Russia starts blocking VPN at the protocol (WireGuard, OpenVPN) level

In case anyone wondered how to potentially get around this...

Pay for a server in another country that gives you SSH access
Create SSH SOCKS tunnel: ssh -N -D 8008 your-server-ip
Open your browser and set the SOCKS server to localhost:8008 (in Chromium/Firefox you can search for this in Settings)

So, that's definitely better than nothing, but your browser isn't the only thing -- though these days, it is a very important thing -- that talks to the Internet. If, for example, you're using a lemmy client to read this, I'd bet that it's good odds that it doesn't have SOCKS support.

Though I wouldn't be surprised if someone has made VPN software that intercepts connections and acts as a proxy SOCKS client, which would make it work more like a traditional VPN if you can reach a remote SOCKS server, though maybe with a performance hit.

googles

Yeah, okay, looks like stunnel can do this on Linux. So it's a thing.

You don't need a 100% solution, though, to have a pretty big impact on society. Combine technical barriers with it just being easier to not think about what's going on outside, maybe some chilling effects from legally going after people who do start doing things that you don't like (viewing websites, spreading information, etc), and you can control people's information environment a lot. Make using circumvention solutions illegal -- okay, maybe you can bypass their system if you don't get caught, but do you want to risk it? Make creating or spreading circumvention solutions really illegal. Do you want to risk getting in a lot of trouble so that random other person can get unrestricted or unmonitored Internet access?

On that note, I was reading about the way North Korea does it in an article from someone who got out of North Korea. That is about as close as it gets to a 100% solution. Only a few thousand people are authorized to get Internet access. You need to apply to use the Internet with a couple of days lead time. Each pair of computers has a "librarian" monitoring what the Internet user on each side is doing, and every five minutes or so the computer will halt with whatever you were doing on the screen and require fingerprint re-authorization from the "librarian" to continue. Users are not allowed to view pages in Korean, just English and Chinese (I assume because most information out there that you'd have to go outside North Korea to get access to is likely available in either English or Chinese, and they definitely don't want people seeing anything out of South Korea).

That pretty much screws North Korea in terms of access to information, is a costly solution, but if you place an absolute priority on control of the information environment, North Korea does prove that it's possible to take a society there.
- North Korea does prove that it’s possible to take a society there.
  
  I don't think NK took themselves there, they were already there when the internet was invented. Easier to limit access to few people when you have draconian measures in place when access becomes possible.
  
  Having a society that already widely has access to one that has extremely limited access is a lot more difficult.
Unfortunately it would be trivial to block an SSH tunnel like this. I recall reading news 10 years ago (maybe even earlier) some foreign journalist tried this at a Beijing hotel room and got shut down in minutes. That was when people are still using PPTP and L2TP protocols to get around censorship, Wireguard and shadowsocks wouldn't be born for another couple years.
- trivial to block an ssh tunnel like this
  
  Far from trivial unless you’re willing to brick ssh completely, or at least cripple a bunch of non-VPN uses for tunneling. Of course it’s trivial to just block ssh outright, or block tunneling above a certain bandwidth. But that would also block, as an example, most remote IDE sessions, loopback-only server management frontends, etc.
This is actually pretty interesting, thanks for sharing. Although i live in a third world country that doesnt care about anything at all including piracy, but this tunneling thing looks pretty handy
Couldn't you also just set the VPN to use port 443?

E: Apparently this isn't enough. IE, for Wireguard, you would need to find a way to obfuscate the handshake.
I'm not 100%, but I think you could set this up for free with an Oracle AlwaysFree tier VM.

(Boo Oracle, yes I know. Still very handy.)
- Just looked up Oracle Always Free... Good to know about, thanks!

Is OpenVPN not just SSL traffic?

They can block the default port and IP addresses owned by VPN service providers, but is there any way to block the protocol without block all encrypted web traffic?

Blocking all encrypted traffic... fantastic suggestion comrade, I'll forward this on to the Kremlin. Also, you've been drafted.
- I suppose with "comrade" you are hinting at Soviet customs, but Russia isn't the USSR and couldn't be further from being socialist
It's a custom protocol that uses SSL/TLS for key exchange and such, so it can be detected. It's actually causing huge problems for many large Russian companies, as it's common to use those protocols for remote access, work, etc.

As mentioned in the article you need something like "Shadowsocks" to avoid protocl blocking, since it fully disguises the traffic as standard SSL/TLS. Which was created for, and is still used to circumvent this type of blocking in "the great firewall of china".
https://security.stackexchange.com/questions/187649/is-it-possible-to-detect-vpn-in-the-network

tl;dr: You can infer that OpenVPN is used from the key exchange somehow.
Permanently Deleted
- Unless the whole of the inner IP packet is encrypted,
  
  It is, because they're inside an encrypted stream of data.
  
  The way OpenVPN works is this:
  
  OpenVPN establishes a TLS connection to the OpenVPN server.
  
  Your computer's kernel generates an IP packet.
  
  OpenVPN sucks that up, shoves it into the TLS connection. That connection is encrypted, so the network provider cannot see inside it, know whether the data is IP packets or anything else, though I suppose maybe traffic analysis might let one classify a connection as probably being a VPN.
  
  The data in that connection is broken up into IP packets, went to the OpenVPN server.
  
  The OpenVPN server decrypts the data in the TLS stream, pulls the original IP packets out.
  
  So the original packets are always encrypted when the network sees them. Only the OpenVPN server can see the unencrypted packet you originally sent.
  
  What @raltoid is saying sounds plausible, though I can't confirm it myself off-the-cuff -- that OpenVPN is detected by looking at somehing unique in the initial handshake.
Yes there is a difference between https traffic.
There's still headers and it's fairly trivial to block using packet analysis. Using other protocols such as SSH tunneling may work (until they try to ban that I suppose). There's always way around these kind of blocks, it's a cat and mouse game.
Is OpenVPN not just SSL traffic?

It's not, it's an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it's not the same protocol and can be differentiated that way.

A way around this would be to run an SSLVPN with a landing page where you log in instead of using an IPSec VPN or a dedicated SSLVPN client.

Another way around it would be to create a reverse SSH tunnel on a VM/VPC in another country/state and send all your traffic through that.
- Is OpenVPN not just SSL traffic?
  
  It’s not, it’s an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it’s not the same protocol and can be differentiated that way.
  
  I think that either I'm misunderstanding what you're aiming to say, or that this is incorrect.
  
  OpenVPN can run over UDP or TCP, but it's not IPSec, not even when running over UDP. IPSec is an entirely separate protocol.
Blocking VPN is easy. You detect a new encrypted connection to a host outside of Russia. Then you connect to the same host yourself and check if it's a VPN server or not. If you get a VPN handshake, you block all access to such host. Boom! No more VPN.

Shithole country

Worse: shithole country that turns everything they touch into shit too.
- Bootlicking simply comes naturally to the Russian culture.
  
  Edit: my apologies to the Russian brothers and sisters still fighting the good fight by blowing up Putin's shit.

using a vpn is also illegal in russia since 2017 😅

But also laws don't really matter in Russia.
- well 😅
I'd appreciate a source for that statement. :o
- In November 2017, the Russian government passed a law banning the use of VPNs, Tor, and proxies to access unauthorized content. Since that time, it has been used to restrict specific VPN services.
  
  The ban targets VPN providers who refuse to submit data to the Russian government. The threat of bans came in 2019. Two waves of bans followed in 2021, covering 15 VPNs. Only one Russia-based provider is known to have complied with the rules.
  
  https://surfshark.com/blog/vpn-in-russia
  
  https://www.reuters.com/article/us-russia-internet-idUSKBN1AF0QI
  
  https://www.bbc.com/news/technology-41829726.amp
This is not accurate information. VPN usage is not banned.
Using is not illegal
- if you want to use it in its original purpose it's illegal. If you use a vpn not registered with Roskomnadzor, it's illegal because you can access stuff that putin does not want you to see.
  
  therefore using a vpn with its normal purpose to create your private tunnel and access what you want is in fact illegal in russia.

But how are their propaganda farms going to be able to pretend they are in your country now?

