9

Is it possible to detect the use of a VPN in a network?

Let's say that I'm going to use a VPN during my connection in a country where the internet is filtered, and to avoid being monitored I installed OpenVPN on a cloud server or a VPS. Is it possible that the ISP or anyone who is watching the network determines if I'm using a VPN or not based on massive surveillance?

I'm not describing the scenario where the Watchdog knows what to look for or who is doing what, I'm asking about the mass surveillance activity.

1 Answer 1

13

The OpenVPN protocol makes no attempt to hide its presence. The protocol itself is briefly described at the end of the documentation. Note that, even if you manage to obfuscate the protocol itself, it is possible for your ISP to determine that you are using a VPN using traffic fingerprinting. Not to mention, the fact that you are using some sort of tunnel can be inferred from the behavior of only connecting with an encrypted protocol to a single IP address for all of your internet activity.

Traffic obfuscation

There are two primary ways to prevent the protocol from being immediately tagged as OpenVPN traffic, however both methods do not defeat advanced traffic fingerprinting. Additionally, both of these methods require support from both client and server, so random commercial VPNs are unlikely to be compatible with this. The two main ways to limit traffic identification are:

  • Static keys - Normally, OpenVPN establishes a TLS connection with the remote server to exchange temporary session keys which are then used to encrypt the VPN protocol. This key exchange gives away that OpenVPN is being used. Static keys are pre-shared keys that are stored on both the client and server. If they are delivered securely to both sides, then that key can be used directly to encrypt the VPN traffic without any key exchange. To use static keys without losing forward secrecy, you have to enable tls-crypt.

  • Obfsproxy - Developed by the Tor Project, obfsproxy is a type of pluggable transport that transparently obfuscates traffic using a variety of methods. It is designed specifically to make it difficult to identify the protocol being used in order to hamper automatic blocking. While originally designed specifically for Tor, obfsproxy can be used with OpenVPN.

No matter what you do, you will very likely not be able to prevent someone who is analyzing the traffic from discovering that you are connecting through an encrypted tunnel of some kind. You may be able to hide that it is specifically OpenVPN traffic, and you may be able to fool automated machine analysis, but not actual human analysis of the traffic itself. Keep that in mind.

Threat modeling

You should formulate a threat model. Ask yourself why you want to hide the existence of the VPN (avoiding so-called membership attribution). A few general threat models:

  • Avoiding censorship - In some regimes, VPNs are blocked either voluntarily by ISPs or due to extensive government censorship. You may want to obfuscate the protocol in order to bypass the filters and gain unrestricted access to the internet. For this threat model, you need only go far enough to prevent automated detection. If simply running the VPN on a different port is enough, then do just that. If you need to fully obfuscate the traffic to avoid DPI, then do that instead. There is no need to make it hard for human analysis to discover the traffic because no one is going to be monitoring it in real time and actively allowing or blocking a given resource.

  • Looking inconspicuous - You may opportunistically want to give away as little information as possible to your adversary. While giving away all your unencrypted traffic is even worse, why not reduce the information even further and hide the fact that the traffic is encrypted? If your adversary is using automated logging to detect VPN traffic, the solution is the same as the one for avoiding censorship. Simply change your traffic just enough to get past the machines, and you are home free. If you want to protect against manual, human analyists, then you're out of luck, unfortunately. There is no practical way to hide that you are using an encrypted tunnel of some kind to a sapient and educated adversary with access to traffic logs.

  • Avoiding legal issues - In some jurisdictions, the mere use of an encrypted tunnel of any kind can be flat-out illegal. In cases where the penalties are high and the laws are actively enforced, you have a much bigger problem. You should avoid all government-run or sympathetic ISPs. This means using underground networks or wireless networks from nearby countries. You should also either hire a lawyer to get professional legal advice, or at the very least ask some questions on the Law Stack Exchange. While they do not provide legal advice, they can answer certain questions and cite relevant laws to help you improve your understanding.

9
  • Thanks @forest, to prevent the watchdog from discovering my vpn use and the connection to a single IP, I used a virtual machine which is not connected to the VPN but it shares the same IP of my computer with some tools like torrent clients where the client will download/share some open source projects like linux os ... etc, and I used it to visit some websites with random links (I need to make a script to automate this) .... I'll add the Obfsproxy and I'll come back in case that I need some help with this. thanks again,
    – Barttttt
    Commented Jun 13, 2018 at 0:29
  • 1
    Doing that would not help much since the majority of traffic would be going to a single IP (even if it's just a VPS, it becomes obvious that it's a tunnel of some sort since you will be sending request-sized encrypted data to it and receiving response-sized encrypted data with an average delay of the time it takes for a webpage to load). Automating visiting random websites might even stand out because there is no way to perfectly simulate human interaction, even with advanced machine learning techniques (and much less with a simple script).
    – forest
    Commented Jun 13, 2018 at 0:30
  • Why do you need to hide use of the VPN itself? I can understand wanting to prevent automated detection in the case where detected VPNs are simply blocked, but generally it's not a problem to be seen using a VPN. Most governments will just assume you want your privacy or download harmless warez. If you're in a country where using proxies or VPNs is illegal and that law is actually enforced, then you should think much harder about your threat model, not just ask on a QA site.
    – forest
    Commented Jun 13, 2018 at 0:32
  • 2
    @UserXD Are corporate VPNs illegal too? Since you say you will be on a business trip, you might be using a corporate VPN. I sort of doubt they would disallow that since it would prevent many people from running their regular business. I strongly advise you ask on Law.SE whether or not you can use a corporate VPN, if that is what you need to do. In that case, it may be that it is worse to obfuscate the traffic, since you can't claim it's just for business if you are intentionally trying to hide it. If it's obviously a VPN but connected to your company LAN, that's easy to explain to them.
    – forest
    Commented Jun 13, 2018 at 0:45
  • 1
    @forest, in OpenVPN 2.4 they added --tls-crypt option, that encrypts all tls packets with a static key. It preserves PFS property of TLS mode and must greatly reduce amount of unencrypted data for traffic analysis. I haven't checked it yet though.
    – Strigo
    Commented Jun 14, 2018 at 13:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .