163
Mullvad: Reminder that OpenVPN is being removed January 15th 2026 (mullvad.net)
submitted 1 year ago by to c/privacy@lemmy.ml
28 comments fedilink hide all child comments
 

Not particularly pleased about the decision when OpenVPN is the most supported protocol.

Meanwhile their competitor IVPN even does IPsec.

you are viewing a single comment's thread
view the rest of the comments
[–] 32 points 1 year ago (6 children)

I assume this is because, in addition to the missing ciphers as referenced in the linked article, OpenVPN, even though it uses TLS, it initially uses a very identifiable handshake before initiating TLS, which is not hard to block. I have personally had problems specifically with OpenVPN being targeted/blocked in this way.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 21 points 1 year ago

    Wireguard is not difficult to block either, it's not designed to be hidden. China, Russia, etc have learned long ago how to detect and block it. The only semi-reliable way to bypass sophisticated VPN blocking techniques is to use protocols that mask as regular https traffic (and self-host it since well know public VPNs will of course be dealt with by simply blocking packets to their ip addresses).

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 10 points 1 year ago (3 children)

    And I specifically had luck with OpenVPN TCP on port 443 on network which DPI-blocked Wireguard.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 1 year ago

    Yeah OpenVPN is often used for business reasons (e.g. by remote workers), so it's usually not blocked wholesale, only throttled (and known public VPNs providers and blocked via blacklisting their endpoints' ip addresses). Wireguard meanwhile is used much more rarely so there is less fallout from blocking it completely.

  • permalink
  • fedilink
  • source
  • parent