They still get to operate don't worry!!
official companies are still able to use vpn 😏
Exemptions that only apply rules to the common people. Maybe device registration with an exception using ipv6 address
Maybe they don't actually have all those propaganda farms that the dems were crying about, did that thought cross your mind?
- Before it was widely reported, Twitter's geocoding feature showed a ton of Russian-based accounts posing as "Americans" and only discussing politics. Would love to see lemmy be more transparent about accounts posting here too, tbh.
- They exist. Inform yourself on the Internet Research Agency, one of Russia's state sponsored troll farms. A handful of their activities are well documented in factual records. 'Dems' weren't crying about it, every rational person who doesn't want foreign interference and disinformation flooding our spaces is concerned about it. This should not be a partisan issue whatsoever.
- Maybe, but get fucking real.
- Sadly, but we have. There is a big propaganda campaign have been raised for the last 2 years. It was here before but not in a such huge amount.

annnd another dictatorship box checked off the list... wont be long now

Until what? Until Russia is a dictatorship? That ship sailed a long time ago.
- Won't be long before Putin catches up to Kim Jong Un in the Oppression Olympics
- Until he stops pretending?

Proton vpn has a feature that can be turned on for oppressive governments, ‘alternate routing’ I believe. Would that be sufficient or no?

Nope, Proton VPN is super simple and is blocked long ago.
Theoretically, yes, since there are options other than WG/OVPN available through Smart Protocol, which Alternate Routing leverages.

I live in Russia and I have vps with wireguard vpn in Netherlands. At the current moment it works for me pretty well except the some connection failures two days ago. But they were very short. But I don't know how long my vps will be accessible with these fucking blocking.

You might want to sign up with astrill. Greetings from China, we've been dealing with this shit for decades.
- Thanks for advice. I didn't hear about it before. It will be my backup plan.
Can you confirm that it is still working fine on normal home internet but not on cellular data? Have been back to Russia multiple times per year (family reasons) and none vpn ever works on cellular network. Some work at home and places.

My own vpn is to my house in different country. Wireguard. That has always been working over home wifi here (not cellular). Even until now.
- For now it works both via mobile data and home provider. My mobile operator is Tinkoff. The home Internet provider - City Telekom. But sometimes it losses connection for several minutes. But generally it works well.
It will be blocked soon. Go read here what to do https://habr.com/ru/articles/731608/

Now comes the Great Russian Firewall.

The Copper Curtain?
- I don't think they can afford copper at the moment. Try cotton maybe.

ProtonVPN has a "stealth" protocol. Does anyone know if that breaks through?

protonvpn hasn't worked here at all for a long time now lol
It doesn't work in China, if that's any indication.
Absolutely doesn't. Even tried to go like 100 servers to see.

But nothing related to proton get through
No. Russia simply blocks the servers in the case of Proton.

It was not working 2 day on mobile operators, now waiting full shutdown

yup. kinda same experience. tele2. complete shutdown on my vpn.
- Shadowsocks worked fine

Russia is a terrorist state. #SlavaUkraini #ArmUkraineForVictory

I love all my fellow Russians and Ukrainians who rise above the brainwashing that this commenter is demonstrating.

Fuck patriotism and slogans, that's what politicians want you to do to die for them. All wars would be over in a day if people just realized this as politicians can't fight their wars without people like this commenter.
- Ukraine was invaded bro. Their politicians did exactly nothing to encourage war.
Russia is less terrorist than Azerbaijan, but the latter isn't even being sanctioned (and there's been an ICJ decision against them, but everybody ignores it) for starving out a little country of 120k people right now in a medieval siege, and openly stating that they are doing exactly that.

I don't think Ukraine has lots of problems. At least the aggressor there is recognized for what it is and the victim is recognized for what it is and armed by half the world.

I don't think Ukraine deserves any attention, in fact, since in Artsakh they support Azerbaijan. Support of now finally actual genocide happening is what makes me think that.
- Russian likes to threaten the world with nukes - nuclear war would inevitably lead to a nuclear holocaust that would cause the near extinction of the human species.
  
  I don't give a flying fuck about Azerbaijan. Russia is terrorizing the entire species of humanity. Until you're threatening to wipe out the entire planet, you are not a terrorist on the same level as Russia.
- I think Ukraine is a western puppet. But that doesn't mean Russia isn't also shit.
  
