemmy.world ⁨1⁩ ⁨year⁩ ago

    using a vpn is also illegal in russia since 2017 😅

    source
    • gapbetweenus@feddit.de ⁨1⁩ ⁨year⁩ ago

      But also laws don’t really matter in Russia.

      source
      • avater@lemmy.world ⁨1⁩ ⁨year⁩ ago

        well 😅

        source
    • Axiochus@lemm.ee ⁨1⁩ ⁨year⁩ ago

      I’d appreciate a source for that statement. :o

      source
      • avater@lemmy.world ⁨1⁩ ⁨year⁩ ago

        In November 2017, the Russian government passed a law banning the use of VPNs, Tor, and proxies to access unauthorized content. Since that time, it has been used to restrict specific VPN services.

        The ban targets VPN providers who refuse to submit data to the Russian government. The threat of bans came in 2019. Two waves of bans followed in 2021, covering 15 VPNs. Only one Russia-based provider is known to have complied with the rules.

        surfshark.com/blog/vpn-in-russia

        reuters.com/…/us-russia-internet-idUSKBN1AF0QI

        www.bbc.com/news/technology-41829726.amp

        source
        • -> View More Comments
    • a_spooky_specter@lemmy.world ⁨1⁩ ⁨year⁩ ago

      This is not accurate information. VPN usage is not banned.

      source
    • Ildar@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Using is not illegal

      source
      • avater@lemmy.world ⁨1⁩ ⁨year⁩ ago

        if you want to use it in its original purpose it’s illegal. If you use a von not registered with Roskomnadzor, it’s illegal because you can access stuff that putin does not want you to see.

        source
        • -> View More Comments
  • originalucifer@moist.catsweat.com ⁨1⁩ ⁨year⁩ ago

    annnd another dictatorship box checked off the list... wont be long now

    source
    • bufordt@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

      Until what? Until Russia is a dictatorship? That ship sailed a long time ago.

      source
      • fluxion@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Won’t be long before Putin catches up to Kim Jong Un in the Oppression Olympics

        source
        • -> View More Comments
      • DragonTypeWyvern@literature.cafe ⁨1⁩ ⁨year⁩ ago

        Until he stops pretending?

        source
        • -> View More Comments
  • Honytawk@lemmy.zip ⁨1⁩ ⁨year⁩ ago

    But how are their propaganda farms going to be able to pretend they are in your country now?

    source
    • Ubermeisters@discuss.online ⁨1⁩ ⁨year⁩ ago

      They still get to operate don’t worry!!

      source
    • avater@lemmy.world ⁨1⁩ ⁨year⁩ ago

      official companies are still able to use vpn 😏

      source
    • AndyLikesCandy@reddthat.com ⁨1⁩ ⁨year⁩ ago

      Exemptions that only apply rules to the common people. Maybe device registration with an exception using ipv6 address

      source
  • HootinNHollerin@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

    Proton vpn has a feature that can be turned on for oppressive governments, ‘alternate routing’ I believe. Would that be sufficient or no?

    source
    • eroc1990@lemmy.parastor.net ⁨1⁩ ⁨year⁩ ago

      Theoretically, yes, since there are options other than WG/OVPN available through Smart Protocol, which Alternate Routing leverages.

      source
  • biblbrox@lemmy.world ⁨1⁩ ⁨year⁩ ago

    I live in Russia and I have vps with wireguard vpn in Netherlands. At the current moment it works for me pretty well except the some connection failures two days ago. But they were very short. But I don’t know how long my vps will be accessible with these fucking restrictions.

    source
    • godless@lemmy.world ⁨1⁩ ⁨year⁩ ago

      You might want to sign up with astrill. Greetings from China, we’ve been dealing with this shit for decades.

      source
      • biblbrox@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Thanks for advice. I didn’t hear about it before. It will be my backup plan.

        source
    • Nanabaz2@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Can you confirm that it is still working fine on normal home internet but not on cellular data? Have been back to Russia multiple times per year (family reasons) and none vpn ever works on cellular network. Some work at home and places.

      My own vpn is to my house in different country. Wireguard. That has always been working over home wifi here (not cellular). Even until now.

      source
      • biblbrox@lemmy.world ⁨1⁩ ⁨year⁩ ago

        For now it works in mobile data and home provider both. My mobile operator Tinkoff. The home Internet provider - City Telekom. But sometimes it losses connection to several minutes. But generally it works well.

        source
    • Aux@lemmy.world ⁨1⁩ ⁨year⁩ ago

      It will be blocked soon. Go read here what to do habr.com/ru/articles/731608/

      source
  • Grant_M@lemmy.ca ⁨1⁩ ⁨year⁩ ago

    Russia is a terrorist state. #SlavaUkraini #ArmUkraineForVictory

    source
    • lemming007@lemm.ee ⁨1⁩ ⁨year⁩ ago

      I love all my fellow Russians and Ukrainians who rise above the brainwashing that this commenter is demonstrating.

      Fuck patriotism and slogans, that’s what politicians want you to do to die for them. All wars would be over in a day if people just realized this as politicians can’t fight their wars without people like this commenter.

      source
    • vacuumflower@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

      Russia is less terrorist than Azerbaijan, but the latter isn’t even being sanctioned (and there’s been an ICJ decision against them, but everybody ignores it) for starving out a little country of 120k people right now in a medieval siege, and openly stating that they are doing exactly that.

      I don’t think Ukraine has lots of problems. At least the aggressor there is recognized for what it is and the victim is recognized for what it is and armed by half the world.

