Hacker News Reader

Comment by sjnair96 | Hacker News Reader

Does this work in the Middle East (Dubai) where we have DPI as good/better than the Great Firewall? Nothing but Shadowsocks [1] seems to be consistent there. Unfortunately I have had poor/no UDP performance on SS even when enabling the UDP Relay on my Mac.

[1] https://shadowsocks.org/en/index.html

View on HN

Works amazingly well in Iran. I suspect that will change once cloudflare warp makes it mainstream.

Probably not. Wireguard doesn’t aim for VPN DPI bypass. It might work for now just because it’s new but it’s not difficult to dpi.

Will this be an eventual goal?

I fail to find the post on the mailing list right now, but iirc the author prefers WG to be the secure part of the equation, with use cases like Dubai/China relying on other tools to mix up/obfuscate the data hitting the wire.

I do hope the author takes this up too. They're extremely talented. Could make a big change in firewall systems.

Iran sometimes does data per endpoint analysis and is able to block any VPNs since they're all single endpoint VPNs. If we were able to split the data to, say a few hundred unique ips it would be extremely difficult to block it.

What are the solutions for DPI bypass?

Openvpn can mimic vanilla HTTPS traffic. Is that not enough?

Not really it can't. Openvpn on its own has a very identifiable header.

You can put it behind stunnel though for example.

Does a dns proxy work? Just curious.

Reply on news.ycombinator.com