Softether: TLS handshake is blocked

Omid Shojaee

Hello,

I am unable to connect to my OpenVPN server because TLS handshake is blocked in my country in order to prevent people from using VPN.

Is there any solution? Changing TLS version? Disabling TLS?

Please assist.

Regards
Omid

TinCanTech

OpenVPN now has --tls-crypt which may defeat your adversary for a while ..
but most likely They will block that once They find it.

Try it and let us know.

Omid Shojaee

Hello,

Would you please explain how to add this key to the config file?

I am using OpenVPN GUI 2.4.4-1601 on Windows 10.

Thank you very much.

TinCanTech

See --tls-crypt in The Manual v24x

Omid Shojaee

My understanding is, I have to generate a key file and store it on both server and client (correct me if I am wrong).

I'm afraid this doesn't work for me. My OpenVPN server is not the real server. It is SoftEther server which has built-in OpenVPN clone functionality.

I do have a SOCSK5 proxy server that works without any issue. If somehow I can manage to route OpenVPN traffic through that, then I can get past TLS handshake. Is this possible? Please note that the proxy server requires user/pass authentication.

TinCanTech

Omid Shojaee wrote My understanding is, I have to generate a key file and store it on both server and client (correct me if I am wrong).

That is correct. (For OpenVPN)

Omid Shojaee wrote I'm afraid this doesn't work for me. My OpenVPN server is not the real server. It is SoftEther server which has built-in OpenVPN clone functionality.

Then you have probably come to the wrong place. We don't really support softether.

Omid Shojaee wrote I do have a SOCSK5 proxy server that works without any issue. If somehow I can manage to route OpenVPN traffic through that, then I can get past TLS handshake. Is this possible? Please note that the proxy server requires user/pass authentication.

Something along those lines may be possible but again "We don't support softether and I don't know what it can/cannot do"

Note: --tls-crypt in OpenVPN may not be available in softether .. ask the softether people.

Also, after reading this, I personally find some of Their claims (that softether can beat any firewall) rather misleading and possibly outright lies. YMMV