5

The government announced that it will start SNI-based filtering next year. And I also heard that Russian goverment and ISPs implemented it already.

Although Cloudflare & Firefox are testing Encrypted SNI, I think it takes time for ESNI to be applied by most of the websites which are not hosted by Cloudflare. Until then, I and all the others in my country have to use VPN or something.

So I decided to make a program that arbitrarily fragments SNI field so that ISP can not eavesdrop it (using IP fragmentation). I thought that it would be already implemented by someone, but I found that there is nothing related to it. Is it infeasible? Or nobody made it?

enter image description here

Improve this question
2
  • 1
    "The government" Which one?
    – forest
    Commented Dec 5, 2018 at 3:09
  • @forest South Korean government
    – Riddle Aaron
    Commented Dec 5, 2018 at 5:16

1 Answer 1

Reset to default
5

It's unlikely that IP fragmentation will be able to evade SNI-based censorship. The reason is that SNI is part of TLS, not raw IP. This means that it's very likely that the equipment doing deep packet inspection (DPI) will be statefully re-assembling fragmented IP packets before analyzing them. The days of evading firewall restrictions by fragmenting IP addresses is long over.

The only real solution is to use an encrypted or obfuscated proxy or VPN, with the proxy server operating outside of the range of the SNI filter, such as in another country. There will be a slight hit to latency, especially when connecting to South Korean websites, but it is necessary.

Improve this answer
7
  • How about forcing fragmented packets to be transported separately along other routers? Do you think that it is possible?
    – Riddle Aaron
    Commented Dec 5, 2018 at 5:20
  • @RiddleAaron I'm not sure what you mean. You can only have one source and destination IP address, so you can only send packets down one path (well it can vary, but it doesn't affect DPI). Why not use an encrypted or obfuscated proxy? That can evade SNI filtering if the proxy is kept outside of South Korea.
    – forest
    Commented Dec 5, 2018 at 5:53
  • I added a picture above. Isn't it possible that packets are separately delivered through different paths like the picture?
    – Riddle Aaron
    Commented Dec 5, 2018 at 6:22
  • @RiddleAaron No, that's not possible, not without using a tunnel (which is like a proxy).
    – forest
    Commented Dec 5, 2018 at 6:23
  • I see. Of course I can use a proxy, but it is slower than a raw one (like using https)
    – Riddle Aaron
    Commented Dec 5, 2018 at 6:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .