Ask HN: The government of my country blocked VPN access. What should I use?

1338 points by rickybule 263 days ago | 732 comments

Indonesia is currently in chaos. Earlier today, the government blocked access to Twitter & Discord knowing news spread mainly through those channels. Usually we can use Cloudflare's WARP to avoid it, but just today they blocked the access as well. What alternative should we use?

_verandaguy 263 days ago |

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s).

- First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN providers partner with local orgs who can figure out the safest and most efficient ways to distribute a VPN package in countries at risk of censorship or undergoing censorship.

- Once you've got the software, you should try to use it with an obfuscation layer.

Obfs4proxy is a popular tool here, and relies on a pre-shared key to make traffic look like nothing special. IIRC it also hides the VPN handshake. This isn't a perfectly secure model, but it's good enough to defeat most DPI setups.

Another option is Shapeshifter, from Operator (https://github.com/OperatorFoundation). Or, in general, anything that uses pluggable transports. While it's a niche technology, it's quite useful in your case.

In both cases, the VPN provider must provide support for these protocols.

- The toughest step long term is not getting caught using a VPN. By its nature, long-term statistical analysis will often reveal a VPN connection regardless of obfuscation and masking (and this approach can be cheaper to support than DPI by a state actor). I don't know the situation on the ground in Indonesia, so I won't speculate about what the best way to avoid this would be, long-term.

I will endorse Mullvad as a trustworthy and technically competent VPN provider in this niche (n.b., I do not work for them, nor have I worked for them; they were a competitor to my employer and we always respected their approach to the space).

teeray 263 days ago | |

> First things first, you have to get your hands on actual VPN software and configs.

It would be nice if one of the big shortwave operators could datacast these packages to the world as a public service.

ianburrell 262 days ago | | |

There isn't enough bandwidth in HF to transmit data. Digital HF audio is 20 kHz wide so maybe 50kbps. The entire HF band is only 3-30 MHz.

mfiro 262 days ago | | |

The problem is the countries, which censor Internet and block VPNs, also jam shortwave radio signals.

hattmall 262 days ago | | |

But then couldn't the authorities just intercept it too and then block those ips?

downrightmike 263 days ago | | |

https://github.com/StreisandEffect/streisand

ivanstepanovftw 262 days ago | |

This is no 'nothing special' with Obfs4proxy. DPI sees it as random byte stream, thus your government can decide to block unknown protocols. Instead, you should trick DPI into thinking it sees HTTPS. Unless your government decides to block HTTPS.

rafram 262 days ago | | |

> your government can decide to block unknown protocols

Has any government ever done that? Seems like it would just break everything (because the world is full of devices that use custom protocols!) at great computational expense.

verandaguy 262 days ago | | |

Hi, posting from my main account (I'm also the poster of the GP comment).

"Nothing special" in this case was meant to describe the fact that it's random data with no identifiable patterns inherent to the data; you're absolutely right that that's what obfs4 does. I understand the confusion though, this phrasing could be better.

    > your government can decide to block unknown protocols

This does happen, though when I worked in the industry it wasn't common. Blocking of specific protocols was much more of an obstacle.

    > you should trick DPI into thinking it sees HTTPS. Unless your government decides to block HTTPS

HTTPS blocking (typically based on either the presence of a specific SNI field value, or based on the use of the ESNI/ECH TLS extension) was prolific. I won't comment on whether this was effective or not in impeding efforts to get people in these places connected.

I will say though, Operator's Replicant does something similar to what you're describing in that it can mimic unrelated protocols. It's a clever approach, unfortunately it was a bit immature when I was working in that area so the team didn't adopt it while I was around.

conradev 262 days ago | | |

WebRTC is another great option: https://snowflake.torproject.org

It's used for a lot of legitimate traffic as well, so a bit harder to block.

commandersaki 262 days ago | | |

The only VPN technology I see that blends as HTTPS is MASQUE IP Proxying, and the only implementation I know that does this is iCloud Private Relay. It is also trivial to block because blocking 443/udp doesn't really affect accessing the Internet.

tiberious726 262 days ago | | |

Exactly this. Hell, for OP's use case of accessing things like twitter, a good old fashioned https proxy would be entirely fine, and likely not even illegal.

mrs6969 262 days ago | | |

How can you do that exactly ?

userbinator 262 days ago | | |

Unless your government decides to block HTTPS.

In which case you use stenography, but I believe even the Great Firewall of China doesn't block HTTPS completely.

77pt77 262 days ago | |

Obfs4proxy and Shapeshifter are an absolute PITA to install.

Get your own VPS server (VPS in EU/US with 2GB of ram, 40GB of disk space and TBs/month of traffic go for $10 a year, it's that cheap). Never get anything in the UK and even USA is weird. I'd stick with EU.

Install your software (wireguard + obsfuscation or even tailscale with your own DERP server)

Another simpler alternative is just `ssh -D port` and use it as a SOCKS server. It's usually not blocked but very obvious.

mrb 262 days ago | | |

In my experience, in China as of 2016, "ssh -D" vasn't reliable at all, I wrote more details at https://blog.zorinaq.com/my-experience-with-the-great-firewa... (see "idea 1")

kijin 262 days ago | | |

Which countries you need to avoid depends on your threat model. For example, there is need to avoid the USA if all you're trying to do is bypass the Chinese firewall. There might even be a legitimate use case for pretending to have a UK IP address.

Since OP is in Southeast Asia, a VPS in JP or SG will probably hit a decent balance between latency and censorship avoidance.

extraduder_ire 262 days ago | | |

Where are you finding a VPS in the EU for $10/year? Any I've seen are about 5-6 times that much.

azalemeth 263 days ago | |

Thank you very much for a detailed answer. Might I rudely ask -- as you're knowledgeable in this space, what do you think of Mullvad's DAITA, which specifically aims to defeat traffic analysis by moving to a more pulsed constant bandwidth model?

_verandaguy 263 days ago | | |

DAITA was introduced after my time in the industry, but this isn't a new idea (though as far as I know, it's the first time this kind of thing's been commercialized).

It's clever. It tries to defeat attacks against one of the tougher parts of VPN connections to reliably obfuscate, and the effort's commendable, but I'll stop short of saying it's a good solution for one big reason: with VPNs and censorship circumvention, the data often speaks for itself.

A VPN provider working in this space will often have aggregate (and obviously anonymized, if they're working in good faith) stats about success rates and failure classes encountered from clients connecting to their nodes. Where I worked, we didn't publish this information. I'm not sure where Mullvad stands on this right now.

In any case -- some VPN providers deploying new technology like this will partner with the research community (because there's a small, but passionate formal research community in this space!) and publish papers, studies, and other digests of their findings. Keep an eye out for this sort of stuff. UMD's Breakerspace in the US in particular had some extremely clever people working on this stuff when I was involved in the industry.

zelphirkalt 262 days ago | | |

If you are on a limited data plan, beware, DAITA produces a lot of traffic.

pipes 262 days ago | |

Thanks for this, UK citizen/subject here I believe the UK government is likely to go down the path of banning vpns.

belter 262 days ago | | |

It will be done very soon....

"Dame Rachel told BBC Newsnight: "Of course, we need age verification on VPNs - it's absolutely a loophole that needs closing and that's one of my major recommendations." - https://www.bbc.com/news/articles/cn438z3ejxyo

They phrase it as age verification, but what they mean is the VPN provider needs to provide them the client list...

laylower 262 days ago | | |

Can someone competent pull together a manual to set a vpn with obfuscation? I am sure it will be well received.

A github repo would be ideal really

Cypher 262 days ago | | |

gotta go underground, freedom is now an enemy of the crown.

kilroy123 262 days ago | | |

ISPs here are already blocking popular ones.

lossolo 262 days ago | |

Mullvad is a bad choice for this particular case because they publish all their IPs, which makes them very easy to block. You should look into VPN providers that do not publish their IPs and that have a wide range of IP classes and multiple ASNs, which look like ordinary networks not associated with VPNs. In my experience, NordVPN and ExpressVPN have many of these.

thenthenthen 262 days ago | | |

Express and Nord are completely useless in China. Mullvad worked fine two years ago but is getting worse, not sure if it still works currently.

myshoemouth 263 days ago | |

I'm curious. How does a state actor do actual DPI without pushing certs to end user devices?

teraflop 263 days ago | | |

The "inspection" part of DPI isn't limited to encrypted payloads. It's straightforward enough to look at application-level protocol headers and identify e.g. a Wireguard or OpenVPN or SSH connection, even if you can't decrypt the payload. That could be used as sufficient grounds to either block the traffic or punish the user.

mrbluecoat 263 days ago | | |

Network fingerprinting, like https://github.com/FoxIO-LLC/ja4

orthoxerox 262 days ago | | |

Pushing certs to end user devices is simple. First you create your own national CA. Then you make all government services use TLS certificates signed by the national CA. Then you make phone vendors preinstall the root cert of the national CA into the trust store if they want to sell them in your country. Then you make your ISPs buy and install MITM appliances.

trod1234 262 days ago | | |

There are a couple of ways.

The main one is called an Eclipse Attack in cyber circles, and it can be done at any entity operating at the ASN layer so long as they can position themselves to relay your traffic.

The adversary can invisibly (to victim PoV) modify traffic if they have a cooperating rootPKI cert (anywhere in the ecosystem) that isn't the originating content provider, so long as they recognize the network signature (connection handshake); solely by terminating encryption early.

Without a cert, you can still listen in with traffic analysis, the fetched traffic that's already been encrypted with their key (bit for bit), as known plaintext the math quickly reduces. SNI and a few other artifacts referencing the resources/sites are not part of the encrypted payload.

Its more commonly known in a crypto context, but that kind of attack can happen anywhere. It even works against TOR. One of the first instances (afaik) was disclosed by Princeton researches in 2015, under the Raptor paper.

oasisbob 263 days ago | | |

DPI refers to a broad class of products which attempt to find signals and categorize traffic according to a ruleset, either to block it or throttle the speeds, etc.

While access to plaintext is useful, it's not required for other rules which are eg looking at the timing and frequency of packets.

dev_l1x_be 262 days ago | | |

Because you are leaking information left and right with TCP / DNS and all these basic protocols that powering the internet today. When these were designed people were happy that it worked at all and nobody really tought that it should be state actor proof. Except maybe DJB. https://www.curvecp.org/

unethical_ban 263 days ago | | |

Patterns of data transmission (network behavioral analysis, I just made that term up), analyzing IP and ports, inspecting SSL handshakes for destination site. In short, metadata.

hsbauauvhabzb 263 days ago | |

I’m curious about what makes it difficult to block a vpn provider long term. You said getting the software is difficult, but can a country not block known vpn ingress points?

_verandaguy 263 days ago | | |

A country can and absolutely will block known VPN ingress points. There are two tricks that we can use to circumvent this:

- Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). Bonus points if you can leverage something like ECH (ex-ESNI) to make it harder to identify a single bucket or subdomain.

- Keep spawning new domains and subdomains to distribute your binaries.

There are complications with both approaches. Some countries block ECH outright. Some have no problem shutting the internet down wholesale for a little bit. The domain-hopping approach presents challenges w/r/t establishing trust (though not insurmountable ones, much of the time).

These are thing that have to be judged and balanced on a case-by-case basis, and having partners on the ground in these places really helps reduce risk to users trying to connect from these places, but then you have to be very careful talking to then since they could themselves get in trouble for trying to organize a VPN distribution network with you. It's layers on layers, and at some point it helps to just have someone on the team with a background in working with people in vulnerable sectors and someone else from a global affairs and policy background to try and keep things as safe as they can be for people living under these regimes.

exe34 263 days ago | |

I wonder if it can be embedded in a video stream, like a video of a lava lamp that you always have open, but the lsb of ever byte is meaningful.

_verandaguy 263 days ago | | |

That's an interesting idea, and probably something you might be able to achieve with a tool like h26forge.

It's also probably more useful to just have a connection be fully dedicated to a VPN, and have the traffic volume over time mimic what you'd see in a video, rather than embedding it in a video -- thanks to letsencrypt, much of the web's served over TLS these days (asterisks for countries like KZ and TM which force the use of a state-sponsored CA), so going to great lengths to embed your VPN in a video isn't really practical.

massung 261 days ago | |

First, this is great information in an area I know very little about.

But I’m curious - from your experience - how do you know the OP isn’t pretending in order to learn about new avenues to block or attack or to track down people who are trying to circumvent?

I don’t mean that as a “be careful”. You’re the expert compared to me and for all I know these are unblockable. Or maybe those doing the blocking would already know about them? So I’m interested in just understanding more.

btown 263 days ago | |

This makes me wonder: are there "cloud drive virtual sneakernet" systems that will communicate e.g. by a client uploading URL request(s) as documents via OneDrive/SharePoint/Google Drive/Baidu etc., a server reacting to this via webhook and uploading (say) a PDF version of the rendered site, then allowing the client to download that PDF? You effectively use the CDN of that service as a (very slow) proxy.

Of course, https://xkcd.com/538/ applies in full force, and I don't have any background in the space to make this a recommendation!

jack_pp 263 days ago | | |

It doesn't apply imo as OP is probably not a high value target of the govt, he just wants to bypass his govt restrictions and I doubt the situation is so bad that the govt will send people physically to deal with people circumventing the block.

Your solution could technically work over any kind of open connection / data transfer protocol that isn't blocked by the provider but it would be an absolute pain to browse the web that way and there are probably better solutions out there.

cluckindan 262 days ago | | |

How about IPv6 over S3?

https://xeiaso.net/blog/anything-message-queue/

mulchpower 262 days ago | |

There are some techniques like fragmented TLS and reordered packets that work in some cases. Also using vanilla HTTPS transport is a good start for many places. URnetwork is an open source, decentralized option that does all of these out of the box. You can get it on the major stores or F-Droid.

pickdig 261 days ago | |

mullvad with DAITA is pretty good you can also purchase mullvad with cryptocurrencies, cash, etc.

bdd8f1df777b 262 days ago |

If you need to bypass censorship, you'll need a tool specifically designed for anti-censorship, rather than any one repurposed for that.

Since China has the most advanced network censorship, the Chinese have also invented the most advanced anti-censorship tools.

The first generation is shadowsocks. It basically encrypts the traffic from the beginning without any handshakes, so DPI cannot find out its nature. This is very simple and fast and should suffice in most places.

The second generation is the Trojan protocol. The lack of a handshake in shadowsocks is also a distinguishing feature that may alert the censor and the censor can decide to block shadowsocks traffic based on suspicions alone. Trojan instead tries to blend in the vast amount of HTTPS traffic over the Internet by pretending to be a normal Web server protected by HTTPS.

After Trojan, a plethora of protocol based on TLS camouflaging have been invented.

1. Add padding to avoid the TLS-in-TLS traffic characteristics in the original Trojan protocol. Protocols: XTLS-VLESS-VISION.

2. Use QUIC instead of TCP+TLS for better performance (very visible if your latency to your tunnel server is high). Protocols: Hysteria2 and TUIC.

3. Multiplex multiple proxy sessions in one TCP connection. Protocols: h2mux, smux, yamux.

4. Steal other websites' certificates. Protocols: ShadowTLS, ShadowQUIC, XTLS-REALITY.

Oh, and there is masking UDP traffic as ICMP traffic or TCP traffic to bypass ISP's QoS if you are proxying traffic through QUIC. Example: phantun.

reisse 262 days ago |

I also want to add here because a lot of people either mention Tor as a succesful solution, or mention why Tor is not a solution but state completely wrong reasons. And I have a good soapbox to stand once in a while.

Number one reason why Tor is dead is Cloudflare.

Let me digress here. In my opinion, Cloudflare does a lot more censoring than all state actors combined, because they singlehandedly decide if the IP you use is "trustworthy" or "not", and if they decided it is not, you're cut off from like half of the Internet, and the only thing you can do is to look for another one. I'd really like if their engineers understood what Orwellian mammoth have they created and resign, but for now they're only bragging without the realization. Or at least if any sane antitrust or comms agency shred their business in pieces.

And Cloudflare by default makes browsing with Tor unusable. Either you're stuck with endless captchas, or you're banned outright.

Number two reason why Tor is dead is all other antifraud protections combined. Try paying with Stripe through Tor. There is quite a big chance you'll get an "unknown error" of sorts on Stripe side. Try to watch Netflix in Tor - exit nodes are banned.

Everyone kept shouting "Tor bad, Tor for criminals", and it became a self-fulfilling prophecy. It's really hard to do just browse web normally in Tor, because all "normal" sites consider it bad. The "wrong" sites, however, who expect Tor visitors...

joshryandavis 263 days ago |

I lived in China for a while and there were several waves of VPN blocks. Also very few VPN services even try to actively support VPN-blocking nations anymore. Any commercial offering will be blocked eventually.

What I settled on for decent reliability and speeds was a free-tier EC2 hosted in an international region. I then setup a SOCKS5 server and connected my devices to it. You mentioned Cloudflare so whatever their VM service is might also work.

It's very low profile as it's just your traffic and the state can't easily differentiate your host from the millions of others in that cloud region.

LPT for surviving the unfree internet: GitHub won't be blocked and you'll find all the resources and downloads you need for this method and others posted by Chinese engineers.

Edit: If you're worried about being too identifiable because of your static IP, well it's just a computer, you can use a VPN on there too if you want to!

nomilk 263 days ago |

Australia and UK might soon go down this path.

Something quite depressing is if we (HN crowd) find workarounds, most regular folks won't have the budget/expertise to do so, so citizen journalism will have been successfully muted by government / big media.

Humorist2290 263 days ago |

- Tor. Pros: Reasonably user friendly and easy to get online, strong anonymity, free. Cons: a common target for censorship, not very fast, exit nodes are basically universally distrusted by websites.

- Tailscale with Mullvad exit nodes. Pros: little setup but not more than installing and configuring a program, faster than Got, very versatile. Cons: deep packet inspection can probably identify your traffic is using Mullvad, costs some money.

- Your own VPSs with Wireguard/Tailscale. Pros: max control, you control how fast you want it, you can share with people you care about (and are willing to support). Cons: the admin effort isn't huge but requires some skill, cost is flexible but probably 20-30$ per month minimum in hosting.

rd07 262 days ago |

I live in Indonesia, and I don't find any recent news that mention X (formerly Twittwr) and or Discord being blocked by the government. The only relevant news from a quick Google search I can find is about the government threatened to block X due to pornography content in 2024. You can even check for yourself if a domain is blocked by visiting https://trustpositif.komdigi.go.id/.

Also for your unability to access the VPN, as far as my experience goes, in the past some providers do block access to VPN. But, I am not experiencing that for at least the last 5 years.

So, maybe you can try changing your internet provider and see if you can connect to VPN?

andunie 262 days ago | |

How can it be that one person living in Indonesia says everything is blocked and the country is in chaos and another, very calmly, is completely unaware and can't even find any news about it? This is so odd. What is the truth?

atsuzaki 262 days ago | | |

The context that was likely left out due to HN rules is, there are mass protests turned violent in the face of police brutality in several cities. The Indonesian government has a history of blocking/throttling internet access in immediate areas of the unrest to limit coverage.

konimex 262 days ago | | |

Indonesia is a big country with over ten thousand islands and uneven coverage. What is blocked on one ISP might not be enforced on another (e.g. the state-owned ISP might block or use DNS poisoning on several "non-compliant" DNS providers but my current ISP doesn't). Also, in addition to what the sibling commenter (and another commenter regarding Cloudflare outage) said there might be a general overload on the mobile network near the affected areas since there are lots of users and limited bandwidth.

csomar 262 days ago | | |

It's a 270 million people country with over 10K+ islands. Last year I visited Borobudur and was surprised that the Yogjakarta region is autonomous and they have their own king.

reinaldnaufal 262 days ago | |

There was a reported outage of cloudflare in Jakarta, while simultaneously people can't access Twitter and Discord. The worst part is that it coincides with the time when people need the information to find a safe route to go home after the protest.

rd07 262 days ago | | |

Yes, this is the most likely explanation I can find, not a nationwide blockade.

wildylion 262 days ago |

As a long-standing supporter of Internet freedoms in Russia, I could advise you to use multiple tools at the same time, to avoid them being blocked.

What would probably work UNLESS they roll out pretty sophisticated DPI that could block by signatures and do active probing:

1. AmneziaVPN (https://amneziavpn.org) - they have the hosted option, or you could run your own on a cheap VPS (preferable). They use Xray/REALITY or a variant of Wireguard with extra padding that confuses DPIs. Should be good enough.

2. Psiphon

3. Lantern

4. Sometimes Tailscale works surprisingly well (even in Russia where they have advanced DPI systems!)

Here's a link to several Tor browser mirrors for you so you could download the VPN software itself:

https://mirror.freedif.org/TorProject/

https://mirrors.mit.edu/torproject/download/

A couple of Tor bridges in case Tor is blocked:

  webtunnel [2001:db8:9947:43ae:8228:97b7:7bd:2c2e]:443 6E6A3FCB09506A05CC8E0D05C7FEA1F5DA803412 url=https://nx2.nexusocean.link ver=0.0.1
  webtunnel [2001:db8:a436:6460:fa7b:318:4e8e:9de3]:443 F76C85011FD8C113AA00960BD9FC7F5B66F726A2 url=https://disobey.net/vM8i19mU4gvHOzRm33DaBNuM ver=0.0.2

rieslingspecial 263 days ago |

This might not be the case for Indonesia currently, but for countries like Russia, China, Iran most of the mentioned solutions will not work. I've had to evade Russian censorship for years now - the censors (Roskomnadzor) use DPI and other means of classifying network traffic, and currently the following things are outright blocked:

- Tor

- Wireguard and derivatives (incl. Mullvad, Tailscale, ProtonVPN)

- OpenVPN

- Shadowsocks (incl. Outline)

What still works is Xray-core [1] with vless and Reality protocols, whatever those mean. Xray-core is an innovation over v2ray [2]. v2ray might also still work, but I've never tried it. If you have the capacity to run your own VPS, the simplest solution would be to install the 3x-ui [3], which is something like "Xray-core with a simple to use UI in a single package ready-to-use", but you'd also need to setup some basic security measures and a firewall.

For those technically inclined, here [4] is a rough ansible playbook to install 3x-ui on a blank Debian machine. Additional configuration will be needed in the UI itself, there is a lot of online tutorials, and I link to one of them in [5] (in Russian, unfortunately). Don't just trust me blindly, please review before running!

There are also commercial xray-aware VPN providers, but I wouldn't publicly vouch for any of them.

I found it very strange that there is not much info on HN about xray and v2ray, and I also hope it stays this way for most of the people here and not here. However, we live in a weird reality and have to actively engage in such an arms race now.

As a side note, if anyone here has quality info about security of the xray-core implementation, I'd be happy to get familiar. I didn't look at the code myself and still am slightly suspicious, but oh well it works :shrug:

[1]: https://github.com/XTLS/Xray-core

[2]: https://github.com/v2fly/v2ray-core

[3]: https://github.com/MHSanaei/3x-ui/

[4]: https://pastebin.com/DjFQ8c6Z

[5]: https://habr.com/ru/articles/731608/

akho 261 days ago | |

Shadowsocks still works. It can be detected through active probing, but blocking it automatically is a bit above their current capabilities.

No reason not to use the *rays anyway.

jszymborski 263 days ago |

Mastodon is not easy for regimes to completely block, and most instances won't block you for using Tor. Mastodon saw a huge migration from Brazil when X was blocked there.

https://joinmastodon.org/

barbazoo 263 days ago | |

Wouldn't it be easy to block the individual servers, e.g. https://mastodon.social?

evulhotdog 263 days ago | | |

There are many instances of Mastodon, and due to its federated nature, you can use any of them to access it, and even host your own.

kragen 263 days ago | | |

Sure, but if you have an account on a different server, you can still see things posted on mastodon.social if you have followed someone there.

int_19h 263 days ago | |

It would be easy to block on protocol level. Countries that block VPNs usually progress to that level pretty fast once they discover that simple IP blocks don't work.

jszymborski 263 days ago | | |

The traffic looks like any other web page.

doix 263 days ago |

I'm currently traveling in Uzbekistan and am surprised that wireguard as a protocol is just blocked. I use wireguard with my own server, because usually governments just block well known VPN providers and a small individual server is fine.

It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use.

nine_k 263 days ago |

XRay / XTLS-Reality / VLESS work rather fine, and is said to be very hard to detect, even in China.

I followed [1] to set up my own proxy, which works pretty fine. More config examples may be helpful, e.g. [2].

[1]: https://cscot.pages.dev/2023/03/02/Xray-REALITY-tutorial/

[2]: https://github.com/XTLS/Xray-examples/blob/main/VLESS-TCP-XT...

zeropointsh 263 days ago | |

The great thing about China's Great Firewall is that really good options to circumvent censorship have been around for a while. Was waiting for someone to bring up XRay! Alternatively, here is a great write up of using V2Ray[1]. May be worth OP looking into, as a blogger I found noted[2] is an alternative to a VPN, and may work. [1]: https://www.v2ray.com/en/ [2]: https://sequentialread.com/v2ray-caddy-to-access-the-interne...

gck1 262 days ago | |

Also sing-box [1]. I don't use it for its primary use case of censorship circumvention, but rather for some highly complex routing configurations it supports.

My use case consists of passing some apps on my Android through interface A (e.g. banking apps through my 5G modem), some apps through US residential proxy (for US banks that don't like me visiting from abroad), and all the rest through VPN. And no root required!

It's wild that GFW triggered creation of this and nothing like it existed / exists.

[1]: https://github.com/SagerNet/sing-box

taminka 262 days ago | |

im curious, isn't ALL of your traffic appearing to be to just one website the most obvious giveaway?

akho 262 days ago | | |

*ray clients typically allow configuration of routing. So you can send only blocked stuff through the tunnel; or, in reverse, send some known-working stuff (e. g. local domain) direct. Also works as adblock.

mynameis777 262 days ago |

Hey there – greetings from one of the most heavily censored regions in the world.

I once considered using an Indonesian VPS to bypass my country's censorship. However, the Indonesian VPS provider actually refused my direct connection request from my country. I was quite frustrated at the time, wondering why they refused me. But now I understand – it turns out these two countries are in cahoots.

Emmm, if you want to break through the censorship, you can start here: https://github.com/free-nodes/v2rayfree

It provides many free proxy nodes that are almost unusable in my country, but might work in Indonesia (although you may need a lot of patience to test which ones actually work).

A good proxy software is Clash.Meta for Linux (you’ll need to install Linux on Windows using VMware, then set up Clash.Meta).

You can start by installing the Windows version of the proxy client software (V2rayN) for a simple way to bypass censorship, but it's not a long-term solution.

A special reminder: these free nodes are not secure (they could very well be "honeypot" lines, but if you're not from my country, the police should have no way of dealing with you). You need to quickly set up your own route by purchasing a U.S. VPS and setting up your own proxy nodes.

Lastly, I recommend a good teacher: ChatGPT. It will solve all the problems you encounter on Linux. Also, use the Chrome browser with translation.

Good luck!

jauntywundrkind 263 days ago |

Nations severing peoples connections to the world is awful. I'm so sorry for the chaos in general, and the state doing awful things both.

Go on https://lowendbox.com and get a cheap cheap cheap VPS. Use ssh SOCKS proxy in your browser to send web traffic through it.

Very unfancy, a 30+ year old solution, but uses such primitive internet basics that it will almost certainly never fail. Builtin to everything but Windows (which afaik doesn't have an ssh client built-in).

Tailscale is also super fantastic.

int_19h 263 days ago | |

> uses such primitive internet basics that it will almost certainly never fail.

It already fails in China and Russia. Simply tunneling HTTP through SSH is too easy to detect with DPI.

> Windows (which afaik doesn't have an ssh client built-in)

It has had both SSH client and SSH server built-in since Win10.

sertsa 263 days ago | |

Windows has had both ssh client/server for years

cogman10 263 days ago |

IMO, the safest route for an individual with tech competency is to setup a small instance server in the cloud outside your country and use ssh port forwarding and a proxy to get at information you want.

For an example of a proxy service https://www.digitalocean.com/community/tutorials/how-to-set-...

That will give you a hard to snoop proxy service that should completely circumvent a government blockaid (they likely aren't going to be watching or blocking ssh traffic).

asqueella 262 days ago | |

Advanced enough censors (who have DPI) do block or slow down ssh, e.g.: https://serverfault.com/questions/1122015/ssh-blockedfor-for...

cogman10 262 days ago | | |

That's a pretty strict censorship that basically locks your digital infrastructure into your country.

jychang 262 days ago | |

That hasn't worked for china since before 2020, you're years out of date.

dongcarl 263 days ago |

Give Obscura a try, we get around internet restrictions by using QUIC as transport, which looks like HTTP/3 and doesn't suffer from TCP-over-TCP meltdown: https://obscura.net/

Technical details: https://obscura.net/blog/bootstrapping-trust/

Let us know what you think!

Disclaimer: I'm the creator of Obscura.

tamimio 262 days ago | |

Looks good, just one note: btc was never meant for anonymity, if you would add Monero as a payment option that would be great.

McNulty2 263 days ago | |

If they're blocking other protocols then likely they're blocking quic also.

dongcarl 263 days ago | | |

Very possible, though many of our users are saying that in network environments where WireGuard is blocked they were able to use Obscura.

mmwelt 262 days ago | |

Looks like MacOS and iOS only, which is unfortunate. Support for at least Windows and Android is needed for wider adoption. Linux would also be nice.

dongcarl 261 days ago | | |

We're working on it! Android is next :-)

jszymborski 263 days ago |

Folks who are looking to bypass censorship, and those who live in countries where their internet connection is not currently censored who would like to help, can look to https://snowflake.torproject.org/

neurostimulant 262 days ago |

Probably just an unfortunate timing. Cloudflare is going down in this region [1] at the same time with the protests and unrest caused by the news of a motorcycle taxi driver who got run over by a swat car during a protest [2].

Such coincidence might seems like the government trying to do some damage control by restricting internet access, but I hope that's not what happen here. At the moment, cloudflare status for Jakarta is still "rerouted".

[1] https://www.cloudflarestatus.com/incidents/1chpg2514kq8

[2] https://www.youtube.com/watch?v=-jONV0mb9nw

genericuser256 263 days ago |

I would recommend Psiphon [1,2] most (all?) of their code is open source and their main goal is to get around censorship blocks. They do have some crypto side projects but the main product is very solid.

[1] https://psiphon.ca/ [2] https://github.com/Psiphon-Inc

adam-p 262 days ago | |

State censorship circumvention is exactly what Psiphon is for! So yes, try it.

(Disclaimer: I work there.)

0xml 262 days ago |

If VPNs don't work for you, I recommend using an anti-censorship tool with an obfuscation protocol like v2ray which is commonly used in China.

https://github.com/v2fly/v2ray-core https://github.com/XTLS/Xray-core https://github.com/net4people/bbs https://en.wikipedia.org/wiki/Great_Firewall

VortexLain 263 days ago |

The most effective solution is to use X-ray/V2ray with VLESS, or VMESS, or Trojan as a protocol.

Another obfuscated solution is Amnezia

If you are not ready to set up your own VPN server and need any kind of connection right now, try Psiphon, but it's a proprietary centralized service and it's not the best solution.

yogorenapan 263 days ago |

WireGuard should still work. Tons of different providers. I trust Mullvad but ProtonVPN has a free tier. If they start blocking WireGuard, check out v2ray and xray-core. If those get blocked... that means somehow they're restricting all HTTPS traffic going out of the country

drake99 263 days ago |

In this scenario, Chinese have very rich experience. you need to use the advance proxy tool like clash ,v2ray, shadowsocks etc.

mezyt 263 days ago | |

shadowsocks was the winner of the state of the art I had to do at work. It address the "long-term statistical analysis will often reveal a VPN connection regardless of obfuscation and masking (and this approach can be cheaper to support than DPI by a stat)" comment.

QuadmasterXLII 262 days ago | | |

Someone should create a vpn protocol that pretends to be a command and control server exfiltrating US corporate secrets from hacked servers. The traffic pattern should be similar, and god forbid Xi blocks the real exfiltrations

Arubis 263 days ago |

If you can still get SSH access and can establish an account with a VPS provider with endpoints outside your country of origin, https://github.com/StreisandEffect/streisand is a little long in the tooth but may still be viable.

kccqzy 263 days ago | |

Tunneling via SSH (ssh -D) is super easy to detect. The government doesn't need any sophisticated analysis to tell SSH connections for tunneling from SSH connections where a human is typing into a terminal.

Countries like China have blocked SSH-based tunneling for years.

It can also block sessions based on packet sizes: a typical web browsing session involves a short HTTP request and a long HTTP response, during which the receiving end sends TCP ACKs; but if the traffic traffic mimics the above except these "ACKs" are a few dozen bytes larger than a real ACK, it knows you are tunneling over a different protocol. This is how it detects the vast majority of VPNs.

mnw21cam 263 days ago | | |

One alternative would be to set up a VPS, run VNC on it, run your browser on that to access the various web sites, and connect over an SSH tunnel to the VNC instance. Then it actually is an interactive ssh session.

beeflet 262 days ago | | |

You could just run links or some text-based browser on the other side.

Perhaps you could also write a script that would mimic typing over the link.

Havoc 262 days ago | | |

>Tunneling via SSH (ssh -D) is super easy to detect.

Mind elaborating on a how level how they'd distinguish? Just volume of it?

bsimpson 263 days ago | |

15 years ago, I was using EC2 at work, and realized it was surprisingly easy to SSH into it in a way where all my traffic went through EC2. I could watch local Netflix when traveling. It was a de facto VPN.

Details are not at the top of my mind these years later, but you can probably rig something up yourself that looks like regular web dev shit and not a known commercial VPN. I think there was a preference in Firefox or something.

mikestorrent 263 days ago | | |

The issue these days is that all of the EC2 IP ranges are well known, and are usually not very high-reputation IPs, so a lot of services will block them, or at least aggressively require CAPTCHAs to prevent botting.

Source: used to work for a shady SEO company that searched Google 6,000,000 times a day on a huge farm of IPs from every provider we could find

WarOnPrivacy 263 days ago |

I'm reading posts that indicate (at least some of) the blocking is at the DNS level.

https://old-reddit-com.translate.goog/r/WkwkwkLand/comments/...

Cloudflare says some issue affecting Jakarta has been resolved. They aren't saying what the issue was.

https://www.cloudflarestatus.com/incidents/1chpg2514kq8

rickybule 263 days ago | |

What I'm worried most are that most people are not even aware of what is DNS and how to change it.

I can't imagine those who are caught in the chaos with only their phone and unable to access information that could help them to be safe.

jhanschoo 263 days ago | | |

Generally speaking, the general population that wants to use blocked services will develop enough technical know-how to circumvent it. The biggest risk is that there are bad actors giving malicious advice and to such learners, looking to defraud or otherwise exploit them.

Nextgrid 263 days ago |

Furthermore, you can always run another VPN on top of that if you don’t trust the outer one with the actual plaintext traffic.

05 262 days ago | |

Not on mobile - iOS doesn't support nested VPNs, and neither does stock Android.

rthnbgrredf 263 days ago |

In case known VPN providers are blocked you can pick a small VPS from a hoster like Hetzner and setup your own VPN.

whyleyc 263 days ago |

I'd recommend using Outline - it's a one click setup that lets you provision your own VPN on a cloud provider (or your own hardware).

Since you get to pick where the hardware is located and it is just you (or you and a small group of friends & family) using the VPN, blocking is more difficult.

If you don't want the hassle of using your own hardware you can rent a Digital Ocean droplet for <$5 per month.

https://getoutline.org/

lucasban 263 days ago | |

I’ve set this up for friends in fairly heavily censored countries before, it has been working well so far, but as others have said, this is a cat and mouse game

herodoturtle 263 days ago |

On a related note, does anyone have insight into *why* the Indonesian government is doing this?

rickybule 263 days ago | |

there is a major protest currently happening due to the legislative body representative just giving themselves a monthly domicile stipend of ~$3300 on top of their salaries (yes, multiple), while the average people earned ~$330 monthly. the information about the protest are not broadcasted on local TVs, so the only spread of information is through social media. i guess since a lot of people went around it using VPN, the gov decided to block it too.

jofer 263 days ago | |

If it helps, here's some recent coverage:

https://www.theguardian.com/world/2025/aug/26/indonesia-prot...

teekert 263 days ago | | |

“Some demonstrators on Monday were seen on television footage carrying a flag from the Japanese manga series One Piece, which has become a symbol of protest against government policies in the country.”

TheChaplain 263 days ago | |

The official word is to counter gambling. Lately the government is not really popular after some decisions that could be interpreted as authoritative, and as citizens have spoken out about it online, causing more voices to join and protests erupting..

So well, my guess is they're trying to control it.

geephroh 263 days ago | |

https://tech.yahoo.com/social-media/articles/indonesia-urges...

NamTaf 262 days ago |

I work often in China. I somehow haven’t had my WireGuard VPN back to my own home server blocked, yet. It’s pointed to a domain that also hosts some HTTPS web services so that might help.

Prior to this, pre-Covid I used to use shadowsocks hosted on a DO droplet. Shadowsocks with obfs, or a newer equivalent (v2ray w/ vmess or vless protocol) and obfs (reality seems to be the current hotness) will probably work within Indonesia given their blocking will be way less sophisticated than China. The difference here is that it’s a proxy, not a VPN, but it makes it a lot easier to obfuscate its true nature than a VPN which stands out because obfuscation isn’t in its design.

Hosting on big public VPSs can be double edged. On one hand, blocking DO or AWS is huge collateral. On the other, it’s an obvious VPN endpoint and can help identify the type of traffic as something to block.

If you have access to reddit, r/dumbclub (believe it or not) has some relatively current info but it’s pretty poor signal to noise. Scratch around there for some leads though.

Note that this stuff is all brittle as hell to set up and I usually have a nightmarish time duct-taping it all together. That’s why I’m overjoyed my WireGuard tunnel has worked whenever I’ve visited for a year now.

One other left-field option, depending on your cost appetite, is a roaming SIM. Roaming by design tunnels all data back to your own ISP before routing out so even in China roaming SIMs aren’t blocked. It’s a very handy backup if you need a clear link to ssh into a box to set up the above, for example.

nneonneo 262 days ago |

An expensive but functional option is to enable roaming on a foreign eSIM. Getting an eSIM is relatively easy. Roaming mobile traffic is routed from the country in which the SIM is from, not the country that you're in, meaning that an eSIM from e.g. an American carrier will not be subject to the censorship in your country.

I've used this on multiple trips to China over the past decade (including a trip last year). You can find carriers that will charge very low (or even no) roaming rates.

gck1 262 days ago | |

Data-only eSIMs (e.g. ones you get from Airalo and apps like that) are not going to cut it though. You need a "full" eSIM that gives you a real number and even then, it's not a guarantee that your traffic will be routed via the country eSIM is from. Tello does route (or rather, exit) via US for example, but it's 2¢/MB.

Chinese forums / blogs have a lot of information about this stuff. I usually ask ChatGPT to translate "Research topic re: some form of circumvention and give me forum posts and blog posts about it" to Chinese, then paste that into DeepSeek with search enabled and just let Chrome translate the responses. Does a really good job. At least better than what I can manage with Baidu.

andunie 262 days ago | |

I don't know if these work or not for the specific case mentioned here, but the cheapest eSIMs by a huge margin are from https://silent.link/ if anyone is interested. They definitely do work under normal internet circumstances.

notpushkin 262 days ago | | |

You can go way cheaper than that – https://esimdb.com/ has a good comparison of options. I’m usually paying sub-$1/GB in Southeast Asia currently.

antonios 262 days ago |

As a quick solution before implementing the more sophisticated suggestions in this thread, you can try getting a small cheap VPS from somewhere outside and trafficking all your traffic through it via sshuttle[1]. For example, Vultr (not an endorsement) has some with ~$3/month that should be sufficient for your case.

[1] https://github.com/sshuttle/sshuttle

o999 263 days ago |

AmneziaWG client worked just fine with normal Wireguard servers in Egypt where official Wireguard clients doesn't, WGTunnel app on android support both protocols.

https://github.com/amnezia-vpn/amneziawg-go https://github.com/wgtunnel/wgtunnel

lifeisstillgood 262 days ago |

I’m not sure this is the right conversation right now, but is this thread heading towards “how do we make totalitarian governments become liberal democracies?”

It’s a nice technical question on how to run a VPN but the ultimate goal is not the best technical solution but the ability to avoid detection by the state. And that’s not a technical problem but an opsec one

If someone is participating in online discussions (discord and twitter) to spread local news - then it’s hard to know who is who, and who to trust - and that’s kind of the why Arab spring did not spring “hey wear a red carnation and meet me by the corner” can become a death sentence

The answer to opsec is avoid all digital comms - but at this point you are seriously into “regieme change”, or just as Eastern Europe did, keep your heads down for forty years and hope those who leave you economically behind will half bankrupt them selves bringing you back.

I think in the end, a thriving middle class with a sufficient amount of land reform, wealth taxes which can over a generation push for liberalisation sounds a good idea.

Our job in the very lucky liberal West is to keep what our forefathers won, and then push it further to show why our values are worth the sacrifice in copying

Ylpertnodi 262 days ago | |

> Our job in the very lucky liberal West is to keep what our forefathers won, and then push it further to show why our values are worth the sacrifice in copying

Would it be possible for you to 'keep what our forefathers won', and then just stay at home?

inkyoto 262 days ago | |

> Our job in the very lucky liberal West is to keep what our forefathers won, and then push it further to show why our values are worth the sacrifice in copying

It was the liberal West who helped China build the Great Firewall – Cisco, Sun Microsystems, Nortel, Siemens and others.

As long as a lucrative commercial opportunity was there, they seized upon it shoving the liberal values up the orifice where the sun does not shine.

teekert 263 days ago |

What is going on if you don’t mind my asking? Our local news does not mention anything. Nor does ddging help? Any sources?

nograpes 263 days ago | |

Massive protests have occurred due to obvious government corruption. In particular the housing allowance for a month for a parliamentarian is now ten times the minimum wage for a month.

https://www.theguardian.com/world/2025/aug/26/indonesia-prot...

Sorry I don't have a better freely accessible source, maybe someone with more knowledge can fill it in.

jacobgkau 263 days ago | | |

> the housing allowance for a month for a parliamentarian is now ten times the minimum wage for a month.

I'm almost positive that everyone in the US Congress is making at least ten times the minimum wage in this country. The "housing allowance" being referred to is separate from their normal salary in Indonesia, but still, interesting to imagine how much more seriously people there would take that disparity than in many other countries.

This caught my attention more:

> Indonesia passed a law in March allowing for the military to assume more civilian posts, while this month the government announced 100 new military battalions that will be trained in agriculture and animal husbandry. In July the government said the military would also start manufacturing pharmaceuticals.

They're replacing civilian industry with military, apparently not out of any emergency requirement but just to benefit the military with jobs (and the government with control over those sectors) at the expense of civilian jobs.

cheesepaint 262 days ago |

I'm in Indonesia right now as well and my Proton VPN still works. But I would see it as a short-term solution.

breve 262 days ago |

You should use people power to work to make Indonesia a more open, democratic society.

Yes, it's hard work. Yes, it will take a long time. Yes, you personally may not get very far with your efforts.

But if Indonesians don't take responsibility for and work to improve Indonesia then the rest of it doesn't matter.

protocolture 262 days ago | |

Part of that is knowing whats happening inside the country, of which they were previously using tools like discord, which have now been blocked. So the first step to using people power to make Indonesia a more open, democratic society would be to find a way to tunnel out to get and share that information. To that end the OP has created this Ask HN thread.

breve 262 days ago | | |

Nope. The outside doesn't matter. The problem is on the inside. External websites will never fix the internal problem.

There are no technical solutions to what is fundamentally a problem of political culture.

qwezxcrty 263 days ago |

Chinese have developed a significant amount of sophisticated tools countering internet censorship. V2ray as far as I recall is the state-of-the-art.

To use them, one need to first rent a (virtual) server somewhere from a foreign cloud provider as long as the payment does not pose a problem. The first step sometimes proves difficult for people in China, but hopefully Indonesia is not at that stage yet. What follows is relatively easy as there are many tutorials for the deployment like: https://guide.v2fly.org/en_US/

mrbluecoat 263 days ago | |

Agreed, the best tools for circumventing The Great Firewall of China are from Chinese developers. https://github.com/txthinking/brook comes to mind..

gudzpoz 263 days ago |

As someone based in China, it's a bit surprising that techniques used by Chinese people get very few mentions here, while I do think they are quite effective against access blocking, especially after coevolving with GFW for the past decade. While I do hope blocking in Indonesia won't get to GFW level, I will leave this here in case it helps.

I found this article [0] summarizing the history of censorship and anti-censorship measures in China, and I think it might be of help to you if the national censorship ever gets worse. As is shown in the article, access blocking in China can be categorized into several kinds: (sorted by severity)

1. DNS poisoning by intercepting DNS traffic. This can be easily mitigated by using a DOT/DOH DNS resolver.

2. Keyword-based HTTP traffic resetting. You are safe as long as you use HTTPS.

3. IP blocking/unencrypted SNI header checking. This will require the use of a VPN/proxy.

4. VPN blocking by recognizing traffic signatures. (VPNs with identifiable signatures include OpenVPN and WireGuard (and Tor and SSH forwards if you count those as VPNs), or basically any VPN that was designed without obfuscation in mind.) This really levels up the blocking: if the government don't block VPN access, then maybe any VPN provider will do; but if they do, you will have a harder time finding providers and configuring things.

5. Many other ways to detect and block obfuscated proxy traffic. It is the worse (that I'm aware of), but it will also cost the government a lot to pull off, so you probably don't need to worry about this. But if you do, maybe check out V2Ray, XRay, Trojan, Hysteria, NaiveProxy and many other obfuscated proxies.

But anyways, bypassing techniques always coevolve with the blocking measures. And many suggestions here by non-Indonesian (including mine!) might not be of help. My personal suggestion is to find a local tech community and see what techniques they are using, which could suit you better.

[0] https://danglingpointer.fun/posts/GFWHistory

mxie-ca 263 days ago | |

Thanks for the link!

Is there any good DoT/DoH DNS resolver that works well in China? I know I can build one myself, but forwarding all DNS requests to my home server in NA slows down all connections...

RajT88 262 days ago |

Somewhat dated read here:

https://www.reddit.com/r/Tailscale/comments/16zfag4/travelin...

Some good ideas, though. There seems to be OSS alternatives for TailScale control servers which would make it harder to block - I'd go that route. The top recommendation boils down to, "Set up several different methods, and one will always work".

arewethereyeta 263 days ago |

Give Trojan proxy a try. It's supposed to go unnoticed since it works on the https port 443. Something like: https://www.anonymous-proxies.net/products/residential-troja... If you get it with a residential IP is even better. Works great in Iran and China and i suspect will wotk great for you too

swe_dima 263 days ago |

Personally, I like Amnezia VPN, it has some ways to work around blocks: https://amnezia.org/en You can very easily self-host it, their installer automatically works on major cloud platforms.

Though if Indonesia has blocked VPNs only now, possibly they only block major providers and don't try to detect the VPN protocol itself, which would make self-hosting any VPN possible.

0xbadcafebee 262 days ago |

Wireguard or OpenVPN might work, if someone has a server set up, set up your client to connect.

If those don't work you can try something like wssocks (https://github.com/genshen/wssocks) or wstunnel (https://github.com/erebe/wstunnel). It tunnels connections through WebSockets, so you can make the connection look like a regular HTTPS connection. Another option would just be a regular-old HTTPS proxy (Nginx, Apache2, etc). Set up an HTTPS proxy somewhere on the internet, connect through it, but configure it to return a regular web page if someone tries to make a non-proxy connection through it. Another tool that may help setting up is chisel (https://github.com/jpillora/chisel). Those HTTPS ones may work if, when authorities connect to the host, it returns pages that look like some kind of private video server. (Maybe run an actual video server, in addition to the proxy...) Also, try to enforce TLS 1.3 for the HTTPS server.

And another option, if all else fails, is to run a straight-up SOCKS proxy over the internet, on a weird port. It might be so obvious they aren't looking for it.

To mask your DNS requests with the SOCKS proxy, use something like Tor-DNS (https://github.com/bfix/Tor-DNS), or set up a VPN through the SOCKS proxy and use DNS through that route. Another option is DNS-over-HTTPS.

gwbas1c 263 days ago |

Just curious: Anyone know if things like Starlink are viable?

akho 262 days ago | |

Starlink, by policy, connects you through a ground station in the same country. They wouldn't be allowed to operate otherwise.

ultim8k 262 days ago | | |

Why? Can someone block the sky? (I have 0 satellite knowledge)

Jigsy 263 days ago |

I was wondering something like this but in a different capacity.

What with certain countries (they know who they are) and their hatred for encryption, it got me wondering how people would communicate securely if - for example - Signal/WhatsApp/etc. pulled out and the country wound up disconnecting the submarine cables to "keep $MORAL_PANIC_OF_THE_DAY safe."

How would people communicate securely and privately in a domestic situation like that?

RansomStark 263 days ago | |

In person or not at all.

At that point you've essentially lost.

You either hope another country sees value in spreading you some democracy, or you rise up and hope others join you.

Or not and you accept the protection the state is graciously providing to you.

Jigsy 263 days ago | | |

SneakerNet or bust, eh? That sucks.

wsintra2022 263 days ago | |

Encrypted hand written notes tied to pigeons

Aachen 263 days ago |

Aren't there local (online or print) newspapers to get news from, as an alternative to Discord? Hope I'm not asking a dumb question

alluro2 263 days ago | |

In countries where it comes to government blocking/censoring internet traffic, traditional media is cleared of all dissent and fully controlled long before. Last stages of that are happening in my country, Serbia, currently.

Aachen 263 days ago | | |

Right, that makes sense. Did some looking up and nonfree press seems to be indeed the case for Indonesia: https://rsf.org/en/country/indonesia

It's a mixed bag apparently, free press is technically legal since 1998 but selective prosecution and harassment of those actually uncovering issues (mainly becomes clear in the last section, "Safety")

Tried looking up Serbia next on that website but got a cloudflare block. I'm a robot now...

wafflemaker 263 days ago | |

It's not a dumb question at all. Level on hn really got down lately if you're getting downvoted.

Think about it Aachen. If the government has enough power to censor internet traffic, that what was the first thing it censored? Which media is traditionally known for being censored or just speaking propaganda? That's the classical newspapers. It's not uncommon in authoritarian countries for editors to need state to sign off on the day's paper. And if not that, articles are signed and publishers are known. They will auto-censor to avoid problems. Just like creators on YouTube don't comment on this one country's treatment of civilians to avoid problems.

grishka 262 days ago |

It very much depends on how the block is implemented technically.

I can only talk about Russia where I'm from — we have quite a lot of success with DPI bypass tools like GoodbyeDPI. If that fails, use VPN protocols specifically designed for censorship circumvention, like VLESS. Better yet, get yourself a VDS in another country and self-host your VPN there.

throwawayffffas 262 days ago |

You can also setup your own, get a VM in the free world and setup an open VPN server. https://www.digitalocean.com/community/tutorials/how-to-set-...

ACCount37 263 days ago |

AmneziaWG is a decent option for censorship resistance, and it can be installed as a container on your own server.

o999 263 days ago | |

AmneziaWG clients works just fine with normal Wireguard servers by the way.

ryzvonusef 263 days ago |

I live in Pakistan and two years back we had this exact same problem, (election interference) and frankly, you just try to scrape through solutions, but without an answerable government, there is little you can do.

We tried things like Proton VPN and Windscribe VPN, as well as enabling MT proxy on Telegram, but soon govts find it easier to just mass ban internet access.

Use Netblocks.org to analyse the level of internet blockage and try to react accordingly.

pbiggar 263 days ago |

There's a new VPN that you might try, built by Boycat.

https://www.boycat.io/vpn

Don't know if it will help in this situation as it's designed to be a VPN not controlled by Israel, but it might be worth a try.

fastnetnet 263 days ago |

Try some of the more niche VPN protocols like IKEv2/IPSec or zinc.

SSH over socks is another option or you can run your own proxy server, nobody will ever know... This makes me wonder if you cannot just run OpenVPN on a different port like 443 since it's also TLS based.

mensetmanusman 262 days ago |

Western governments should have entire budgets focused on software to circumvent great firewalls.

paddlesteamer 262 days ago |

Years ago, I created a very basic HTTP proxy using Google Cloud. The idea relies on Google Cloud wouldn't be blocked because the industry in that country probably also needs Google Cloud to function, so the government couldn't touch it.

You can see it here: https://github.com/paddlesteamer/gcrproxy. I don't know whether it works or not (maybe something has changed; it is very old code), but the idea beneath it remains. And I think it is also applicable to other cloud services, too. Cheaper (even free to some point) than having your own VPS.

figassis 262 days ago |

The thing about fighting against vpn blocks is that if you win, the govt can just turn off the internet. Something like starlink would be ideal in these circumstances, but you'd have to have the receivers in the country before lockdown.

rkomorn 262 days ago | |

Assuming something like Starlink doesn't cooperate with shutting down in the country just like the land-based ISPs would.

GJim 262 days ago | |

Thereby entrusting your internet connectivity to the whims of an unhinged lunatic.

tmarsden 262 days ago | | |

Well that "unhinged lunatic" has also publicly characterized himself as a "free speech absolutist" so until someone or something better comes along you take what you can get.

jinnko 263 days ago |

AmneziaVPN has censorship circumvention options and makes it easy to set up a self hosted instance of that's what you prefer, or use their hosted service.

https://amnezia.org/

database64128 263 days ago |

You could use something like https://github.com/database64128/swgp-go to obfuscate WireGuard traffic.

Using full-blown VPNs under such environments has the disadvantage of affecting your use of domestic web services. You might want to try something like https://github.com/database64128/shadowsocks-go, which allows you to route traffic based on domain and IP geolocation rules.

acuozzo 263 days ago |

Grab a VPS and use SOCKS5 tunneling via SSH.

Joel_Mckay 263 days ago | |

SSH is often targeted by deep packet inspection and protocol binding filters.

i.e. One is better off tunneling over https://www.praise-the-glorious-leader.google.com.facebook.c...

include SSH traffic protocol auto-swapping on your server (i.e. no way to tell the apparent web page differs between clients), as some corporate networks are infamously invasive. People can do this all day long, and they do... =3

bitwize 263 days ago | | |

lolwut

At least it isn't goatse...

darkhorn 263 days ago |

People in Turkey use https://github.com/ValdikSS/GoodbyeDPI together with DNS over HTTPS (DoH).

jedisct1 263 days ago |

Get a cheap VPS anywhere, and use DSVPN https://github.com/jedisct1/dsvpn

Uses TCP and works pretty much anywhere.

more_corn 263 days ago |

You could rent a cheapo instance at a cloud provider and tunnel https over ssh.

That’s basically undetectable. Long lived ssh connection? Totally normal. Lots of throughput? Also normal. Bursts throughput? Same.

Not sure how to do this on mobile.

Tailscale might be an option too (they have a free account for individuals and an exit node out of country nearly bypasses your problem) It uses wireguard which might not be blocked and which comes with some plausible deniability. It’s a secure network overlay not a VPN. It just connects my machines, honest officer.

village_kothi 262 days ago |

Can you try both WireGuard and MASQUE? you can do that by using `warp-cli tunnel protocol set MASQUE'. if you want to try WireGuard, `warp-cli tunnel protocol set WireGuard'

lubosm 262 days ago |

VPN services are just someone else's computers. Any cloud provider with a low performance virtual machine can become a VPN gateway using Linux distribution of your choice for around $4.

OpenVPN or WireGuard are my tools of choice. Professionally, I also use OpenVPN's EasyRSA PKI framework for certificates, but you can just generate your keys using any tutorial out there. "OpenVPN Cookbook" ebook from Packt is my go to source. For performance reasons, WireGuard is better.

thewanderer1983 263 days ago |

Go here. https://github.com/net4people/bbs/issues

Very helpful community.

andrewinardeer 262 days ago |

Weird. I'm in Indonesia and can access VPNs, X and Discord.

ies7 262 days ago | |

I just wake up in Jakarta and there is nothing wrong with X or Discord

ssh-wrapper 259 days ago |

Based on your question, i worked on a wrapper of wstunnel, wrapping ssh into wesockets. You could maybe use it to setup a socks proxy, provided that someone helps you setup the 'unwrapping' endpoint. https://github.com/cecemel/ssh-over-http-wrapping-service

jiggawatts 262 days ago |

As an aside about professional and engineering ethics:

If you’ve ever worked in the DPI space and actively participated in the development or installation of state surveillance and censorship products…

Shame.

chidg 262 days ago |

Hi, not well educated on the details of VPNs and network security so this may be a basic question, but - VPNs are used regularly by corporates to enable secure intranet access to people offsite, etc - surely completely blocking VPNs or detecting and punishing VPN users is severely detrimental to business and not something countries would want to do carte blanche? How does this work?

Crestwave 262 days ago | |

It's possible that they're only blocking the VPNs hosted outside of the country (and thus bypassing censorship).

Of course, that would still impact international remote workers, but it's probably niche enough for the government to offload it as their problem.

huksley 262 days ago |

Shadowsocks over websockets is the way to have traffic indistinguishable from browser traffic. A bit difficult to configure manually: https://developers.google.com/outline/docs/guides/service-pr...

rostislaved 255 days ago |

I would say there are two options:

1. (Easy, fast but someday it will be blocked, because it is relatively easy to block) Just buy vpn. Mullvad and "Private Internet Access" are ones of the best.

2. (Requires experience, not fast, but the most reliable and flexible). Get a VPS (server) somewhere and install your own VPN. VLESS is the best at this moment

dboreham 262 days ago |

The closest I've come to this is on an airplane where almost everything was blocked. SSTP to a server I spun up worked well.

mlhpdx 262 days ago |

A question related to the question, for which I apologize:

It seems to me that using WireGuard (UDP) in conjunction with something like Raptor Forward Error Correction would be somewhat difficult to block. A client could send to and receive from a wide array of endpoints without ever establishing a session and communicate privately and reliably, is that correct?

keepamovin 262 days ago |

Do you still have access to GitHub?

If so you can run BrowserBox in a GitHub action runner exposed via IP or ngrok tunnel. That will give you a browser in a free region. Easy set up via workflow.

You’ll need a ngrok API key and a BrowserBox key. Hit us up: sales@dosaygo.com for a short term key at a discount if it works for you.

We will offer keys for free to any journalists in censored regions.

jay-418 263 days ago |

Censorship circumvention tools specialize in this, and are extensively used in China, Iran, and Russia. I work on Lantern, and we're not seeing any significant interruptions to connections in Indonesia at the moment. https://lantern.io/download

Hope it helps!

raxxorraxor 262 days ago |

I would rent a server in an outside jurisdiction and use it as proxy. It isn't too hard to setup and you can share it with others too. I believe it would be completely legal as well. As least it should be.

That said, you are much less anonymous with that. But you could opt for your server using an additional VPN service to mitigate that.

ddtaylor 263 days ago |

Your first option until you get settled is to use an SSH reverse proxy:

    ssh -D 9999 user@my.server

Then configure your browser to use local port 9999 for your SOCKS5 proxy.

This gets you a temporarily usable system and if you can tunnel this way successfully installing some WireGuard or OpenVPN stuff will likely work.

EDIT: Thanks it's -D not -R

hdgvhicv 263 days ago | |

It’s -D, -R is for forwarding specific ports.

ddtaylor 263 days ago | | |

Thanks I have updated my comment as well.

Sorry for the brain rot!

Beijinger 262 days ago |

Use Astrill - if you can afford. You could try AirVPN, much cheaper, but if Astrill does not work, probably no VPN will. https://expatcircle.com/cms/privacy/vpn-services/

Why is Indonesia in chaos?

rufus_foreman 262 days ago | |

>> Why is Indonesia in chaos?

I was wondering that too, looks like https://en.wikipedia.org/wiki/2025_Indonesian_protests.

teaga 263 days ago |

Launch an EC2 instance in the US region (Ubuntu, open ports 22 and 1194), then connect via SSH and run the OpenVPN install script. Generate the .ovpn profile with the script and download it to your local machine. Finally, import the file into the OpenVPN client and connect to route traffic through the US server.

wiredpancake 262 days ago | |

Doesn't work in China, this is a method for last decades censorship.

mhitza 263 days ago |

Use the Tor browser window in Brave. It's nowhere near as anonymous as the Tor browser, but the built in ad blocking makes browsing via Tor usable. And that's what you and your compatriots are interested in.

Prepare to fill in Cloudflare captchas all day, but that's what it takes to have a bit of privacy nowadays.

notorandit 262 days ago |

I would use SSH dynamic TCP forwarding (-D). Then use "SOCKSv5" proxy configuration in your browsers and in your apps (if that's supported). You can hve remote SSH server listen on different ports and IPv6. Maybe speed and latency will not be the best, but it'd be OK. Simple and easy.

thinkingtoilet 263 days ago |

Please consider the potential consequences of circumventing the ban. Do what you do, but above all stay safe!

Joel_Mckay 263 days ago |

There are many options, but avoiding the legal consequences may be a grey area:

https://www.stunnel.org/index.html

https://github.com/yarrick/iodine

https://infocondb.org/con/black-hat/black-hat-usa-2010/psudp...

..and many many more, as networks see reduced throughput as an error to naturally route around. =3

wdroz 262 days ago | |

DNS tunnels with iodine works well, it's easy to setup and work in a lot of place.

You can also connect to some random corporate wifi and it's very likely that this will work (not necessary in "direct" mode).

ghsar 262 days ago |

Hello! I use Octohide VPN - it has VLESS protocol that can bypass geo-blocks (in countries like Russia, China). Its fast, the connection to a server takes merely a second and I do not even have an account as there is no registration required. Try it and see whether it helps you.

raugustinus 262 days ago |

There's https://refraction.network/ but I am not sure how feasible that is at the moment (or at all). I came across it when researching some TLS stuff in golang (programming language).

rurban 263 days ago |

In this case the blockage will probably just be up for a few days, until the protests calmed down.

Other than that: tor

defulmere 263 days ago |

SOCKS proxy over SSH?

pmlnr 263 days ago | |

Android doesn't come with system wide socks proxy support, and i couldn't find an open source app for it either. Is anyone aware of one?

Nonetheless this is a surprisingly simple and bullet proof solution: SSH, that's not vpn boss, i need it for work.

kevindamm 263 days ago | | |

Outline is an open source shadowsocks client, and you provision your own server to act as the proxy. You can use it against any Shadowsocks server you want, and the protocol makes it look like regular https traffic.

https://github.com/Jigsaw-Code/outline-apps

Android & iOS & Linux & Mac & Windows

their server installer will help set up a proxy for users that aren't familiar with shadowsocks, too

newlisp 263 days ago | | |

For web browsing, Firefox lets you configure socks on android.

seany 262 days ago |

Shadowsocks used to be the thing that _really_ worked in CN. Not sure what's current there.

AWS ap-southeast-3 should still be up, and isn't in a different partition like CN, govcloud, iso etc. So a VM there and a vpc peer in the US should get you around a lot of stuff.

thenthenthen 262 days ago | |

Use shadowsocks for the past 2 years in CN works fine. Also Trojan. Not sure what the servers actually run.

wiredpancake 262 days ago | |

Shadowsocks isn't a viable method in 2025 it seems. Not by itself apparently. Shadowsocks generates high-entropy noise via packet analysis, which typically is easy to spot out as it looks irregular.

Maro 262 days ago |

Get a cheap VPS for less than $10/mo or a dedicated server for like $25/mo and ssh tunnel into it. You can also use it to be your devserver, run your blog, etc. I've been using french located OVH servers in France for many years, it just works.

nromiun 263 days ago |

Usually when countries block websites they don't block major cloud providers, like AWS and Google Cloud. Because most websites are hosted on them. So you can get a cheap VPS from AWS or GCP (always free VM is available) and host OpenVPN on it.

ali-aljufairi 262 days ago | |

vps install tailscale on it use it as exit node

dabockster 256 days ago |

See if your community can establish some kind of mesh network connection to someone outside of the country. You'd have to trust everyone on it with your life (quite literally in this case), but it would work.

stoicfungi 262 days ago |

Try this, https://github.com/database64128/swgp-go, setup is a bit complicated but it works extremely well.

liveoneggs 263 days ago |

All the various proxy solutions offered are good (although the simplest ones - like squid - haven't been mentioned yet). You can also use a remote desktop or even just ssh -Y me@remote-server "firefox"

vander_elst 263 days ago |

Set up a VM on AWS/azure/gcp/... in the desired cell, install a VPN server and done. Once you have automation in place it takes ~2 minutes to start, you can run it on demand so you can pay per minute.

andunie 262 days ago |

About VPNs I don't know but you could all start using Nostr instead of Twitter and Discord.

Also Telegram using MTProto proxies (that you have to host, do not use those free ones out there), if those don't qualify as VPNs.

chmod775 262 days ago |

Mullvad has some anti-censorship features (shadowsocks) that it will automatically use if regular connections fail and works reliably in China as well (and has for the last 2+ years). You could give it a shot.

SirMaster 263 days ago |

Remote desktop (RDP/AnyDesk/etc) into a VM hosted somewhere else?

pabs3 262 days ago |

Try the Tor Browser, and use bridged mode to to make it look like you aren't using Tor.

https://www.torproject.org/

Imustaskforhelp 262 days ago |

nextdns recently created geo spoofing methods, I may be wrong, I usually am but I am curious as to if these censorship can be fixed by nextdns.

I don't know if indonesia is becoming exactly like china/ so a complete crackdown as people are discussing things as if its for china, but I feel like that there are definitely some easier things than hosting your own server or using shadowsocks.

Check if proton vpn/mullvad vpn are working once please, they are definitely plug n play and proton even offers a free tier.

globular-toast 262 days ago |

The best time to develop meshnets was 15 years ago. The second best time is now. What is actually holding us back here? Almost everyone has powerful radio equipment these days.

jodosha 262 days ago |

I’m in Indonesia at the moment for vacation.

Just checked with NordVPN connected to their server Indonesia #54 (Borneo) and I was able to access twitter.com (via Chrome) and Discord (via app).

I’m on iPhone.

fruitworks 263 days ago |

Try looking into tor bridges.

You could also buy a VPS and use SSH tunneling to access a tor daemon running on a VPS. Host some sort of web service on the VPS so it looks inconspicuous

jorisnoo 262 days ago |

Working from China, i've rented VPS outside of the country and set up tailscale exit nodes - as my private VPN. Speed is not always optimal but it mostly works.

outrage 262 days ago |

You can try using forks of existing protocols. Those are usually harder to detect. My country also blocks OpenVPN and Wireguard, but AmneziaWG works great for me.

arman_nocapro 262 days ago |

Sama-sama bro, confirming this from Jakarta. It's a mess. My group chats were blowing up yesterday when WARP and Twitter suddenly went down. Felt like they pulled the plug right when everyone needed info on the protests.

Be very careful with random free VPNs being shared around on WhatsApp right now, many could be honeypots.

Like others have said, the most reliable long-term fix is rolling your own. I've had a cheap VPS in Singapore for years for moments just like this. The latency is low and it's been rock solid. I'm using v2ray with a simple setup, and it's been working fine because it just looks like normal web traffic to my ISP (Indihome). The guides posted in the top comment are excellent starting points.

For my less technical friends, I've been helping them set up ProtonVPN. Their 'Stealth' protocol seems to be holding up for now, but who knows for how long. The hardest part is getting this info to people who aren't tech-savvy.

Stay safe out there, everyone. Jaga diri.

mediumsmart 262 days ago |

The real problem of course is that no government is going to block twitterredditmetadiscordandwhathaveyou long enough to risk people becoming informed citizens.

mulchpower 263 days ago |

URnetwork works where many don't http://ur.io . It used a grab bag of techniques, open source

asqueella 262 days ago | |

The site is awful, and I couldn't find the technical description easily. I assume it runs an exit node for other people's traffic?

notepad0x90 262 days ago |

I've heard of shadowsocks being advertised for such use cases.

https://shadowsocks.org/

sudahtigabulan 262 days ago |

Use a less-known DoH or DoT provider.

They just "blocked" Reddit today, I selected another DoH provider from the menu in my browser settings, and continued.

robobro 262 days ago |

I'm in also indonesia and nordvpn is still working fine for me, but you may want to consider trying socks5 via ssh as others are suggesting.

robobro 262 days ago |

I'm in also indonesia and nordvpn is still working fine for me, but you may want to consider trying socks5 via ssh as others are suggesting

game_the0ry 262 days ago |

https://www.privacytools.io/privacy-vpn

puffybuf 263 days ago |

I like mullvad. You can buy a prepaid card off amazon. I figured out how to setup wireguard on various unixes Mac/linux/openbsd

leishman 263 days ago |

I'd recommend Obscura because it uses Wireguard over QUIC and it pretty good at avoiding these blocks. It's also open source.

sturza 263 days ago |

Mullvad

reisse 263 days ago | |

Mullvad doesn't really have any modern censorship circumvention options.

octo888 263 days ago | | |

Genuine question is Shadowsocks outdated? Because it supports it

rglynn 262 days ago | | |

Works in China just fine.

heinternets 262 days ago |

May I suggest getting a cheap VPS in another country and using SSH to tunnel traffic, or even setup a window manager on the VPS.

bitbasher 263 days ago |

Make your own VPN using a VPS and something like openvpn.

Not every website will allow it, but it should get you access to more than you have now.

throwawayffffas 262 days ago |

Maybe TOR? https://www.torproject.org/

jwong_ 263 days ago |

A proxy service like shadow socks works. There are thousands of providers for $X/month for a decent amount of traffic

BobbyTables2 262 days ago |

I block Twitter at home… it’s not a huge loss

afh1 263 days ago |

Depending on the circumstances, maybe ditch the landline local ISP for a satellite connection with a foreign ISP?

arihant 262 days ago |

Get a Digitalocean droplet, and host your own Outline instance. Their manager app makes this a 1-click process.

zhengiszen 263 days ago |

Use an ethical one

https://www.boycat.io/vpn

ck2 263 days ago |

Just please be safe and necessarily paranoid

One way they tend to "solve" workarounds is making examples of people

AugSun 262 days ago |

https://amnezia.org/

01jonny01 262 days ago |

Hey I run Skipvids.com we receive alot of Indonesia traffic. I think we are still accessible there.

txrx0000 262 days ago |

Use the open-source SoftEther VPN. It sends your traffic over software-defined Ethernet wrapped in HTTPS. https://en.m.wikipedia.org/wiki/SoftEther_VPN

Here's a list of public instances hosted by volunteers: https://www.vpngate.net/en/

For anyone reading this who still lives in a somewhat free country and has resources to spare, please consider hosting a public instance or mirroring the VPN Gate site.

jasonlingx 262 days ago |

An alternative is using an eSIM with an “internet breakout” via another country.

Esimdb is a good place to start.

rdl 262 days ago |

A one way plane ticket, a rifle, or a drone swarm. (What I’d use if my country blocked VPNs)

pilingual 262 days ago | |

To where would you fly?

ryan-ca 262 days ago |

I recommend using tor over snowflake relays to connect. It is meant to be censorship proof.

yannick 263 days ago |

does this include bali? curious as that would impact the large international population.

devops000 262 days ago |

In China uses Rocket Shadow. Alternatively, you could purchase an eSIM, such as Holafy.

coretx 262 days ago |

Get a VPS, arrange your own IPV6. Setup a tunnel and block all non encrypted traffic.

guluarte 263 days ago |

SSH tunneling on port 80 could work since it's rarely blocked, rent a cheap vps.

berlinismycity 262 days ago |

Love Indonesia. Spend the last six months on Bali. This VPN thing is a shame!

Gud 263 days ago |

Try a ssh socks5 proxy to a cheap vps.

It worked well for me in UAE when other solutions didn’t

worthless-trash 262 days ago |

Isn't there an SSH proxy command as long as you have shell access ?

whalesalad 263 days ago |

SSH SOCKS proxy if you have an SSH host somewhere that is not Indonesia.

Aloha 262 days ago |

I would just configure a VPS outside the country and tunnel thru that

tuananh 262 days ago |

you can use anything that has a VM.

let's say Github codespaces. Launch a new codespace, setup vpn or just squid. Use it.

It will not stop working unless your gov. decides to block said service (GitHub) too.

princevegeta89 263 days ago |

OP, you can rent a VPS from a reputable and cheap provider within the NA region - OVH, Vultr, Linode etc. are decent. Also check out lowendtalk.com

Then, setup Tailscale on the server. You can VPN into it and essentially browse the internet as someone from NA.

teekert 263 days ago | |

From some of the comments here I get why you are downvoted. But tbh I would also have gone that route. So are we just inexperienced? I read here indeed that wireguard is very easily blocked. It was at the company I worked for but then I just set port 23 (who uses ftp anyways??). And it worked. But why is this still bad then?

Obviously I have 0 real experience with this.

princevegeta89 263 days ago | | |

Well, I mean, Tailscale is pretty easy overall. When client apps get blocked, you can literally hook up your router into Tailscale if needed, or you can run a headless version of Tailscale on your home server or the very machine you are on.

It should also be possible to use a tunnel to get around the blocking of WireGuard, for example.

You can then use it as an exit node if needed. It should work in theory, I have never tried this though. I just speak as a very frequent user of Tailscale with a bunch of nodes that are geographically located in different cities around me.

yupyupyups 263 days ago |

Residential VPNs, but try to find ones that are ran ethically.

pshirshov 263 days ago |

You should use a jet. Actually that's a Russian joke.

egberts1 262 days ago |

Buy a VSP elsewhere and run Wireguard over IPSec

reactordev 263 days ago |

localtunnel.me, some node in the cloud, tunnel…

jeffbee 263 days ago |

Use an Actual Private Network? Radio links that you control. Peer with someone who owns a Starlink terminal. Rent instances in GCP's Jakarta datacenter.

jasonjayr 263 days ago | |

https://en.wikipedia.org/wiki/AMSAT-OSCAR_7#Use_by_Polish_an... <-- "Radio links you control", and is hard to block/detect.

moralestapia 263 days ago |

Can you SSH outside the country?

If so, then you have a VPN.

trhway 263 days ago |

HTTPS to you own proxy on a foreign VPS.

theyknowitsxmas 263 days ago |

OVH VPS-1 and your own configuration.

ddbb33 263 days ago |

Psiphon works

diggan 263 days ago |

Tor should be pretty good even for environments where they crack down on VPNs, although it can be a bit slow, at least it works.

immibis 263 days ago | |

Then you will be blocked by Twitter and Discord, which is the same thing.

diggan 263 days ago | | |

Yeah, sucks, but really should find better places for people to gather regardless, if you're in that sort of environment.

ivape 263 days ago |

SSH tunnel on cheap VPS, a couple.

TimCTRL 263 days ago |

I can relate to this because my country has an election soon and I'm sure we wont have internet for 3 - 5 days then.

asdefghyk 263 days ago |

shortwave radios would enable you to still get news of major events - not 2 way though

tonymet 263 days ago |

try Bright Data / luminati and the traffic is http to the proxy as well.

oleksandr_l5 262 days ago |

SSTP or other HTTPS like VPN

lrvick 261 days ago |

ssh socks proxy over port 443 should work in most situations

lidder86 262 days ago |

surfshark works also Im on MTM no issues! Same with Biznet

lemper 263 days ago |

megavpn, should be around a dollar a month for 5 devices.

jongjong 262 days ago |

Easy, you can just create any generic Linux Amazon EC2 instance (or just about any cloud provider of your choice; in fact, the smaller the provider, the better) and use it as a SOCKS5 proxy via SSH tunnel with -D flag... Then set one of your browsers (e.g. Firefox) to connect via that proxy.

Indistinguishable from any other server on the internet.

fguerraz 262 days ago |

Take the power back?

draneone 261 days ago |

use vless/xray, barely blockable by anything

yegor 262 days ago |

Full disclosure, I run a commercial VPN service (Windscribe).

There are 2 paths you can take here:

1. Roll your own VPN server on a VPS at a less common cloud provider and use it. If you're tech savvy and know what you're doing, you can get this going in <1hr. Be mindful of the downsides of being the sole user of your custom VPN server you pay for: cloud providers log all TCP flows and traffic correlation is trivial. You do something "bad", your gov subpoenas the provider who hands over your personal info. If you used fake info, your TCP flows are still there, which means your ISP's IP is logged, and deanonymizing you after that is a piece of cake (no court order needed in many countries).

2. Get a paid commercial VPN service that values your privacy, has a diverse network of endpoints and protocols. Do not use any random free VPN apps from the Play/App stores, as they're either Chinese honeypots (https://www.bitdefender.com/en-us/blog/hotforsecurity/china-...) or total scams (https://www.tomsguide.com/computing/vpns/this-shady-vpn-has-...).

Do not go with a VPN service that is "mainstream" (advertised by a Youtuber) or one that has an affiliate program. Doing/having both of these things essentially requires a provider to resort so dishonest billing practices where your subscription renews at 2-5x of the original price. This is because VPNs that advertise or run affiliate programs don't make a profit on the initial purchase for that amazing deal thats 27 months with 4 months free or whatever the random numbers are, they pay all of this to an affiliate, sometimes more. Since commercial VPNs are not charities, they need ROI and that comes only when someone rebills. Since many people cancel their subscriptions immediately after purchase (to avoid the thing that follows) the rebill price is usually significantly more than the initial "amazing deal". This is why both Nord and Express have multiple class action lawsuits for dishonest billing practices - they have to do it, to get their bag (back). It's a race to the bottom of who can offer the most $ to affiliates, and shaft their customers as the inevitable result.

Billing quirks aside, a VPN you choose should offer multiple VPN protocols, and obfuscation techniques. There is no 1 magic protocol that just works everywhere, as every country does censorship differently, using different tools.

- Some do basic DNS filtering, in which case you don't need a VPN at all, just use an encrypted DNS protocol like DOH, from any provider (Cloudflare, Google, Control D[I also run this company], NextDNS, Adguard DNS)

- Then there is SNI filtering, where changing your DNS provider won't have any effect and you will have to use a VPN or a secure proxy (HTTPS forward proxy, or something fancier like shadowsocks or v2ray).

