actually, it is quite interesting that the great firewall can totally block most VPN's when the gov. wants it to, but most of the time they choose not to. they just make it enough of a pain for normal people to give up, yet they leave just enough access for those who really need international internet access to get by with VPN (albeit barely).
And their office has 4? different ISPs, so I know it's a bad day on the firewall when they're working from HK.
Some examples: - Dropping GRE packet so PPTP VPN is not possible - Send TCP RST to both end when a connection to dport=22 generated too much traffic
Also from my understanding, it's not that hard to use some basic machine learning techniques to classify the traffic. That's the reason why Tor project developed obfsproxy to obfuscate the traffic flow.
obfuscation of traffic to make it not look like VPN can be helpful, but traffic flow analysis based on source/origin IPs, timing and kbps/pps can still identify what looks like a VPN.
The Great Firewall is only one aspect of the problem. Most companies would we willing to host their service within the firewall and deal with it that way. The problem is that running a service within the firewall requires going through the Chinese bureaucracy that is inherently hostile to foreign companies and internet companies.
Google executives long suspected China of using local regulations and the GFW to show favoritism to local companies:
"[T]he Chinese government against Google seemed less to do with regulations and more like harassment. The sanctions appeared directly tied to how well Google was doing [...] Google executives believed that [...] when [its] market share approached 30%, suddenly bad things would happen. In China, companies need a license to run a website, and it took Google massive effort to secure one. [...] Google’s executives in China realized they were always one step away from another sanction."
I think this is exactly what the GFW is for. Train/show local talent a great concept, create/replicate homegrown version, cut off foreign version when homegrown version is ready.
At some point, China needs to be concerned if it's pissing off foreign companies. If they want American users, the door has to open both ways.
Why the US puts up with this blatant WTO violation is baffling.
Yes, the pain of doing business in China is great and asymmetric, but in some fashion, I'm happy that at least the firewall is a symmetric, universal problem.
the fact that you have to do _anything_ is a problem... also dealing with mainland providers can be challenging.
Lower bandwidth, higher latency, more packet loss, less reliability. But everything can be achieved. It's not a great problem once you're used to it.
Slack and WeChat
If you want global, secure, internal chat that works, use XMPP on a VPN. It's pretty trivial to set up.
Github is a disaster in China
No, it works perfectly. It's not even firewalled. I use it every day, no problems.
They'll turn to you asking why your API/whatever isn't working for their developers, and then expect that you have some miracle solution to get rid of the 200-400ms of latency (each way!) across the firewall, as well as a cure for the hours of it just dropping all traffic
That's not across the firewall, that's across the Atlantic. A good solution would be placing servers inside of China, or outside but nearby in Hong Kong, Japan or Korea instead of the US. For businesses of any size desiring access to the Chinese market, another POP is not a huge expense. Even for me in the west of China, HK is ~70ms away, Japan is ~100ms.
The problem is when you have a global endpoint that Chinese customers want to access. What do you do then? You either have to figure out how close you can get your services to China and hope and pray they don't whack your traffic one day, or take the bigger risk of deploying your endpoint in China. Either is fraught, but if you want to service that population...
And remember, no multicast traffic in China...
Width of the Taiwan Strait = 180 km (coast to coast)
Height of antenna required for direct line of sight = 2,542 m or ~8,400 ft. This would be one antenna on a tower and one on the ground.
Tallest antenna in the world is on top of the Burj Khalifa skyscraper at 2,722 ft.
If you split the difference (so each antenna just sees the other at sea level), the tower would need to be 635m tall or 2,088 ft. So if you put a Burj Khalifa tower on each coast you could make it work.
also the chinese version of the FCC will come along with their partyvan.
when you are dealing with a government where non-licensed non-compliant ISP type things will be shut down at OSI layer 1 by armed men with carbines, you have other problems.
A financial services "startup" in sz manages to run a VPN with some sort of official permission. Not sure what sort of connections made this possible...
In Shenzhen, there was a moment in the hotel where Google worked for about 10 minutes. I was elated but then disappointed when that brief window of openness ended.
Then consider possible alternatives.
And too boot, it's amazing that Chinese companies are still doing a really poor job of figuring out how to connect well to the outside world. They'll turn to you asking why your API/whatever isn't working for their developers, and then expect that you have some miracle solution to get rid of the 200-400ms of latency (each way!) across the firewall, as well as a cure for the hours of it just dropping all traffic. Perhaps the Party has scared them enough they're not willing to chance employees doing illegal things on the company's connection...
The firewall is a fickle, cantankerous beast that, to me, is really at heart of this matter. Because they want throats to choke for every packet on Chinese soil, they've created this huge barrier that touches everything you might want to do in China or with a Chinese company.