Wireguard is blocked in my country, so I no longer can use Tailscale or other Wireguard-based solutions. My home server is behind a NAT. What other ways of secure private connection can I use?
Can you set your NAT to port forward a port to your ssh host?
I’m currently using yggdrasil to deal with this problem, though I’ve also used tor hidden services.
Unfortunately I’m behind CGNAT and yggdrasil is also partly blocked here (works super slow)
You might try adding more gateways to the conf file?
Or if you’ve got a host your trying to connect to I think I’ve seen people get a VPN connection through ssh? https://wiki.archlinux.org/title/VPN_over_SSH
This is what I do. For best security practices, make sure to use public key authentication and disable password authentication so nobody can even try to guess your password.
Zerotier. They have their own protocol, and there’s a free tier that lets you connect up to ten machines to make a network.
Also possible to selfhost, although I haven’t done it.
Thanks! But zerotier is also blocked here 😅
Out of curiosity, how is WireGuard blocked in your country? I would assume you cellular provider and or ISP sniffs for the default port (51820) - can’t you just put it on another port?
I haven’t tried it myself but I’ve been looking at NetBird.
Maybe others who’ve used it or know more can chime in on if this is a good idea or not?
Yes, that’s what I used to use! Love it, but wireguard is blocked
Have you tried replacing your country?
It’s also wireguard…
I have successfully setup trojan / trojan-go on my server. It uses port 443 and will return a standard website if the connection is not recognized as an authorized trojan-go client. As stealth as it can get.
Thanks! Will look into it
Tor Hidden Services, easy to set up on the server side, can be annoying on the client side but HTTP and SSH are fine. Can be a bit slow but IMHO still usable.
Based on what you planning to do, maybe mTLS could be a solution.
deleted by creator
deleted by creator
https://github.com/erebe/wstunnel seems like the obvious solution.
Or maybe OpenVPN over normal TLS on port 443.
You could try to run Wireguard on a different port which would be otherwise used by some very common service, maybe there’s some general exemption for port 21, 22, 53, 80, 443…
Wow, wstunnel seems to be a very elegant solution, thanks! However I still need to figure out how to get to my server behind a NAT
OpenVPN is my current method. Got it running on port 443 with user certificate authentication, and tls-crypt on top of that to completely mask the protocol from VPN detectors.
Also technically prevents DoS attacks, but that wasn’t my primary goal.
Does netbird run on wg on on ovpn as well? Maybe that’s an option…
I’m not really an expert on VPN, but I believe solutions like Tailscale, Netbird, Pangolin all leverage the Wireguard protocol.
Yeah, WG is by far the best way to do this kind of networking.
NetBird is Wireguard yes.
AmneziaWG is a Wireguard fork built against deep packet inspection, try that.
Yes it’s what I use for normal VPN, but I need to get around the NAT somehow. There’s been a PR for NetBird that implements AWG but it was never merged
Neat, I might have to set this up for myself. It sounds like it could get around some of the VPN blocking I’ve seen while traveling through airports.
Self hosted networking! Legitimately one of my favourite topics
You won’t get around the requirement of a publicly reachable endpoint. That can either be a small server with a public ip or dynamic DNS to your home with port forwarding for the VPN.
A classic option is OpenVPN. You can run it on Port 443 in TCP mode and while it won’t be performant, it has a better chance of bypassing most simple blocks
Other than that I’m a fan of completely decentralized mesh VPNs.
The one I use and am most familiar with is Yggdrasil. Connections can be established over TCP, TLS or QUIC on any port you want.
I’ve written a somewhat lengthy comment under this post. One advantage to Yggdrasil would be its existing public network. If you can firewall of your home lab to the point where joining the public network doesn’t expose a security risk to your local network, you could use that to transport your traffic instead of having your own public node or port forwarding.The same post also mentions Anywherelan, it’s intended to have better NAT handling out of the box by using community nodes.
Then there’s also EasyTier mentioned at the bottom, it is a Chinese project and those tend to have good censorship resistance.
Finally I’ll mention Nebula, it requires at least one coordination server but might also be an option
Thank you for your info, I’ll be checking out these projects.
Nebula might actually work as it doesn’t use Wireguard
Wireguard is blocked in my country
RIP
OpenVPN in TCP mode wrapped around Stunnel. That’s the thing that works.
I have it set up to bypass VPN restrictions in some networks, but it also serves to bypass a lot more stuff if you know what you’re doing.
DPI will only see TLS traffic, and assume it’s HTTP. You can even try to fool it by modifying the packet headers, so dumb enough DPI will think you’re connecting to the site you choose.
We have had success with this on port 443 and it appears to do a good job on networks that only allow browsing. Usual problems with TCP based VPN still apply.
Port forward your SSH-server. You can forward ports through SSH to access web services or others running on the server or anything else in the network.
But only allow access through keys. And maybe try to use a different port than 22. That usually gets hammered a lot, trying to find accounts with weak passwords.
Yep, that a good option. But only with a key ! Not with a password.
Bot from everywhere will try to forcebrut attack with many password attempt.
I got in this situation in the past. Nothing wrong happened, but it was stressfull.
Changing the port doesn’t actually accomplish much
Best practice is to just harden SSH so that not traffic gets nowhere