- Finally there is full protocol aware DPI that can be implemented with various degrees of aggressiveness that will perform all kinds of unholy traffic inspection on all TCP and UDP flows, for some or all IP subnets.

For this last type, having a variety of protocols and endpoints you can connect to is what's gonna define your chance of success to bypass restrictions. Beyond variety of protocols, some VPN providers (like Windscribe, and Mullvad) will mess with packets in order to bypass DPI engines, which works with variable degree of success and is very region/ISP specific. You can learn about some of these concepts in this very handy project: https://github.com/ValdikSS/GoodbyeDPI (we borrow some concepts from here, and have a few of our own).

Soooo... what are good VPNs that don't do shady stuff, keeps your privacy in mind, have a reasonably sized server footprint and have features that go beyond basic traffic proxying? There is IVPN, Mullvad, and maybe even Windscribe. All are audited, have open source clients and in case of Windscribe, also court proven to keep no logs (ask me about that 1 time I got criminally charged in Greece for actions of a Windscribe user).

If you have any questions, I'd be happy to answer them.

king_of_shit 262 days ago | |

TIL

cabirum 262 days ago |

sshuttle. Tunnel your connections inside ssh.

ok123456 263 days ago |

ssh -D 48323 -p 61423 my-vps.big-company.com

comonoid 262 days ago |

An airport.

dragonz00011011 262 days ago |

2121

dragonz00011011 262 days ago |

2323

Lu2025 262 days ago |

Starlink?

altern8 263 days ago |

Tor..?

dragonz00011011 262 days ago |

aaaaaaaaaaaaaaaaaaaaaaaaaa

barnacl437 261 days ago |

woah, another country blocking discord again? (well, mine don't, just surprised)

quick resort: you can use quad9 or nextdns if they are just using the classic dpi blocking thing. if these just doesnt work, then there is psiphon. its an anti surveillance kit iirc. other comments might include more options. i just want to list the ones that i've tried and used.

JOHN-DAN 261 days ago |

I'm also curious about your thoughts on the GFW. To be frank, I don't think it's as effective as you might expect.

dragonz00011011 262 days ago |

sadsa das asd asd sa

scotty79 263 days ago |

Maybe you could buy VPS in another country and set up VPN server yourself?

farceSpherule 263 days ago |

If you are a journalist or other, contact Team Cymru.

reisse 263 days ago |

You've come to a wrong place to ask. Most people here (judging by recommendations of own VPN instances, Tor, Tailscale/other Wireguard-based VPNs, and Mullvad) don't have any experience with censorship circumvention.

Just look for any VPNs that are advertised specifically for China, Russia, or Iran. These are the cutting edge tech, they may not be so privacy-friendly as Mullvad, but they will certainly work.

Hizonner 263 days ago | |

Hmm. People who recommend widely used approaches, and well-known, well-established providers, "don't have any experience with cenorship circumvention".

So the solution is no-name providers using random ad-hoc hackery, chosen according to a criterion more or less custom designed to lead you into watering hole attacks.

Right.

adamfisk 262 days ago | | |

@reisse is 100% right. Most people outside of heavily censored regions have no clue what technology is actually used in those countries. The well-known, well-established providers don't actually work in censored regions because:

1) The problem is very difficult and requires a lot of engineering resources 2) It's very hard to make money in these countries for many reasons, including sanctions or the government restricting payments (Alipay, WeChatPay, etc)

The immediate response would be: "If the problem is so difficult, how can it be solved if not be well-known, well-established providers?"

The answer is simple: the crowdsourcing power of open source combined with billions of people with a huge incentive to get around government blocking.

raincole 262 days ago | | |

It's very sad that every sane and informed comment (like reisse's) has to meet this kind of snarky comment whose only purpose is being snarky on HN.

Perhaps you should stop and think about why people living in countries where governments actually censor a lot hardly use these "well-established providers" to circumvent censorship. Tip: it's not because they're stupid.

reisse 263 days ago | | |

None of the things I listed are "widely used approaches, and well-known, well-established providers" in the parts of the world where it does matter.

Yeah, maybe V* and derivatives are random ad-hoc hackery, but they also are the well-known standard now.

musttotoes 262 days ago | | |

At DefCon 26 (25?) I attended two presentations that scared me:

1. there was a presentation about several admins in a hostile country who had been arrested because someone from Harvard pinged a server they ran as part of IPv4 measurement. The suggestion was to avoid measuring countries with strong censorship laws to prevent accidental imprisonment of innocent IT.

2. similar presentation about ToR project struggling to find fresh egress/ingress addresses. Authoritarian countries were making lists of any IP addresses that were known ToR IPs and prosecuting/imprisoning users associated with them as a result of traffic on those addresses.

I would be extremely careful trying to bypass authoritarian restrictions unless I was 110% confident what I was doing.

tomaskafka 263 days ago | |

> Just look for any VPNs that are advertised specifically for China, Russia, or Iran.

If I was working for a secret service for these countries, I would set up many "VPNs that are advertised specifically for x" as honeypots to gather data about any dissidents.

dmantis 263 days ago | | |

It doesn't matter, he should look into the open source protocols that these services use. He doesn't have to use them.

VLESS / v2ray works in Russia, as far as I know.

khaki54 262 days ago | | |

Just run second VPN inside the honeypotted VPN

refulgentis 263 days ago | | |

Mr. Kafka, suspicion is healthy. However, abstraction provides no way forward when faced with practicalities instead of theory. Creates a Kafka-esque situation - anything suitable is by definition unsuitable. Better to focus on practical technical advice.

yogorenapan 263 days ago | |

You can always do v2ray -> Mullvad in a docker container routed with gluetun for censorship avoidance and privacy

riehwvfbk 263 days ago | |

OP: look into VLESS (and similar). And read up on ntc.party (through Google translate). There are certain VPN providers that offer the protocol.

yogorenapan 263 days ago | | |

I think REALITY is the newer protocol. I remember VLESS being somewhat more detectable

arewethereyeta 263 days ago | |

Actually I do, we sell a lot of proxy types designed specifically to circumvent such filters. Trojan works great for our Iran and China users: https://www.anonymous-proxies.net/products/residential-troja...

wat10000 263 days ago | |

Mullvad worked OK in China for me recently. Sometimes I'd have to try a few different endpoints before it worked. Something built specifically to work in those places would probably be better, but it wasn't too much trouble. Not necessarily a recommendation, just sharing one data point.

Liftyee 263 days ago | | |

I remember always needing obfuscation enabled in Mullvad, but it would work in the end (as you said, after trying a few endpoints).

more_corn 263 days ago | |

^ this comment is right on. The cutting edge of VPN circumvention is the one marketed to people in China. Last I poked at this there were a lot of options.

johnisgood 263 days ago | | |

Can I have a list of these options?

ailun 263 days ago | |

Mullvad worked okay in China in June for me. I imagine it will be better in Indonesia with their less sophisticated blocking.

77pt77 262 days ago | | |

This makes no sense.

On the one hand they do DPI with ML.

On the other hand a major player is open!

Something is not right here...

esosac 263 days ago | |

what's wrong with those solutions?

leshenka 262 days ago | | |

Wrong threat model. Solutions like mullvad/proton focus on privacy not breaking the blockade. They have well known entry points and therefore easily blocked. You can play cat and mouse game switching servers faster than censorship agency blocks them (e.g. Telegram vs Roskomnadzor circa 2018 [1]) but that gets expensive and not really focus of these companies.

What you need is open protocols and hundreds of thousands of small servers only known to their owners and their family/friends

1: https://archive.is/sxiha

hinkley 263 days ago | |

I have a little, maybe enough to be dangerous. SSH won’t be sufficient to avoid all traffic analysis. Everyone can see how much traffic and the pattern of that traffic, which can leak info about the sort of things you’re doing.

If you’re worried about ending up on a list, using things that look like VPNs while the VPNs are locked down is likely to do so.

Also… your neighbors in Myanmar didn’t do a lockdown during the genocide and things got pretty fucking dire as a result. People have taken different lessons from this. I’m not sure what the right answer is, and which is the greater evil. Deplatforming and arresting people for inciting riots and hate speech is probably the best you can do to maintain life and liberty for the most people.

logicchains 263 days ago | | |

>Also… your neighbors in Myanmar didn’t do a lockdown during the genocide and things got pretty fucking dire as a result

The genocide in Myanmar was incited _by_ the government there; giving it more power to censor it's citizens' communications would have done absolutely nothing to help the people being genocided. Genocides don't just suddenly happen; the vast majority of genocide over the past century (including Indonesian genocides against ethnically Chinese Indonesians) had the support of the state.

kragen 263 days ago | |

VPNs that are advertised are for-profit products, which means:

1. They are in most cases run by national spy agencies.

2. They will at least appear to work, i.e., they will provide you with access to websites that are blocked by the country you are in. Depending on which country's spies run the system, they may actually work in the sense of hiding your traffic from that country's spies, or they may mark you as a specific target and save all your traffic for later analysis.

My inclination is to prefer free (open-source) software that isn't controlled by a company which can use that control against its users.

reisse 263 days ago | | |

Well, you have to host your free open-source VPN software somewhere. And then, (N. B.: technical and usability stuff aside, I'm talking only about privacy bits here) everything boils down to two equally nightmarish options.

First, you use well-known cloud or dedicated hoster. All your traffic is now tied to the single IP address of that hoster. It may be linked to you by visiting two different sites from the same IP address. Furthermore, this hoster is legally required to do anything with your VPN machine on demand of corresponding state actors (this is not a speculative scenario; i. e. Linode literally silently MitMed one of their customers on German request). Going ever further, residential and company IPs have quite different rules when it comes to law enforcement. Seeding Linux ISOs from your residential IP will be overlooked almost everywhere (sorry, Germany again), but seeding Linux ISOs from AWS can easily be a criminal offense.

Second, you use some shady abuse-proof hosting company, which keeps no logs (or at least says that) and accepts payments in XMR. Now you're logging in to your bank account from an IP address that is used to seedbox pirate content or something even more illegal, and you still don't know if anyone meddles with your VPN instance looking for crypto wallet keys in your traffic.

VPN services have a lot of "good" customers for a small amount of IP addresses, so even if they have some "bad" actors, their IPs as a whole remain "good enough". And, as the number of customers is big, each IP cannot be reliably tied to a specific customer without access logs.

some_random 263 days ago | | |

Do you have any evidence for either of these claims?

tiahura 263 days ago | | |

For 99% of use cases - piracy and porn, does that matter?

mrtesthah 263 days ago | |

[flagged]

dang 262 days ago | | |

Please don't do this here.

ali-aljufairi 262 days ago |

Tailscale

weregiraffe 263 days ago |

[flagged]

simmo9000 262 days ago | |

Recommendations for any 'good' ones?

roscas 263 days ago |

Blocking Twitter is a good start, now Facebook, Instagram, Whatsup and TikTok.

This is a good start but more should be blocked. Then force ISP to block ads.

Not just for Indonesia but all countries. But we still have a lot more to do to fix the web.

platevoltage 263 days ago | |

I can't stand most of these things you want blocked but this is bonkers.

mr90210 263 days ago | |

The issue with that is where do they draw the line. Next thing you know each country becomes North Korea.