| ▲ | doix 9 days ago |
| I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governments just block well known VPN providers and a small individual server is fine. It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use. |
|
| ▲ | bryanlarsen 9 days ago | parent | next [-] |
| We've had success using wireguard over wstunnel in places where wireguard is blocked. https://github.com/erebe/wstunnel |
| |
| ▲ | vehemenz 9 days ago | parent [-] | | This looks great, thanks. | | |
| ▲ | bryanlarsen 9 days ago | parent [-] | | I should have mentioned that our use case isn't avoiding government firewalls, it's transiting through broken network environments. |
|
|
|
| ▲ | VTimofeenko 9 days ago | parent | prev | next [-] |
| WireGuard by itself has a pretty noticeable network pattern and I don't think they make obfuscating it a goal. There are some solutions that mimic the traffic and, say, route it through 443/TCP. |
|
| ▲ | daveidol 9 days ago | parent | prev | next [-] |
| Wow, kinda crazy to think about a government blocking a protocol that just simply lets two computers talk securely over a tunnel. |
| |
| ▲ | mikestorrent 9 days ago | parent | next [-] | | Well, think about it - almost every other interaction you can have with an individual in another country is mediated by government. Physical interaction? You need to get through a border and customs. Phone call? Going through their exchanges, could be blocked, easy to spy on with wiretaps. Letter mail? Many cases historically of all letters being opened before being forwarded along. We lived through the golden age of the Internet where anyone was allowed to open a raw socket connection to anyone else, anywhere. That age is fading, now, and time may come where even sending an email to someone in Russia or China will be fraught with difficulty. Certainly encryption will be blocked. We're going to need steganographic tech that uses AI-hallucinated content as a carrier, or something. | |
| ▲ | roscas 9 days ago | parent | prev [-] | | That is how you know they haven't got a clue on what they're doing. | | |
| ▲ | tsimionescu 8 days ago | parent [-] | | On the contrary, it shows that they know very well what they're doing. Their goal is censorship. If that disrupts connectivity for some niche but valid use cases, so be it. The vast majority of people have never used a WireGuard tunnel, so they are unimpacted. Some corporate use cases that even that government would approve of are disrupted, but they can either lie with that or have a whitelist. Most non-corporate use of this and other similar protocols is not something the government would allow. So, given their nefarious goal, they are doing a great job by blocking WireGuard (and similar protocols, presumably). |
|
|
|
| ▲ | Flere-Imsaho 9 days ago | parent | prev | next [-] |
| > surprised that wireguard as a protocol is just blocked. Honestly this is the route I'm sure the UK will decide upon in the not too distant future. The job of us hackers is going to become even more important... |
|
| ▲ | 9 days ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | aabdelhafez 9 days ago | parent | prev | next [-] |
| Same in Egypt. |
|
| ▲ | wereHamster 9 days ago | parent | prev | next [-] |
| A year ago I was traveling through Uzbekistan while also partly working remotely. IKEv2 VPN was blocked but thankfully I was able to switch to SSL VPN which worked fine. I didn't expect that, everything else (people, culture) in the country seemed quite open. |
|
| ▲ | atmosx 9 days ago | parent | prev | next [-] |
| Cloak + wireguard should work fine on the server side. The problem is that I didn't find any clients for Android and I doubt there are clients for iOs that can (a) open a cloak tunnel and then (b) allow wireguard to connect to localhost... |
| |
| ▲ | akho 9 days ago | parent [-] | | AmneziaWG is obfuscated, wireguard-based, and has clients for whatever. | | |
|
|
| ▲ | varenc 8 days ago | parent | prev | next [-] |
| Is it the protocol that's blocked as a result of DPI, or just the default 51820 UDP port that's blocked? If the latter, just changing your Wireguard server's port might work. |
| |
| ▲ | doix 8 days ago | parent [-] | | It's DPI, I run on a non standard port. | | |
| ▲ | varenc 8 days ago | parent [-] | | Damnnn, wonder what hardware you need to run DPI on a nation's internet. | | |
| ▲ | doix 8 days ago | parent [-] | | I think the hardware doesn't keep up. Uzbekistan has the worst internet compared to Kazakhstan and Kyrgyzstan whilst the infrastructure in general is much better (in my fairly uneducated opinion). I expected to have the best internet until I got around to trying to use it. |
|
|
|
|
| ▲ | dmantis 9 days ago | parent | prev | next [-] |
| XRay protocol based VPN worked for me in Uzbekistan when I were travelling there. Wireguard is indeed blocked. |
| |
| ▲ | akho 9 days ago | parent [-] | | xray is a proxy. They may have needed an actual VPN. |
|
|
| ▲ | slt2021 9 days ago | parent | prev | next [-] |
| how can they detect it is wireguard, I thought the traffic is encrypted? how does it differ from regular TLS 1.3 traffic? |
| |
| ▲ | dmantis 9 days ago | parent [-] | | It's UDP, not TCP (like TLS) and has a distinguishable handshake. Wireguard is not designed as a censorship prevention tool, it's purely a networking solution. The tunnel itself is encrypted, but the tunnel creation and existence is not obfuscated. |
|
|
| ▲ | sintezcs 9 days ago | parent | prev [-] |
| Same in Russia |