  People can wrap their heads around two mean bullies fighting in a schoolyard. But someone when it's politics many people want a single bad guy.

I am pretty confused by the article.

What I'd expected based on what I've seen so far was that the Kremlin would not care what protocols are used, just whether the a given VPN provider was in Russia and whether it provided the government with access to monitor traffic in the VPN.

So, use whatever VPN protocol you want to talk to a VPN provider where we can monitor or block traffic by seeing inside the VPN. You don't get to talk to any VPN providers for which we can't do that, like ones outside Russia, and the Russian government will do what it can to detect and block such protocols when they pass somewhere outside of Russia.

But that doesn't seem to fit with what the article says is happening.

The media in Russia reports that the reason behind this is that the country isn’t banning specific VPNs. Instead, it’s putting restrictions on the protocols these services use.

According to appleinsider.ru, the two protocols that are subject to the restrictions are:

OpenVPN

WireGuard

A Russian VPN provider, Terona VPN, confirmed the recent restrictions and said its users are reporting difficulties using the service. It’s now preparing to switch to new protocols that are more resistant to blocking.

I don't see what blocking those protocols internal to Russia buys the Kremlin -- if Terona conformed to Russian rules on state access to the VPN, I don't see how the Kremlin benefits from blocking them.

And I don't see why Russia would want to permit through other protocols, though maybe there are just the only protocols that they've gotten around to blocking.

EDIT: Okay, maybe Terona doesn't conform to state rules or something and there is whitelisting of VPN providers in Russia actually happening. Looking at their VK page, it looks like Terona's top selling point is "VPN access to free internet" and they have a bunch of country flags of countries outside of Russia. So maybe Russia is blocking VPN connectivity at the point that it exits Russia, and it's affecting Terona users who are trying to use a VPN to access the Internet outside Russia, which would be in line with what I would have expected.

Your edit makes sense, it would be possible to block all VPN traffic but just whitelist traffic from trusted IP addresses (like those in Russia). But I don't think we have enough info to say for sure that's what's happening.

Shadowsocks/ShadowsocksR/vmess/vless/trojan:

Is it possible to bypass this block? Say, embedding VPN packets within a different protocol?

I don't know why some moron downvoted you, but the answer is maybe. For reference, I have always bypassed SSH firewall blocking by sneaking SSH packets within https.

The only way this won't be possible is if the government enforces installing a certificate to use the internet, so that they can do a man-in-the-middle-attack. I heard this is already being done in Afghanistan.
- So sad. More and more we are seeing a world were the powers that be can do anything they want but if you do it it's (rightfully) malware and illegal.
  
  The vast majority of popular apps and OSes are spyware by any reasonable definition of the term.
For simple web browsing or streaming over https you can use a socks proxy.

For full VPN function you could try something like IPSec or L2TP, as they’re not listed in the protocols Russia is targeting.
I've had success wrapping OpenVPN (TCP) in stunnel on networks that have done similar things.

Can someone explain from a technical standpoint how they can block OpenVPN running on port 443? my admittedly limited understanding is that port 443 is the common port for https. If they blocked that port wouldn't that mean that they would be blocking nearly the entire internet?

I don't know what they actually do but one possibly is to look for (absence of) the TLS handshake. Or maybe they simply infect all devices on the Chinese market with MITM certificates to be able to decrypt all TLS encrypted traffic. Should be easy to force companies to do that in such a country.
- The port isn’t their focus, they’re looking at the protocol that is being used, regardless of the port. The protocol is still visible when not doing deep packet inspection. That’s why there suggesting a socks proxy for Russian citizens, because that uses HTTPS to tunnel traffic, so it wouldn’t be caught up in protocol analysis.
You can analyze the traffic, detect common patterns and also detect source of the request. Russian IT specialists are now using very complex solutions to come around the block which work a lot like MITM attacks.
From my understanding, they are most likely just blocking the defualt port of wireguard / openvpn and IPs associated with the VPN servers of VPN providers they dont like.

If they wanted to block VPN traffic over 443 to any IP, they would have to do deep packet inspection, which I would imagine is infeasible for Russia.

