Bypass Great Firewall of China, Iron Curtain (Russia), Iran, KSA and other super restrictive networks 2024

Hello all as my first introduction post I wanted to share some information which I saw was missing on here.

For those who travel and wish to, in an easy manner, quickly and easily, bypass firewalls with high success rate this guide is the gateway to that rabbit hole. I prefer the approach of letting people research for themselves which in turn usually leads to fruitful conversation so this guide will be straight to the point as I am.

A quick note is this short guide will NOT make you anonymous. Using only proxies or only VPNs or only Tor will get you caught without doubt and I say this with multiple years of experience and inside knowledge about how these things work. If you are a target of high interest even chaining several of these technologies will not work. A much more comprehensive and in-depth approach is needed to deflect 'NSA-level' network detection as well as deep understanding from the physical to the network layer to truly remain anonymous. This is out of the scope of this guide.

This guide WILL help you access your legitimate business dealings where legitimate also covers gray areas such as legality of services or products in specific country or region.

Intro

You have all heard many different VPN brands advertising how they work in China, Iran, KSA and others. They are the same ones repeated over and over. Many of the top VPN companies are owned and operated by people highly intertwined with intelligence agencies. Any mainstream services are pretty bad and the way to go around it to ensure top protection of your data is to do it yourself. In this threat scenario the adversary will almost always know where you are connecting to, who you are speaking to etc. however they will not know the contents of it. Knowing the who is more than enough for a dedicated intel agency to figure out/hack the rest so always take in mind your business and personal threat landscape.

VPNs like any other technology have use cases where they performs excellent and in contrast where they are s**t. The nature of VPNs itself can make it problematic to apply to your own situation such as you want to run the VPN 24/7 making it easy for motivated adversaries most notably the Chinese firewall to identify and shutdown your access. The Great Firewall identifies all kinds of VPN and proxy technologies however there are always improvements and advancements. VPNs unfortunately do not have a lot of 'plugins' to prevent very strong network censorship. Although obfuscated VPNs with obfs4 (yes same as Tor bridges) or openvpn with TLS-CRYPT or channeling it through SSH are great easy alternatives they eventually get recognized and draw more attention than needed. If you would like to be more creative you can even channel your VPN through DNS (port 53) using iodine and be able to bypass hotspots in the airport or hotel or anywhere where they want you to pay.

Regardless of what you choose to look at VPNs are very hard and hit and miss and there is nothing more annoying than your connection dropping all the time. Some protocols like Wireguard or custom variation of openvpn might not be implemented today in the firewall rules but it does not stop network admins for adding it tomorrow. Taking on the Great Firewall takes more than spray and pray.

On a good note VPNs however can be useful as further protection once you have 'gotten out' of the restrictive networks and into more friendly ones.

Background Reading:
medium.com/@tesla8877/demystifying-the-workf…dc7f393b8583Different vpn protocols and why they weak, openvpn wireguard best others have some use.

vpnessentials.com/articles/how-vpn-is-detected/VPN detection overview.

iodine lets you tunnel IPv4 data through a DNS server. This can be useful in situations where Internet access is firewalled, but DNS queries are allowed. It needs a TUN/TAP device to operate. The bandwidth is asymmetrical, with a measured maximum of 680 kbit/s upstream and 2.3 Mbit/s downstream in a wired LAN test network. Realistic sustained throughput on a Wifi network using a carrier-grade DNS cache has been measured at some 50 kbit/s upstream and over 200 kbit/s downstream. iodine is the client application, iodined is the server.

Note: server and client are required to speak the exact same protocol. In most cases, this means running the same iodine version. Unfortunately, implementing backward and forward protocol compatibility is usually not feasible.

In TLS mode, OpenVPN establishes a TLS session to perform a key exchange over that TLS session to obtain the keys used to encrypt/authenticate the tunnel payload data. This is a normal TLS session, just as if you'd open a HTTPS website in your browser, except that it won't just perform server authentication but also client authentication and thus the client will require a cert with private key, too.

The TLS session exchange on itself should be secure, after all it's all that you have when you visit an online banking site for example but that's only the theory. In practice every protocol has weaknesses and even if the protocol would not have any, the protocol implementation can have weaknesses, too. To make it even harder for an attacker to make use of such weaknesses, you can use tls-crypt, which will encrypt and authenticate the TLS packets using keys from a static key file. Now an attacker would also need to get his hands on a copy of that key file, otherwise even knowing an usable attack and having the possibility to pull it off (e.g. being able to monitor traffic or perform a man-in-the-middle attach) won't help him.

With tls-crypt, all data running on the "TLS channel" is encrypted and authenticated with the same algorithms as the tunnel payload data and with the keys from the static key file. For the TLS payload data (user authentication, key exchange, config push, etc.) this means, this data is encrypted and authenticated twice. Once by tls-crypt and once by the TLS session itself, as a TLS session itself is used to encrypt and authenticate data and, of course, even if tls-crypt is not used, the user authentication, the key exchange, and the configuration push must be encrypted and authenticated; otherwise how would the whole protocol be secure if that wasn't the case?

Despite adding extra security for the paranoid VPN admin (albeit, considering the horrible SSL/TLS bugs found the last couple of years, these people appear much less paranoid as they used to), it also has another positive effect: It prevents certain kind of denial of service attacks. Even if an attacker cannot break into your VPN, he may still try to open thousands of TLS sessions at the same time. Not being able to provide a valid certificate, all of these sessions will fail in the end but until that is the case (will take 60 seconds by default), a TLS session object can use a significant amount of memory resources for a small embedded device and opening thousands of these can quickly bring such a device down. With tls-crypt, already the first packet sent will not authenticate/decrypt correctly and thus is immediately discarded. There is no need to even create a TLS session object in that case.

