17

I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore.

Is it possible to setup my own VPN (or alternative), either on AWS or at home, in a way that would be more efficient for them than Astrill?

If VPNs all get blocked by some machine-learning chinese wizardry, what about a more custom solution like payload hidden in pictures? (steganography)

My thinking is that if I do it for a few people it would pass under the radar. What would you recommend?

MasterScrat
  • 272
  • 2
  • 7
  • 1
    Have you thought about using Tor ? That will prevent their awful government from knowing to which server they're connecting, and from there they could connect to your VPN. – André Borie Mar 17 '16 at 16:14
  • I don't have knowledge of VPN. But I suppose stego could be at least a fine alternative for you, if your stego scheme is secure enough and the common means of stego with pictures as cover doesn't lead to suspicions when very frequently pictures are sent. I must say that I also know not much about stego via pictures to be able to recommend you any such schemes. On the other hand, I have two stego schemes of my own with normal texts as covers, albeit unfortunately with very low efficiency: s13.zetaboards.com/Crypto/topic/6939954/1/ and s13.zetaboards.com/Crypto/topic/7338098/1/ – Mok-Kong Shen Mar 17 '16 at 17:38
  • have you achieved this and if so it would be great to know how you did it? – dragonfly02 Jan 23 '18 at 09:38

3 Answers3

13

Note that my information may be outdated, as the last time I really dug into this subject was in 2013 - 3 years ago. I lived there, and experienced all the inns and outs of VPNs and Proxies.


The love-hate affair with VPNs in China

I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore.

Yeah, this happens during a lot of interesting events, and certain times of the year. The Internet becomes heavily restricted, and most of the VPNs keep getting blocked.

Shortly thereafter, the VPNs are generally unblocked because the ruling party members are using them too. ;) It's mostly just for show. However, they'll sometimes ban entire lists... so it's often a game of cat and mouse.


Homebrew Solutions may not be the best course of action

Is it possible to setup my own VPN (or alternative), either on AWS or at home, in a way that would be more efficient for them than Astrill?

Yes, and this can work, but! It's highly suspicious. And if you're using your own home proxy as a VPN, you'll eventually be banned from connecting to Chinese websites and communication protocols. Do you want to lose contact? Because this is how you lose contact.

Chinese authorities are notoriously paranoid, and think that any kind of communication with foreign entities denotes espionage, especially if you are in any way connected to individuals listed in the data stolen from the OPM breach, and especially if the people you're talking to have appropriate guanxi (关系: "connections," "relationships", etc).

You will not pass under the radar. In most cases, you will only connect to VPNs which are allowed to be connected to. In fact, this will put your family in China under suspicion. "climbing the wall" (翻墙) is not something you want to create a homebrew solution to, as it's suspicious. It's better to get lost in the noise.


PPTP vs. OpenVPN in China

If VPNs all get blocked by some machine-learning chinese wizardry, what about a more custom solution like payload hidden in pictures? (steganography)

It's more like this: if you utilize standard VPN protocols which begin their connections in a standardized way, it will be blocked due to DPI. OpenVPN for example, did not work for me, but PPTP did.

Unfortunately, PPTP with MS-CHAPv2 is quite insecure, and easy to decrypt. PPTP is also vulnerable to man-in-the-middle attacks. Part of the reason why it works is because they're able to redirect traffic.

If you're trying to discuss anything sensitive, do not use PPTP. Do not use anything, actually. There are a lot of reasons for this, but it's beyond the scope of this answer.


Recommended VPNs

My thinking is that if I do it for a few people it would pass under the radar. What would you recommend?

Now here's where our, "questions seeking product recommendations are off-topic as they become obsolete quickly", rule really comes into play: VPNs are extremely volatile in China. One day they're banned, another day they're not. Some times, entire VPN companies become completely inaccessible, and sometimes you need to contact support to get updates, if you're lucky enough to find some way of contacting them.

And even if this was on topic, it's best not to tell you at all. Why? Because the CCP trawls the internet for VPN companies, signing up for them, and downloading the product's entire IP range, and then blocking them.

For things that do work, telling you assists "them" in helping to block more hosts, degrading the experience for everyone else. Find it yourself. Chances are, if you find something that is working, they're using it too. :-p

Mark Buffalo
  • 22,498
  • 8
  • 74
  • 91
  • What about a more secure protocol embedded inside PPTP ? PPTP will go under the radar and "get lost in the noise", while the real security will be provided by the underlying protocol. – André Borie Mar 17 '16 at 16:12
  • 1
    @AndréBorie If you are opening a connection to a foreign IP address, and the contents are encrypted - whether the protocol is secure or not - you may be eventually designated as "suspicious." And they have plenty of people to check up on you, especially if you already have *family* in China. Using a regular VPN provider, like everyone else, is probably a better solution... because the ruling party will be using it too. When "they" investigate, they'll see just random stuff... and will probably allow you to keep it going so they can monitor the traffic. Expect zero privacy. – Mark Buffalo Mar 17 '16 at 16:20
  • it depends if they would actually bother breaking the PPTP to realise there's something stronger inside, or if they will just let it thorough believing it's "simple" PPTP with plaintext inside. My guess is the latter; unless you're already under suspicion, nobody will bother. – André Borie Mar 17 '16 at 16:28
  • 1
    If you're under suspicion, the best thing to do is behave normally, or in some cases, *abnormally*. Having unbroken encryption will attract the attention of some of the seedier elements, possibly the Ministry of State Security. – Mark Buffalo Mar 17 '16 at 16:29
  • So is there an up to date version that works? – dragonfly02 Jan 23 '18 at 09:39
  • We can't really tell you. You'll have to find this for yourself... if we tell you, they'll probably find and block it. Product recommendations don't really work on this site, and doubly so for great firewall VPNs. – Mark Buffalo Jan 24 '18 at 06:34
  • While the information on what VPNs to use could easily become outdated, I doubt it would be an issue to name the services in a way that is hard to automatically scrape. Even something as simple as rot13 or base64 encoding should be enough to hide it from automated scraping. – forest Jul 24 '18 at 08:19
  • While it all sounds legitimate, I am wondering how "real' this really is. What actual experience is there to become 'suspicious'? In theory it sounds good, but will they REALLY dive into one single connection that goes outside of the country? Did you encounter such actions? – CularBytes Aug 09 '19 at 07:10
1

I'm currently researching this topic for my upcoming trip to china

There is an interesting article about this

Basically, using a normal proxy won't work because the firewall will filter out most of the requests. Using secured connection to a proxy might work, however, you should use a dedicated software, like Shadowsocks or it's successor ShadowsocksR, because the firewall is able to detect that you are using http proxy even if you are connected to a proxy via TLS

Arsen Zahray
  • 135
  • 4
0

Using usual VPN protocols might be a bad idea as The Great Firewall Of China filters such connections autonomously via deep packet inspection, afaik.

You could still use your own, custom made steganography-based proxy ripoff.

I'd recommend to call it YAPTOC, Yet Another Proxy To Own China.

This will probably go under the radar as you recon, however it would need quite some work to get it working correctly and easily deployable for your family.

Tobi Nary
  • 14,302
  • 8
  • 43
  • 58
  • Do you maybe know some ready-made YAPTOC implementations? ;-) – MasterScrat Mar 17 '16 at 15:49
  • I would like to say that a friend of mine goes to china often and set up his own VPN on a rasp pi for when he is out there, using an IP checking service to email him self an IP address so if it ever got changed / blocked he could cycle the power. he used swan VPN – TheHidden Mar 17 '16 at 16:01