Block vpn in Russia?

[zimbabwe 11]

22 hours ago, the.one.dda said:

Today the last working option (wireguard app in router) deid. So, I'd say it's just the time for support team to come up with some sort of clear instruction for normal users.

SSH and SSL tunneling is very hard to set up on a router unless you are a very advanced user (here is an example for dd-wrt firmware; for original firmware it is not possible at all). So unfortunately normal users have to stick to using Eddie, with a bit of configuring it can do both SSH and SSL.

[the.one.dda 2]

It took me about 5 hours, but I've found a combination that brought Wireguard back online in router. However there is still a problem with cellular provider. Cannot find a way to connect via eddie, wireguard or openvpn (ios and android). The old ssh manual for android is not working either. 

Edited ... by the.one.dda

[zimbabwe 11]

I don't know if it's only for me but both SSL and SSH tunneling have got incredibly slow in the last several days, approximately since the beginning of the infamous throttling of YouTube (1st of August) or may be a couple of days later. I tried adding additional options for stunnel (socket = r:SO_OOBINLINE=yes; sni =; failover = rr; delay = yes), tried passing it through a DPI spoofer (byedpi, SpoofDPI) using proxychains: nothing helps at all, the speed still varies enormously, one moment it can be over 10 mbps, and 10 seconds later it almost stalls completely, or it may work fine for several minutes and then begin to degrade, or otherwise recover up to 10 mbps. It's completely unpredictable, and there are no errors in the log. Where is the problem? Is there a way to circumvent it?

[gc2017 0]

I have the same problem so i opened a support ticket about the secret bootstrap servers. Signal is soon to be blocked in RF too :/.

[Fezenari 0]

On 8/3/2024 at 8:32 PM, the.one.dda said:

Cannot find a way to connect via eddie, wireguard or openvpn (ios and android). The old ssh manual for android is not working either.  

I use Connectbot and Eddie together and they work pretty well. The only thing wrong in the old guide are port numbers, everything else is still accurate.

[zimbabwe 11]

May be it is all just snake oil but yesterday I was playing with the MTU settings of my OpenVPN client (SSL-wrapped) and for some reason the values around

--tun-mtu 700 --mssfix 692 mtu

improve the situation with the throttling quite visibly. SpeedTest shows that higher values (1000 or more) cause the speed to drop steeper and in larger steps, finally causing the complete freezing of transmission, lower values (500 or less) make the connection just slow and unreliable. It seems like 700 is sort of the golden middle.

Also for Linux enabling BBR (Bottleneck Bandwidth and RTT) may increase the throughput. If your Linux kernel is recent enough (4.9 or later), add the following lines to /etc/sysctl.conf:

net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr

Then execute sysctl --system or reboot.

And one more advice: switch cipher to CHACHA20-POLY1305, it seems that it's now supported by almost all AirVPN servers. It probably means next to nothing but as far as I understand in theory its presence is not that easily detectable by DPI in the SSL-encrypted traffic as AES. To switch add the following parameter to openvpn (if it's started manually):

--data-ciphers CHACHA20-POLY1305

Or alternatively edit the data-ciphers line in the .conf file.

[wwshake 3]

Currently in Russia, I can confirm that OpenVPN UDP without any extra config (on any port) works on some US, NL and LV servers on mobile networks (MegaFon, MTS).
On household connections, regular OpenVPN does not seem to work at all, but regular WireGuard sometimes does. When it doesn't work, the connection handshake usually succeeds, but no traffic passes.

But what I wanted to share is that I've had near 100% success (on both household and mobile connections) using the AmneziaWG client with many (most?) AirVPN servers. This is a client that introduces modified handshake parameters intended to fool DPI, while remaining compatible with the vanilla WireGuard server implementation, and it's available for all platforms (you can always compile from source, but at the time of writing there are binaries available at least for Windows, iOS and Mac OS and Android. Linux kernel modules and binaries are also available on Github). Note: there is also an "AmneziaVPN" GUI client but I prefer to use the bare protocol implementation instead.

These additional parameters are needed in the WireGuard config file generated by the Config Generator (check the Amnezia documentation for a detailed explanation), and have been verified to work:
 

[Interface]
Jc = 3
Jmin = 40
Jmax = 70
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4

[zimbabwe 11]

Yes, I can confirm that AmneziaWG currently works amazingly well with AirVPN. I get speeds up to 150+ Mbps to the German servers even without the kernel module (sorry but I don't want to install anything from GitHub into the kernel). Unfortunately it's still a "DPI spoofing" solution in the vein of GoodbyeDPI, byedpi, SpoofDPI, etc., hence sooner or later they manage to detect those fake packet tricks and block it. My opinion is that only real obfuscation (methods used by Cloak, VRay, etc.) can be considered a long-term solution.

For those who, like me, uses a Linux home server which acts like a VPN gateway, and start WireGuard/OpenVPN in a custom way, a couple of advices: download, compile and install both amneziavpn-go and amneziawg-tools. The first is the userspace daemon which creates the network interface, it will be run automatically once you run either:

awg-quick <wg_interface_name>
awg-quick <full_path_to_wg_config_file>

That is the only command you should run.