Supposedly, the Chinese great firewall does use deep packet inspection, so it is possible to do this at the country level.
- They specifically mention it's on the protocol level which would imply it's doing more than just blocking some ports. Not sure why you'd think China could pull that off but it would be infeasible for Russia?

OpenVPN + obfs4proxy should still work. I've been using it in China for some time along with a VPN client on Android & windows that support obfs3.

Is this just address/port blocking, or DPI of some kind? I'm wondering what they can trigger off?

Interesting read: https://www.ntkernel.com/how-to-bypass-egypts-wireguard-ban/
vpn traffic isnt directly hidden, but it can be helped along.

youd need to encapsulate your vpn traffic in a different protocol, make sure you shape your traffic to expected values for that protocol and then avoid known vpn endpoints.
Neither. They detect new secure connections outside of Russia. Then connect to the same host and check if it has a VPN handshake. If it does - the host gets blocked. No need for DPI or anything complex and 100% ban rate.

Couldn't you just use any server/droplet/AWS instance via SSH to get around this law? Seems much simpler.

If you're savvy enough, sure. But for the lay person who doesn't want a clouded view of the world, they likely won't have the same resources or technical capabilities.
It's not without drawback though. SSH tunnel consumes a lot more cpu compared to wireguard. If your vps has a weak cpu, it might not even able to fully saturate a 1gbps connection due to cpu bottleneck on certain ciphers. If you're using a mobile device, it will drain your battery faster than wireguard.
- Permanently Deleted
that's assuming you can get one, which is challenging since most hosting companies don't/can't offer services in russia anymore

This has been happening intermittently since 2012 or something.

Not wg, cause it wasn't popular then.

HTTP\HTTPS tunneling etc are not that hard, ya knaw.

Or encrypted GRE, ffs.

However will they get messages through??

Curious if anyone living there has tried Windscribe Stealth protocol?

!chapotraphouse@hexbear.net will love this.

After a discussion that lasted for way too long, it appears that they like censorship.

They think that this is a perfectly reasonable argument: https://youtu.be/QFgcqB8-AxE and that the government knows better and thus information should be suppressed.

Absolutely ridiculous...

Peeps on hexbear are atrocious
- Yes they are. And they shadow delete comments! That's after several of their members straight up sent abusive messages to me. I of course reported them. That's when I noticed my comments deleted.
  
  I'm not too worried about it. If that's how they are with others, their message and community won't reach far. Fuck em
Here is an alternative Piped link(s): https://piped.video/QFgcqB8-AxE

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source, check me out at GitHub.
!chapotraphouse@hexbear.net will love this.

yo thanks for the hookup was looking for another based instance

subscribed!

Can this actually work? If you run Wireguard on a non-default port, is it possible to tell that it's wireguard?

Most open source vpn protocols, afaik, do not obfuscate what they are, because they're not designed to work in the presence of a hostile operator. They only encrypt the user data. That is, they will carry information in their header that they are such and such vpn protocol, but the data payload will be encrypted.

You can open up wireshark and see for yourself. Wireshark can very easily recognize and even filter wireguard packets regardless of port number. I've used it to debug my firewall setups.

In the past when I needed a VPN in such a situation, I had to resort to a paid option where the VPN provider had their own protocol which did try to obfuscate the nature of the protocol.
Yes ofc they can. The Wireguard protocol is not designed to be hidden.

Interesting read: https://www.ntkernel.com/how-to-bypass-egypts-wireguard-ban/
Chinese firewall can detect it, AFAIK
- Gfw is mostly picky about anything udp or where both ports are unknown. Also if the known port (server) isn't from a licensed block.
  
  Basically there are heuristics that lead to either a reset, a temp block, or a perm block, but it seems to vary from time to time a lot.
- Wireguard through gfw worked fine when I tried it. The other client did have a static IP and static Port tho, that probably helped
Yes. It's very easy. Read my other comments in this post.

Permanently Deleted

Use scramble features

how long before our beautiful UE thinks about doing the same?

It would only take 1% of the population to oust putler's fascist regime. 1%

I'd like to see your calculations.
- 1.4 million people in a country where most people are brainwashed do-nothings would be enough to take out a group of the few hundred cowards and their war criminal czar. (thank you @Vriska@lemmy.world )
Lmao