0

Countries such as China are known for blocking VPN connections, which causes a lot frustration for residents and temporary visitors alike. However China doesn't (yet) apply a white-list mode to outgoing traffic, so it's possible to connect to any regular website that is not on the ban list.

So why doesn't VPN software simply mask itself as HTTPS packets? This would force entities like China to either block all HTTPS traffic or employ extremely unreliable pattern analysis on all HTTPS traffic. Traffic could even be masked as HTTP packets, with the secure data being encoded into fake image or video files, which would make it even harder to block.

Improve this question
4
  • 3
    What makes you say that packet pattern analysis is extremely unreliable?
    – Jenessa
    Commented Jan 29, 2017 at 14:07
  • @Jenessa it would be hard to block VPN traffic obfuscated as HTTPS without also blocking a bunch of normal websites
    – JonathanReez
    Commented Jan 29, 2017 at 14:56
  • 1
    @JonathanReez what makes you thing that a zero false-positive rate is a requirement? You can wait until you're reasonably sure that a particular user is using VPN masked as HTTPS and then block everything for that user and for that HTTPS service and/or visit the user in person.
    – Peteris
    Commented Jan 29, 2017 at 15:41
  • A TLS-VPN and a HTTPS-VPN look the same to a packet capturing intermediate. Just run your VPN Endpoint on 443. (No matter if you tunnel through TLS or HTTPS you can detect rogue VPNs with traffic analysis)
    – eckes
    Commented Jan 29, 2017 at 16:14

3 Answers 3

Reset to default
3

Actually we do have these kind of protocols and they work pretty well. One example is called "shadowsocks". The spec can be found here: https://shadowsocks.org/en/spec/protocol.html. Its main goal is simply obfuscate TCP/UDP packets into random traffic by very simple encryption, so that the GFW cannot recognize any pattern but some random bytes. It's very flexible with many "ciphersuites" to choose from.

A variant of shadowsocks is called shadowsocks-rss, which allows more obfuscation mechanism, including disguises traffic as TLS. Shadowsocks and shadowsocks-rss are the very few protocols can be used efficiently in China to bypass GFW. Moreover, these protocols and their implementations are open source on Github.

Improve this answer
1

Because one of the basis of modern (well at least for 30 years) networking is the concept of layers. The role of a VPN is to encapsulate network traffic to allow to remote sub-networks connected through en uncontrolled network behave as is they were locally connected. No more no less.

But there are other projects that allow to hide a network stream in a tunnel encapsulated in a HTTP conversation. Some example of those have been discussed in that SO question.

Technically, it is possible to encapsulate a full VPN flow inside a HTTP(S) tunnel. But I must admit that I do not know a full out of the box solution. Maybe because there are not that much acceptable use cases for it: VPN are highly used to joint corporate networks so you can find plenty of references of that. But HTTP tunneling sounds like I know you do not want me to do that so I'll just hide it. And then the problem instantly passes from the technical side to the legal one...

And even if the traffic might use correct HTTP(S) requests and responses, it is likely to have slight differences in request sizes and delays that allow heuristic methods to discover it. Once it is detected it can be a matter of hours for the police to arrive. I would never use that in a country like China!

For temporary residents, a solution would be to setup a private VPN before going to China, and then simply use it. If it only carries little traffic it should not be banned.

Improve this answer
2
  • VPNs are legal in China, they just keep getting blocked often.
    – JonathanReez
    Commented Jan 29, 2017 at 15:38
  • @JonathanReez I just meant that using too complex tools can be seen as a hint that you are actually trying to hide serious things, and as such can attract attention.
    – Serge Ballesta
    Commented Jan 29, 2017 at 15:46
0

Any protocol needs to be understandably on both sides. You could wrap every protocol in any other, but the VPN you are connecting to has to know. How would you tell? This maybe could be solved with TLS (https), okay. It just needs somebody who wants develop and spread such a protocol oh, and there is addition overhead: on CPU and on bandwidth

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .