Wireguard is blocked in my country, so I no longer can use Tailscale or other Wireguard-based solutions. My home server is behind a NAT. What other ways of secure private connection can I use?
2 months
You must log in or register to comment.
- slabber@lemmy.mlEnglish2 months
I have successfully setup trojan / trojan-go on my server. It uses port 443 and will return a standard website if the connection is not recognized as an authorized trojan-go client. As stealth as it can get.
- Evil_Incarnate@sopuli.xyzEnglish2 months
Zerotier. They have their own protocol, and there’s a free tier that lets you connect up to ten machines to make a network.
Also possible to selfhost, although I haven’t done it.
- alienghic@slrpnk.netEnglish2 months
Can you set your NAT to port forward a port to your ssh host?
I’m currently using yggdrasil to deal with this problem, though I’ve also used tor hidden services.
- myszka@lemmy.mlEnglish2 months
Unfortunately I’m behind CGNAT and yggdrasil is also partly blocked here (works super slow)
- alienghic@slrpnk.netEnglish2 months
You might try adding more gateways to the conf file?
Or if you’ve got a host your trying to connect to I think I’ve seen people get a VPN connection through ssh? https://wiki.archlinux.org/title/VPN_over_SSH
- Feathercrown@lemmy.worldEnglish2 months
This is what I do. For best security practice, make sure to use public key authentication and disable password authentication so nobody can even try to guess your password.
- iocase@lemmy.zipEnglish2 months
I haven’t tried it myself but I’ve been looking at NetBird.
Maybe others who’ve used it or know more can chime in on if this is a good idea or not?
- 2 months
Tor Hidden Services, easy to set up on the server side, can be annoying on the client side but HTTP and SSH are fine. Can be a bit slow but IMHO still usable.
- myszka@lemmy.mlEnglish2 months
Yes, I’ve tried that, but it’s not robust enough. This is what I’ll eventually resort to, if I don’t find a better solution.
- sandwichsaregood@lemmy.worldEnglish2 months
Sing-box is a VPN tool built to evade censorship https://github.com/SagerNet/sing-box . It is extremely resilient and stealthy.
See also, xray and v2ray, which are similar, but in my experience sing-box is a bit better documented (at least in English) and has better maintained client apps.
Setting any of these up can be complicated, but LLMs can get you pretty far if you have safe access.
- 2 months
Best solution is to organize revolution to kick out the fascist that censored the internet by protocol
- myszka@lemmy.mlEnglish2 months
Well you’d still depend on someone else’s will to provide you with robust and uncensored internet connection. The actual solution is to build a decentralised people-owned network using Reticulum for example. Reticulum over WiFi HaLow already works very well for small-scale local networks.
- zbyte64@awful.systemsEnglish2 months
That’s an ideal solution. The best solution is what works immediately and within your capabilities.
- Feathercrown@lemmy.worldEnglish2 months
The phrase “fun at parties” has been banned from my sight. I cast Quickened Spell: 1000 Downvotes
- q7mJI7tk1@lemmy.worldEnglish2 months
So this has been interesting to me as I’m travelling at the moment and wireguard has been blocked on the guest wifi I’ve been on across the hotels, I’ve had to rely on cellular instead.
I’ve just tried Teleport on my Unifi router and that works. I believe it uses wireguard, and it is taking up to 20secs to connect, but I’m now curious as to what it’s doing to bypass the VPN restrictions that are blocking plain wireguard.
- kalpol@lemmy.caEnglish2 months
How is this even a thing? Businesses can’t just have open network connections.
You could set up wireguard via stunnel maybe to port 22
- altphoto@lemmy.todayEnglish2 months
I’ll recommend this new VPN thing :
Its new so its evolving quickly with weekly releases and nightly builds.
Lots of people have told me about their grievance list due to AI having a big part in the development. It’s a bunch of guys in the team, so there’s the human element there.
As for my opinion, it’s the only VPN I’ve managed to get working on my own.
I lost connection yesterday and I am not sure what happened but my home computer and my phone were on the same VPN constantly for a week. Jumping from the house WiFi to 5g didn’t break the VPN connection but it did take a few seconds the first time I did it.
My other option would be Tailscale.
Update on the lost connection. I had restarted my computer and that changed my firewall device name for the VPN. So it was not rayfish related. It’s been pretty steady since.
- myszka@lemmy.mlEnglish2 months
Looks promising, but the ai part throws me off too. But I’ll give it a try
- altphoto@lemmy.todayEnglish2 months
You’re right. It’s kind of how Michael Jackson music doesn’t mix well with orchestra music:
- Squizzy@lemmy.worldEnglish2 months
I’m new to all this, how is wireguard banned and enforced? Seems odd
- sandwichsaregood@lemmy.worldEnglish2 months
WG is not meant to be a stealthy protocol and is easy to detect at the ISP level. It has distinct characteristics that packet inspection tools can use to identify it by examining the traffic and block or flag it. Blocking it completely is trivial for any ISP, much less a nation.
There are modified versions like AmneziaWG that make it stealthier, or alternative protocols built to evade traffic inspection like xray or sing-box (these two are really more like protocol frameworks that have multiple protocols you can use). It’s a bit of an arms race for packet inspection tools to be able to reliably identify these intentionally stealthy protocols, but the advantage is generally in your favor as long as you are using your own servers and not public VPNs. Though even then you need to take care to camouflage your traffic to be truly safe, like if you are shoving all of your traffic through one remote server that has approximately the same amount of traffic going out immediately etc that is something that can also be identified.
How much precaution is actually warranted depends on where you are and what the potential consequences are. You don’t have to go to a full tinfoil hat paranoia level setup to avoid most blocking.
2 monthsI’m an expert at nothing, but I would imagine that different VPN like WireGuard have different detectable signatures, much like different browsers have different signatures that can be detected. Also, for commercial VPNs, the IPs that the VPN company uses are easily identifiable.
