Both openvpn and wireguard protocols are trivially blocked by DPI. Why do people make custom protocols today? Everybody should use something standard and indistinguishable, like QUIC, DTLS or TLS1.3, for their transport layer.
There's at least 2 or more different efforts to make WireGuard DPI resistant. Ex: https://github.com/database64128/swgp-go
Interestingly, Cloudflare (and Apple?) have begun switching to MASQUE: https://blog.cloudflare.com/zero-trust-warp-with-a-masque
> Everybody should use something standard ... like QUIC, DTLS or TLS1.3, for their transport layer.
Very common for anti-censorship tools (V2Ray, XRay, Clash, Hysteria, Trojan, uTLS, Snowflake, SingBox, Outline etc) to use these.
If you don't want to stand out you should use steganography and masquerade as a legitimate and popular protocol. It seems that MASQUE does exactly this.
so even though that stream was itself encrypted, it was trivially easy to track down that one guy and tie it to him.
Not so trivially as it seems. I use wireguard from Russia despite their efforts to block it. It needs some tricks to connect, but it works. I believe that openvpn will work too with those tricks.
> Everybody should use something standard and indistinguishable, like QUIC, DTLS or TLS1.3, for their transport layer.
Let them first learn how to block wireguard properly. No point to show them the full scale of the problem they face, so they could get more funding. :)
On a more serious note, it is whack-the-mole game, the idea that sounds like "everybody should use X" for some value of X is not a good idea. Everybody should look for their own way to bypass censorship, and they should do it with as much creativity and tech skills as they have.
To experiment with this you need to buy a VPS abroad.
If you don't want to do that then you can search for existing utilities like: GoodbyeDPI, XRay/reality, AmneziaVPN etc.
I don't understand why this matters, it's not like your ISP will ever block this kind of traffic since every company that has any form of IT department uses some form of VPN making it not only a legitimate kind of traffic but also quite common.
Many businesses don't bother even subscribing to a business package, because something like a static IP is unnecessary for them.
Further, the point regarding VPNs still stands -- think of the chaos it would cause for many people working from home (on residential connections). And that's just one example.
I don't find it plausible for an ISP to block this.
Exactly this does exist, search for xray / xtls-reality.
A node pretends to be a valid web site, with a valid third-party TLS certificate (like a CDN node serving that website), until a correct secret key is presented, then it looks like regular TLS-encrypted web traffic.
E.g. https://github.com/XTLS/Xray-core — most documentation, sadly but expectedly, is in Chinese and Russian, because these folks seem to need this most.
The project you mentioned seems to be pretty complicated; I think it is possible to implement the tunnel in a single Python file without any external libraries. But I was not intending to implement any serious crypto, just masquerade traffic.
Yes, I saw that project and even the English documentation is not easy to read.
This protects the VPN node from being blocked after a port scan, and gives you plausible deniability: "Yes, I have visited this IP. Let's open it. Ah, I just wanted to look at the newest Samsung phone model."