My ISP blocked a bunch of networks I need to access. I installed VPS (unix box) outside of my ISP's network and I now can build VPN between my home router and VPS, but I want to hide this fact from my ISP.
Here are several approaches and their weaknesses, could you please check my thoughts?
VPNs that work over IP. Their protocols are easy to detect (one needs to check "protocol" field in IP header), although my ISP will not be able to decrypt data, it will know for sure I am using VPN.
- PPTP: Uses GRE
- IPSec: Uses ESP header
Looks like I need application level VPN that will work over TCP and use well-known port to resemble valid traffic. I know 2 of them:
OpenVPN: TLS based, so I can use TCP mode and port 443 and make my ISP believe that I am using HTTPS. But my ISP may try to open website and quickly find that it is not website actually. To fight that, I can use destination nat on VPS to change dest. port for any IP except mine and launch webserver on this port. So, any access to MY_VPS:443 from anywhere will look like regular website. But for me it will act as VPN. I see one trouble here: keeping permanent connection with website may be suspicious for my ISP. I can create website that uses websockets, comet or some other technology to keep permanent connection (for webchat for example) and tell my ISP that this is the reason I have permanent connection.
SSH Tunneling. I do not need to DNAT anything here: my ISP connects to OpenSSH running on my VPS and sees "login:" prompt which is absolutelly legal. I can tell that I am sitting on my remote box via SSH all hight long:) However, traffic patterns differ a lot for character-based SSH (when I simply type commands) and for using it as VPN when I download large files (small HTTP request followed by huge HTTP response). My ISP may use this information. I can try to tell that I am downloading backups from my server via SCP or SFTP. I can also say that I am running X11 client there (ssh X11 forwarding) but it could be treated as kind of VPN. Patterns could be an issue for OpenVPN also, but there I can say that my website has a lot of data to download.
Which one is better? Is it possible for my ISP to use some DPI to find that I am using connection as VPN?