      I don’t think Ukraine deserves any attention, in fact, since in Artsakh they support Azerbaijan. Support of now finally actual genocide happening is what makes me think that.

      source
      • FaeDrifter@midwest.social ⁨1⁩ ⁨year⁩ ago

        Russian likes to threaten the world with nukes - nuclear war would inevitably lead to a nuclear holocaust that would cause the near extinction of the human species.

        I don’t give a flying fuck about Azerbaijan. Russia is terrorizing the entire species of humanity. Until you’re threatening to wipe out the entire planet, you are not a terrorist on the same level as Russia.

        source
        • -> View More Comments
      • nomadjoanne@lemmy.world ⁨1⁩ ⁨year⁩ ago

        I think Ukraine is a western puppet. But that doesn’t mean Russia isn’t also shit.

        source
        • -> View More Comments
  • falkerie71@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

    Now comes the Great Russian Firewall.

    source
  • breakerfall@lemmy.world ⁨1⁩ ⁨year⁩ ago

    ProtonVPN has a “stealth” protocol. Does anyone know if that breaks through?

    source
    • pipes@pawb.social ⁨1⁩ ⁨year⁩ ago

      protonvpn hasn’t worked here at all for a long time now lol

      source
    • godless@lemmy.world ⁨1⁩ ⁨year⁩ ago

      It doesn’t work in China, if that’s any indication.

      source
    • Nanabaz2@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Absolutely doesn’t. Even tried to go like 100 servers to see.

      But nothing related to proton get through

      source
  • tal@kbin.social ⁨1⁩ ⁨year⁩ ago

    I am pretty confused by the article.

    What I'd expected based on what I've seen so far was that the Kremlin would not care what protocols are used, just whether the a given VPN provider was in Russia and whether it provided the government with access to monitor traffic in the VPN.

    So, use whatever VPN protocol you want to talk to a VPN provider where we can monitor or block traffic by seeing inside the VPN. You don't get to talk to any VPN providers for which we can't do that, like ones outside Russia, and the Russian government will do what IR can to detect and block such protocols.

    But that doesn't seem to fit with what the article says is happening.

    The media in Russia reports that the reason behind this is that the country isn’t banning specific VPNs. Instead, it’s putting restrictions on the protocols these services use.

    According to appleinsider.ru, the two protocols that are subject to the restrictions are:

    • OpenVPN
    • WireGuard

    A Russian VPN provider, Terona VPN, confirmed the recent restrictions and said its users are reporting difficulties using the service. It’s now preparing to switch to new protocols that are more resistant to blocking.

    I don't see what blocking those protocols internal to Russia buys the Kremlin -- if Terona conformed to Russian rules on state access to the VPN, I don't see how the Kremlin benefits from blocking them.

    And I don't see why Russia would want to permit through other protocols, though maybe there are just the only protocols that they've gotten around to blocking.

    source
  • callmepk@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Shadowsocks/ShadowsocksR/vmess/vless/trojan:

    Image

    source
  • Ildar@lemmy.world ⁨1⁩ ⁨year⁩ ago

    It was not working 2 day on mobile operators, now waiting full shutdown

    source
  • egeres@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Is it possible to bypass this block? Say, embedding VPN packets within a different protocol?

    source
  • rustydomino@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Can someone explain from a technical standpoint how they can block OpenVPN running on port 443? my admittedly limited understanding is that port 443 is the common port for https. If they blocked that port wouldn’t that mean that they would be blocking nearly the entire internet?

    source
  • wewbull@feddit.uk ⁨1⁩ ⁨year⁩ ago

    Is this just address/port blocking, or DPI of some kind? I’m wondering what they can trigger off?

    source
  • daveydee@midwest.social ⁨1⁩ ⁨year⁩ ago

    Couldn’t you just use any server/droplet/AWS instance via SSH to get around this law? Seems much simpler.

    source
  • BloopWut@lemmy.world ⁨1⁩ ⁨year⁩ ago

    OpenVPN + obfs4proxy should still work. I’ve been using it in China for some time along with a VPN client on Android & windows that support obfs3.

    source
  • lud@lemm.ee ⁨1⁩ ⁨year⁩ ago

    !chapotraphouse@hexbear.net will love this.

    After a discussion that lasted for way too long, it appears that they like censorship.

    They think that this is a perfectly reasonable argument: youtu.be/QFgcqB8-AxE and that the government knows better and thus information should be suppressed.

    Absolutely ridiculous…

    source
  • vacuumflower@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

    This has been happening intermittently since 2012 or something.

    Not wg, cause it wasn’t popular then.

    HTTP\HTTPS tunneling etc are not that hard, ya knaw.

    Or encrypted GRE, ffs.

    source
  • martinkostov@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Curious if anyone living there has tried Windscribe Stealth protocol?

    source
  • Grant_M@lemmy.ca ⁨1⁩ ⁨year⁩ ago

    It would only take 1% of the population to oust putler’s fascist regime. 1%

    source
  • Antimutt@lemmy.world ⁨1⁩ ⁨year⁩ ago

    However will they get messages through??

    source
  • masterairmagic@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

    Can this actually work? If you run Wireguard on a non-default port, is it possible to tell that it’s wireguard?

    source
  • RVGamer06@lemmy.world ⁨1⁩ ⁨year⁩ ago

    As long as it doesn’t learn to block TOR via snowflake, there’s still hope.

    source
  • ryannathans@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Use scramble features

    source
  • jeanma@lemmy.ninja ⁨1⁩ ⁨year⁩ ago

    how long before our beautiful UE thinks about doing the same?

    source