Wireguard is blocked in my country, so I no longer can use Tailscale or other Wireguard-based solutions. My home server is behind a NAT. What other ways of secure private connection can I use?
Can you set your NAT to port forward a port to your ssh host?
I’m currently using yggdrasil to deal with this problem, though I’ve also used tor hidden services.
Unfortunately I’m behind CGNAT and yggdrasil is also partly blocked here (works super slow)
You might try adding more gateways to the conf file?
Or if you’ve got a host your trying to connect to I think I’ve seen people get a VPN connection through ssh? https://wiki.archlinux.org/title/VPN_over_SSH
This is what I do. For best security practice, make sure to use public key authentication and disable password authentication so nobody can even try to guess your password.
Best solution is to organize revolution to kick out the fascist that censored the internet by protocol
Well you’d still depend on someone else’s will to provide you with robust and uncensored internet connection. The actual solution is to build a decentralised people-owned network using Reticulum for example. Reticulum over WiFi HaLow already works very well for small-scale local networks.
That’s an ideal solution. The best solution is what works immediately and within your capabilities.
So helpful! Bet you’re fun at parties.
The phrase “fun at parties” has been banned from my sight. I cast Quickened Spell: 1000 Downvotes
that is neither easy nor quick.
Nothing worth having ever is.
Sing-box is a VPN tool built to evade censorship https://github.com/SagerNet/sing-box . It is extremely resilient and stealthy.
See also, xray and v2ray, which are similar, but in my experience sing-box is a bit better documented (at least in English) and has better maintained client apps.
Setting any of these up can be complicated, but LLMs can get you pretty far if you have safe access.
Zerotier. They have their own protocol, and there’s a free tier that lets you connect up to ten machines to make a network.
Also possible to selfhost, although I haven’t done it.
Thanks! But zerotier is also blocked here 😅
Out of curiosity, how is WireGuard blocked in your country? I would assume you cellular provider and or ISP sniffs for the default port (51820) - can’t you just put it on another port?
I haven’t tried it myself but I’ve been looking at NetBird.
Maybe others who’ve used it or know more can chime in on if this is a good idea or not?
Yes, that’s what I used to use! Love it, but wireguard is blocked
Have you tried replacing your country?
It’s also wireguard…
Could use SSH tunnel to an entry point
Yes, I’ve tried that, but it’s not robust enough. This is what I’ll eventually resort to, if I don’t find a better solution.
I have successfully setup trojan / trojan-go on my server. It uses port 443 and will return a standard website if the connection is not recognized as an authorized trojan-go client. As stealth as it can get.
Thanks! Will look into it
So this has been interesting to me as I’m travelling at the moment and wireguard has been blocked on the guest wifi I’ve been on across the hotels, I’ve had to rely on cellular instead.
I’ve just tried Teleport on my Unifi router and that works. I believe it uses wireguard, and it is taking up to 20secs to connect, but I’m now curious as to what it’s doing to bypass the VPN restrictions that are blocking plain wireguard.
How is this even a thing? Businesses can’t just have open network connections.
You could set up wireguard via stunnel maybe to port 22
Tor Hidden Services, easy to set up on the server side, can be annoying on the client side but HTTP and SSH are fine. Can be a bit slow but IMHO still usable.
Based on what you planning to do, maybe mTLS could be a solution.
deleted by creator
deleted by creator
Run ssh on an Onion Service.
https://github.com/erebe/wstunnel seems like the obvious solution.
Or maybe OpenVPN over normal TLS on port 443.
You could try to run Wireguard on a different port which would be otherwise used by some very common service, maybe there’s some general exemption for port 21, 22, 53, 80, 443…
Wow, wstunnel seems to be a very elegant solution, thanks! However I still need to figure out how to get to my server behind a NAT
OpenVPN is my current method. Got it running on port 443 with user certificate authentication, and tls-crypt on top of that to completely mask the protocol from VPN detectors.
Also technically prevents DoS attacks, but that wasn’t my primary goal.
Does netbird run on wg on on ovpn as well? Maybe that’s an option…
I’m not really an expert on VPN, but I believe solutions like Tailscale, Netbird, Pangolin all leverage the Wireguard protocol.
Yeah, WG is by far the best way to do this kind of networking.
NetBird is Wireguard yes.
