Wireguard is blocked in my country, so I no longer can use Tailscale or other Wireguard-based solutions. My home server is behind a NAT. What other ways of secure private connection can I use?
Does amnezia work? Its obfuscated wireguard and is, according to their github, resistant to deep packet inspection and such
https://github.com/erebe/wstunnel seems like the obvious solution.
Or maybe OpenVPN over normal TLS on port 443.
You could try to run Wireguard on a different port which would be otherwise used by some very common service, maybe there’s some general exemption for port 21, 22, 53, 80, 443…
OpenVPN is my current method. Got it running on port 443 with user certificate authentication, and tls-crypt on top of that to completely mask the protocol from VPN detectors.
Also technically prevents DoS attacks, but that wasn’t my primary goal.
Does netbird run on wg on on ovpn as well? Maybe that’s an option…
I’m not really an expert on VPN, but I believe solutions like Tailscale, Netbird, Pangolin all leverage the Wireguard protocol.
Yeah, WG is by far the best way to do this kind of networking.
NetBird is Wireguard yes.
AmneziaWG is a Wireguard fork built against deep packet inspection, try that.
Neat, I might have to set this up for myself. It sounds like it could get around some of the VPN blocking I’ve seen while traveling through airports.
Self hosted networking! Legitimately one of my favourite topics
You won’t get around the requirement of a publicly reachable endpoint. That can either be a small server with a public ip or dynamic DNS to your home with port forwarding for the VPN.
A classic option is OpenVPN. You can run it on Port 443 in TCP mode and while it won’t be performant, it has a better chance of bypassing most simple blocks
Other than that I’m a fan of completely decentralized mesh VPNs.
The one I use and am most familiar with is Yggdrasil. Connections can be established over TCP, TLS or QUIC on any port you want.
I’ve written a somewhat lengthy comment under this post. One advantage to Yggdrasil would be its existing public network. If you can firewall of your home lab to the point where joining the public network doesn’t expose a security risk to your local network, you could use that to transport your traffic instead of having your own public node or port forwarding.The same post also mentions Anywherelan, it’s intended to have better NAT handling out of the box by using community nodes.
Then there’s also EasyTier mentioned at the bottom, it is a Chinese project and those tend to have good censorship resistance.
Finally I’ll mention Nebula, it requires at least one coordination server but might also be an option
Thank you for your info, I’ll be checking out these projects.
Nebula might actually work as it doesn’t use Wireguard
Wireguard is blocked in my country
RIP
Best solution is to organize revolution to kick out the fascist that censored the internet by protocol
So helpful! Bet you’re fun at parties.
The phrase “fun at parties” has been banned from my sight. I cast Quickened Spell: 1000 Downvotes
That’s an ideal solution. The best solution is what works immediately and within your capabilities.
Port forward your SSH-server. You can forward ports through SSH to access web services or others running on the server or anything else in the network.
But only allow access through keys. And maybe try to use a different port than 22. That usually gets hammered a lot, trying to find accounts with weak passwords.
Changing the port doesn’t actually accomplish much
Best practice is to just harden SSH so that not traffic gets nowhere
Sing-box is a VPN tool built to evade censorship https://github.com/SagerNet/sing-box . It is extremely resilient and stealthy.
See also, xray and v2ray, which are similar, but in my experience sing-box is a bit better documented (at least in English) and has better maintained client apps.
Setting any of these up can be complicated, but LLMs can get you pretty far if you have safe access.
Wow. Do they block VPNs inside your country too?
Anyway, there’s openvpn and there’s nebula (I think nebula doesn’t use wireguard… do double-check), or you look into things built specifically to hide traffic (keyword: “vpn obfuscation”).
No idea if VPN protocols other than wireguard may be blocked too (probably?).
No idea if trying too hard to circumvent government policies may get you added to some list you’d rather not be in.Wireguard is effectively blocked in China, from my experience so far.
China uses deep packet inspection so that makes sense
I think the the great Firewall is less restrictive with QUIC traffic. It might be worth trying fragmented QUIC as from what I’ve read the GFW struggles to reconstruct the traffic
I use two services that do work and alternate between them: Mullvad with Obfuscation turned on, and Ghelper paired with Shadowrocket (China side ones used by Chinese devs)
From what I can tell, the issue with Wireguard is that the traffic is quite obvious. Other options might be blocked, but technically harder to implement said blocks.
See if you can use ZeroTier. It doesn’t use wire guard but rather their own protocol as far as I know.
Big Netbird fan, and they support a fully self hosted version.
Tor Hidden Services, easy to set up on the server side, can be annoying on the client side but HTTP and SSH are fine. Can be a bit slow but IMHO still usable.
That’s quite fascinating, didn’t realize Wireguard could be blocked in that way (although the WG traffic is pretty obvious looking, so it makes sense). The only solution I know of without a need for a VPS is hosting everything on Tor. Wildly private and secure, but also wildly slow. Beyond that, there are a number of ways of using a VPS to similar effect, I know people have used Cloudflare Tunnel to similar effect in the past.
Also, there are apparently quite a number of wiregaurd derivatives which protect better against detection and blocking methods. amnezia and wstunnel are the two that came up. Likewise, you will need a VPS, and might even be able to set up a tailscale-like coordination server that way (maybe with headscale, or maybe with one of its competitors like NetBird).
ZeroTier might also get the job done, but I really don’t know much about it.
Hope this helps, and good lucks!
I had luck with zerotier before switching to wireguard, but I imagine it has similar issues as talescale. Worth a try
Can you set your NAT to port forward a port to your ssh host?
I’m currently using yggdrasil to deal with this problem, though I’ve also used tor hidden services.
This is what I do. For best security practice, make sure to use public key authentication and disable password authentication so nobody can even try to guess your password.
