outline-apps VS wstunnel

Outline, a free and open-source VPN service developed by Google, is renowned for its user-friendly design. It can be conveniently established on diverse platforms, and this blog will specifically guide you through the process of setting up a self-hosted Outline VPN using Amazon LightSail.

Another good way is to set up your own VPN server on Digitalocean or something. Use a VPN protocol that is good at escaping detection. I recommend Outline VPN (getoutline.org). It's an open-source project that uses the Shadowsocks protocol and aims to provide censorship-free Internet to journalists in certain countries. It's not a VPN service so you need to set it up on your own server.

Use a self-hosted Outline on GCP or any other cloud platform, it works really well in my experience for circumventing these blocks.

Yes. Use an outline service. https://getoutline.org/

See https://github.com/Jigsaw-Code/outline-client/issues/1177, technically you don't need Outline Client, compatible Shadowsocks client like https://github.com/shadowsocks/ShadowsocksX-NG/releases should work too.

wstunnel - Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Rust with executables provided.

Shameless plug, there is also wstunnel (i am its author) https://github.com/erebe/wstunnel/, hope you enjoy.

If you want to tunnel UDP (WireGuard) or TCP (SSH) over WebSocket protocol, check out https://github.com/erebe/wstunnel

While working in an environment where VPN connections were pretty much all blocked⁰ a friend of mine had success using https://guacamole.apache.org/ to access a remote machine¹. Not quite the same as a direct VPN connection but worth a try if nothing else functions, it looks enough like normal HTTPS traffic that he got away with it.

To keep your wireguard setup more as-is, you could try https://kirill888.github.io/notes/wireguard-via-websocket/ to tunnel that via a web server. In fact https://github.com/erebe/wstunnel which that uses could be used just as well with any other UDP based VPN.

I once tinkered with https://github.com/yarrick/iodine and successfully connected to resources over the wireless on a train, bypassing its traffic capture and sign-up requirement, so that might be an option, though I think fully blocking external DNS is more common now so this is less likely to work²³.

--

[0] practically only HTTP(S) permitted, not even SSH, DPI in use that detected just using SSH or OpenVPN over port 443

[1] NOTE: be careful breaching restrictions like this, you are at risk of an insta-sacking if discovered, or worse if operating in some securiry environments!

[2] and the latency when it does work is significant!

[3] and that much traffic over port 53 might get noticed by the heuristics of data exfiltration scanner, encouraging sysadmins to notice and implement a way to block it

You can try with this project, https://github.com/erebe/wstunnel.

There are projects out there (like this) which run wireguard traffic through websocket.