how to find client already uses openvpn

ovpn

Hello
sorry if OT but maybe there is someone knowledgeable in this forum to answer ;-)
I noticed certain public openvpn providers can determine whether user uses openvpn or not.
How is this possible ?
Do they check MTU size or sth?
Is this possible to configure something on server so openvpn traffic looks no different than regular traffic arriving from public internet that is arriving not over openvpn?

maikcat

keep in mind that ISPs can perform deep packet inspection...

Michael.

ovpn

could be some other technique?
Consider this:
Client in Europe buys paid VPN service to watch Hulu.
So after watching Hulu he does some websurf over VPN and spotted Astrill.com offers cheaper, maybe faster VPN service.
He visits Astrill.com tries to sign up and hits wall as explained here:
http://storify.com/Saccaparami/some-vpn-providers-respect-privacy-and-then-there

As I looked further into Astrill's site, I started to go through the procedure of purchasing a 1 year subscription, just to see what would happen. As it turns out, Astrill will not let you even purchase their product if they detect you are behind a proxy or a VPN, even if that is Astrill's own VPN!

If it was due to ISP DPI some copyright agency would probably block many movie sites accessible over VPN.
Could it be sth with how SSL is handled?

maikcat

DPI & detecting if you are going through a proxy are 2 different things...

please also read

http://security.stackexchange.com/questions/20067/advanced-techniques-for-detecting-a-proxy-getting-original-ip

There are multiple ways to detect whether or not your traffic is of proxy origin. Two easy ones are:

Presence of the X-Forwarded-For header (or custom data in forwarded headers)
Cross-checking known IPs of proxies or exit relays (TOR)
databases maintained by third parties (e.g. Quova)

There are other ways, possibly requiring additional intelligence on the server, perhaps to correlate requests across connections from different IPs, i.e. looking at user-agent criteria and timing of requests, cookies, LSOs in flash, (one of the reasons you'd want cookies and Flash player disabled to really anonymize yourself).

Michael.

ovpn

For sure proxy is not case, all those test sites from your link pass with no detection of proxy, and yes tried webbrowser without flash player installed.
As he complained about Astrill

they detect you are behind a proxy or a VPN

this means he tried both, btw Astrill now either removed such detection or no longer care.
It just upsets keeping in mind that one day all movie sites may become inaccessible from overseas once Hulu or Netflix implements this.
Thanks anyway for your help.