This provides several benefits:

It hides the initialization of a TLS handshake with a OpenVPN server. This is helpful in some situations when OpenVPN protocol signature is detected and blocked.
It prevents TLS denial of service attacks. With tls-auth the attacker can open thousands of TLS connections simultaneously but not provide a valid certificate, jamming the available ports. With tls-crypt the server would reject the connection up-front at step 1.
Data is encrypted twice, once by tls-crypt and once by the TLS session.

Note this only covers TCP tunneling, it will not mask it over HTTP(S) so it will not be protected if your firewall performs Deep packet Inspection or header analysis etc such as the networks we are talking about here.

wireguard.com/known-limitations/github.com/wangyu-/udp2rawgithub.com/rfc1036/udptunnel

What about proxies?

Everyone has heard what and knows what proxies are. If you do not please search it up.

geonode.com/blog/proxy-types-comparisonproxyway.com/guides/types-of-proxies
As a general rule proxies are like condoms - use once and throw away. In the situation of bypassing strong network censorship though that might not be the case. The explanation is simple as it would be a 'not-worth-for-most-people' operating expense as new servers, new IPs, new domains (e.g domain fronting) would be required. There are different proxy providers you can use where their servers act as proxies however trusting someone else especially with the first hop of your connection is never a smart idea. That is why having one or two own proxy servers can be really beneficial to ensure integrity and confidentiality of the transmitted data.

Proxies are easier to innovate on as most of the time they do not offer security but only act as an almost transparent bridge. If the adversary can detect what the connection is and its content as it is in more modern DPI systems they will be 'happy' - even in situation where you can provide random data encapsulated in a weak cipher while having the actual data encrypted further down. Thus users should not expect cryptographically audited code from proxies to ensure your encrypted tunnel. The solution I will present in the next section however does have the best data security currently in development but again it is in no way replacement for the core functionality of VPNs.

https://security.stackexchange.com/...china-get-past-the-great-firewall-in-practicetechbullion.com/navigating-the-great-firewal…ns-in-china/
How to bypass Great Firewall of China, Iron Curtain (Russia), Iran, KSA and other super restrictive networks in 2024?

A key point to understand is nothing will work forever. Protocols change, new are created, old ones become detected if they are not updated and so on. Even with working solutions like I am going to point out there is no guarantee your connection will not be silently dropped. It might even work for some time and then stop working - they currently are (and have been) utilizing 'AI' based pattern recognition. These can still be bypassed either mostly by randomizing your paths, time of day for connections and destinations as well as take into account in your mind how you connect each time and if e.g 'you connected X amount of times through Y at time Z' will that be put on the radar?

Establishing a pattern and getting comfortable is not only inducing a fake security for yourself (and your loved ones) and lowering your defenses automatically but also adds predictability which will be used and leveraged by bad actors such as LE striking in time of their choosing when you are at the weakest/most vulnerable. The same principle applies when building a team - they will not attack you directly or other experienced members but go for the weakest link. That is why it is called the weakest link because it can break the strong chain.

Reusing proxies you have setup can be beneficiary if for example they are behind services which they can not ban/restrict without affecting a large portion of the native population such as Alibaba cloud or Amazon AWS. That in itself you can understand how it can be problematic from an operational security (opsec) point of view but again in this scenario we are not trying to be completely anonymous but bypass firewalls so we can work on our businesses.

Without further to do I present to you XTLS.

github.com/XTLS/Xray-corecloudzy.com/blog/v2ray-vmess-vs-vless-vs-trojan/vk.com/@s0r0kan-tehnologii-obhoda-blokirovok…steria-cloak
There is no point to reiterate the documentation and explanations on there or how XTLS is built from another project etc. The community behind these tools is big and you will learn a lot more by doing your own research.

I only have a restrictive ISP what simple thing can I do?
The only simple thing to do in a scenario where you are not in any of the aforementioned networks but just at a shitty ISP would be to look at the background reading about utilizing VPN connection by tunneling through DNS, SSH, encrypting the tunnels themselves and so on. Most of these can also help with throttling in especially public WiFi networks where for example youtube videos are prioritized while whatsapp calls are bandwidth restricted.

I want a simple and easy solution? What should I do?
Being lazy in your mindset is your first mistake. Security is never easy and security is a process not a state. Every time you want to do the 'simple' or 'easy' remember to ask yourself if you were in say prison (even if you business was in the gray area) would you have done the work for an extra 2-3 hours rather than spend years living and listening to constant s**t. The choice then becomes easy and effortless. As they say no pain no gain so why make it gain and then pain and more pain and in the end no gain? :)

Last edited: Feb 14, 2024

charliechaplin said:

Very good, thanks for make this thread. Which residential proxy do you recommend? I'm currently using iproyal but are not too good.

It depends a lot on your needs. Marketing, anonymity, scraping etc. Most you need to try and check for yourself and it can also be country-specific where some are bad they are good for other countries. Try to look which antidetect browsers partner with, it can give you some good idea without needing to search on certain forums.

uplana said:

Wow, what a thread you've created there; it's both educational and in-depth, with many details. It must be a true pleasure to read for those users who want to operate in China & Russia without being censored.

I like that you describe all the technical aspects of such a setup in detail, which must be said to be a bit complicated for the average person, but I would think that one could hire you on a consultancy basis to help, right?

To be completely honest I do not currently do that as most likely it would not be worth my time. The article is an educational contribution to the forum rather than any business promotion of sorts. I am open to suggestions regardless and if you have any question feel free to send a message.

charliechaplin said:

For marketing. I already work with Adspower. Thanks

I sent you in a PM some suggestions.

Last edited: Mar 2, 2024