114
It must look ridiculous to the ISP to see on average 2TB of scrambled, outgoing UDP packets/month... (piefed.cdn.blahaj.zone)
submitted 22 hours ago by to c/piracy@lemmy.dbzer0.com
25 comments fedilink hide all child comments
 

...versus the 1-2GB of incoming traffic.

you are viewing a single comment's thread
view the rest of the comments
[–] 16 points 11 hours ago* (7 children)

Size and timing of packets. Protocols generally have consistent patterns, so say always 6 packets with the last 3/4ths filled. Then some keepalive at regular intervals (i.e. tracker updates), establising new peer connections, ...
Luckily this deep inspection is illegal for isps in the eu.

Russia, China, and Iran are using the patterns to effectively block all normal VPN and proxy protocols. There, people need special tools that send fake packets, randomize timing, and split and group packets into different sizes. All of course decreasing speed and increasing latency.
For UDP you'd also usually reencode packets as http3 warp ones so it looks like a video call.
Then the other end needs the same tooling to restore the normal packets.

Obfuscating it would be possible if necessary, but it's better when you aren't forced to maintain such an obfuscation stack.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 8 points 8 hours ago (2 children)

    Luckily this deep inspection is illegal for isps in the eu.

    Luckily one of the most populated police states in Europe didn't trick idiots into voting to leave the EU or anything...oh wait.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 9 hours ago (3 children)

    Obfuscating it would be possible if necessary, but it’s better when you aren’t forced to maintain such an obfuscation stack.

    I'd be delighted if my VPN provider provided even an obfuscation layer that I could use on my routers, but alas...

    For UDP you’d also usually reencode packets as http3 warp ones so it looks like a video call. Then the other end needs the same tooling to restore the normal packets.

    Is this similar to when you mask it as webrtc?

    Luckily this deep inspection is illegal for isps in the eu.

    As per the GDPR or something else?

    There, people need special tools that send fake packets, randomize timing, and split and group packets into different sizes. All of course decreasing speed and increasing latency.

    Something other than DAITA?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 hour ago* (last edited 1 hour ago)

    For UDP you’d also usually reencode packets as http3 warp ones [...]

    Is this similar to when you mask it as webrtc?

    Sorry I probably meant QUIC not warp. It is related, I think webrtc now usually uses quic, so masking as quic or webrtc are probably synonymous, but honestly I don't know enough about the details to say for sure.

    Something other than DAITA?

    I know people in Russia are reporting Mullvad gets fully blocked, so I don't think DAITA is enough. As @chimp@lemmy.dbzer0.com mentioned, Hysteria is more in the right direction, though in more modern iterations/forks and together with another layer of obfuscation.
    I don't generally like to shout out names too much, since popularity among those that don't need the tools makes them more cracked down upon for people that do need them. So I'll just say that for the less obfuscated but more responsive route via rtc you use an updated hysteria as the outer layer, containing a fully homogeneous encrypted stream from a tool named after a reptile.

    As per the GDPR or something else?

    Mainly Net neutrality rules. Net neutrality just barely allows basic DPI, though it already heavily restricts what ISPs can actually do with that inspection. Wikipedia: EU net neutrality violations. Note that the 2007 case there happened well before regulations were strictened.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 9 hours ago (1 child)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 54 minutes ago* (last edited 48 minutes ago)

    This seems really cool! Although, if I already use a VPN, the packets would've already exited the VPN node before they were routed to a hysteria insrance. If the normal route without a proxy is:

    MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node -> "clearnet" -> destination host (and back in reverse)

    Then I don't understand where and how I could place a proxy in a meaningful way. If I for instance ran in on my public facing, non VPN router, the decrypted traffic would be visible during the "hop" from the VPN to my router:

    MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node -> "clearnet" -> MyHysteriaRouter[WAN -> http/3 masq -> WAN] -> "clearnet" -> destination host (and back in reverse)

    Unless I use hysteria to obfuscate right here in my LAN before even sending it out to my VPN router? Because then the protocol footprint/fingerprint wouldn't be that of a torrenting protocol, but that of http traffic?

    Torrenting client -> MyHysteriaServer[http/3 masq] -> MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node -> "clearnet" -> destination host (and back in reverse)

    And also perhaps for traffic that does not already use a VPN hysteria is a good obfuscator?

    Please do forgive and correct any wrong assumptions on my part! 😊

  • permalink
  • fedilink
  • source
  • parent