Censorship by ISP / government -- seeking for advice!

Raegdan

Hi all,

I live in Moscow, Russia. Since mid 2012 Internet liberty here is experiencing serious govermental pressure:

filtering at ISPs' exit equipment according to federal black list formed by so-called RSOC (some kind of supervision government agency)
logging the traffic transiting via ISPs' gear into so-called "SORM-3" (Russian: "operative and interrogative actions system number 3") - system under control of Federal Safety Service (former KGB, now something like american NSA).

So, as you can see the situation is pretty hard. But I have bought a VPS in a nearby democratic country, established an OpenVPN tunnel over UDP and everything was OK until yesterday. Yesterday I found out my ISP partially blocks UDP traffic, so the tunnel often disconnects and then fails to reconnect for a many many retries - log stucks on "Initial TLS packet..." (often) or certificate checking (seldom). When it after plenty of tries establishes VPN, it lives maximum 10-15 min and then keepalive triggers restarting. So it looks like not every packet is blocked, ISP emulates some kind of high packet loss or something alike.

This gateway receives tunnels from 3 devices: my home PC, my work PC and my phone. All of them have different ISPs, but share the same configuration and only the home one experience troubles -- so it's obviously filtering and not gateway issues.

I tried changing ports, including ones reserved in RFCs for different protocols, with no luck.

OpenVPN over TCP connection looks to work seamlessly, but the speed is extremely low: 20 Mbps on direct link and 1.5 Mbps on VPN. It's unaffordable for me too, because in this case paid VPN becomes almost as slow as free Tor/I2P.

ISP support swears that they filter nothing and that may be their uplink does. But understand me, I don't give a firetruck who actually filters my traffic, I just want to make my tunnel operate on affordable reliability and speed, just want RSOC to firetruck off from me with their firetrucking filters and want our undemocratic government firetruck off from me with their firetrucking undemocratic laws! Sorry for my strong language, I'm just almost out of patience.

Changing the ISP is also bad variant because all other ISPs available in my city are much worse than the current one.

So, what advices can you give me about bypassing the UDP filtering, or making the tunnel stable at conditions of high packet loss, or increasing the speed working over TCP? I will appreciate any help and will be thankful of any advice.

Traffic

Raegdan wroteThis gateway receives tunnels from 3 devices: my home PC, my work PC and my phone. All of them have different ISPs, but share the same configuration and only the home one experience troubles

Raegdan wroteISP support swears that they filter nothing

Perhaps your home router has some hardware problem ? Try a new router ...

Raegdan

Traffic wrote
Raegdan wroteThis gateway receives tunnels from 3 devices: my home PC, my work PC and my phone. All of them have different ISPs, but share the same configuration and only the home one experience troubles
Raegdan wroteISP support swears that they filter nothing
Perhaps your home router has some hardware problem ? Try a new router ...

I'm not using a hardware router. My home gateway is an Ubuntu-powered machine, and OpenVPN client daemon is located ot it too.

Traffic

My suggestion was for you to check all the equipment you are responsible for ...

However, while I accept that your situation with government and ISP is difficult, it is possible to determine some details of how the VPN is broken, if by packet filtering.

For example (this is a simple test .. not conclusive):

Ping the server directly by real IP (not VPN) and leave it running indefinitely, log the results to a file. With a simple script you can add some 'random' breaks to the ping and time stamps to the log.

Then use your VPN; Even if you redirect your gateway the ping should continue to ping the server directly.

When the VPN goes down, check to see if the ping still replies.

If the ping is replied this would suggest that the VPN packets are being dropped some where.

You could also use traceroute (Linux) to give you an indication of where the UDP packets are being dropped ..

You could also setup the same in reverse: Server to client.

You can take detailed logs to your ISP and ask for clarification .. though I doubt they would be much help. Even in the UK ISPs are quite unhelpful until you prove absolutely that they are doing something wrong ... even then they tend to shy away from it and blame somebody else.

On the other hand .. if the pings are also filtered out then either it would suggest that they block you completely from your VPN server for a period of time .. or there is a real network problem .. as you suggest: ISP support swears that they filter nothing and that may be their uplink does.

As for this:

Raegdan wrotewhat advices can you give me about bypassing the UDP filtering, or making the tunnel stable at conditions of high packet loss, or increasing the speed working over TCP? I will appreciate any help and will be thankful of any advice.

Who ever owns the network has absolute control of it and there is nothing you can do about it .. Except reject your government .. do you even get to Vote ?

There is a 'obfuscation' patch for OpenVPN that I have never tried .. but you could.
https://forums.openvpn.net/topic12605.html

Perhaps somebody else on this forum can help ..