Can someone explain from a technical standpoint how they can block OpenVPN running on port 443? my admittedly limited understanding is that port 443 is the common port for https. If they blocked that port wouldn’t that mean that they would be blocking nearly the entire internet?
I don’t know what they actually do but one possibly is to look for (absence of) the TLS handshake. Or maybe they simply infect all devices on the Chinese market with MITM certificates to be able to decrypt all TLS encrypted traffic. Should be easy to force companies to do that in such a country.
The port isn’t their focus, they’re looking at the protocol that is being used, regardless of the port. The protocol is still visible when not doing deep packet inspection. That’s why there suggesting a socks proxy for Russian citizens, because that uses HTTPS to tunnel traffic, so it wouldn’t be caught up in protocol analysis.
Look up NBAR for the basic idea. Each vendor has their own ‘secret sauce’ implementation, Palo Alto only needs 9 bytes of payload for disambiguation, iirc.
thank you! so it is basically looking at identifiable patterns in the packet flow and matching them to protocols.
i also found this paper about traffic identification interesting.
From my understanding, they are most likely just blocking the defualt port of wireguard / openvpn and IPs associated with the VPN servers of VPN providers they dont like.
If they wanted to block VPN traffic over 443 to any IP, they would have to do deep packet inspection, which I would imagine is infeasible for Russia.
Supposedly, the Chinese great firewall does use deep packet inspection, so it is possible to do this at the country level.
They specifically mention it’s on the protocol level which would imply it’s doing more than just blocking some ports. Not sure why you’d think China could pull that off but it would be infeasible for Russia?
You can analyze the traffic, detect common patterns and also detect source of the request. Russian IT specialists are now using very complex solutions to come around the block which work a lot like MITM attacks.
Can someone explain from a technical standpoint how they can block OpenVPN running on port 443? my admittedly limited understanding is that port 443 is the common port for https. If they blocked that port wouldn’t that mean that they would be blocking nearly the entire internet?
I don’t know what they actually do but one possibly is to look for (absence of) the TLS handshake. Or maybe they simply infect all devices on the Chinese market with MITM certificates to be able to decrypt all TLS encrypted traffic. Should be easy to force companies to do that in such a country.
The port isn’t their focus, they’re looking at the protocol that is being used, regardless of the port. The protocol is still visible when not doing deep packet inspection. That’s why there suggesting a socks proxy for Russian citizens, because that uses HTTPS to tunnel traffic, so it wouldn’t be caught up in protocol analysis.
can you maybe link some ressources on how the protocol used can be detected? i did not know about this and would like to read into it some more :)
Look up NBAR for the basic idea. Each vendor has their own ‘secret sauce’ implementation, Palo Alto only needs 9 bytes of payload for disambiguation, iirc.
thank you! so it is basically looking at identifiable patterns in the packet flow and matching them to protocols. i also found this paper about traffic identification interesting.
Time to up the spoofing game. Maybe some AI-generated traffic to throw off the packet analytics.
From my understanding, they are most likely just blocking the defualt port of wireguard / openvpn and IPs associated with the VPN servers of VPN providers they dont like.
If they wanted to block VPN traffic over 443 to any IP, they would have to do deep packet inspection, which I would imagine is infeasible for Russia.
Supposedly, the Chinese great firewall does use deep packet inspection, so it is possible to do this at the country level.
They specifically mention it’s on the protocol level which would imply it’s doing more than just blocking some ports. Not sure why you’d think China could pull that off but it would be infeasible for Russia?
You can analyze the traffic, detect common patterns and also detect source of the request. Russian IT specialists are now using very complex solutions to come around the block which work a lot like MITM attacks.