10 years ago I would have said 'it's probably Western companies helping them'.
Now, I would say probably it's Chinese. Frankly, because it's going to be so, so much cheaper, let alone it probably doesn't come with any potential political headaches, and, they are developing a 'core competency' in this.
That said, Putin has serious geopolitical interest in Belarus, and himself is supportive of the regime. Since the Russian state is also 'good at that stuff' it could very well be a state-sponsored initiative.
Finally, Belarus is not Venezuela, wherein they might have difficulty recruiting all the talent necessary to do this. Belarus has enough native talent to contemplate the task.
But it'd be interesting to know 'who' is helping them do this.
You might want to pad the traffic too. IIRC, the GFW can detect many kinds of VPN connections based off of a sequence of characteristic packet lengths during the handshake.
I've been wondering why it's called that for the last few days, thanks! Curiously, it's not mentioned on the Russian NEXTA wikipedia page.
At a casual glance, look at how Beltelecom is one of the very, very few that has any international peers just based on the flags: https://bgp.he.net/AS6697#_peers
Then look at the others:
https://bgp.he.net/AS12406#_peers
https://bgp.he.net/AS60330#_peers
https://bgp.he.net/AS25106#_peers
This is similar to to Iran's ITC/TIC (there's a handful of them, pop in 12880, 49666, 48159, etc. onto bgp.he for a quick look) where they are the in-between to international peers and domestic peers.
If it happens again (but SSH still works), then to enable general web browsing you can:
1. Set up Squid (a proxy server) on a remote host. eg a VM in Digital Ocean. You may need to ask someone to do this for you, if you don't have a VM you can access remotely already.
2. Configure SSH to proxy traffic from your (desktop) web browser to that remote Squid server
3. Configure your browser (eg Firefox/Chrome) to use the new SSH proxy
It sounds like you're familiar with the Linux or macOS command line, so you shouldn't have much trouble.
I've done exactly this before, and it works reliably. Browsing speed is a bit slower than standard though, but not horrible. :)
We saw that (at least as of 8 PM UTC) outbound connections to HTTP servers wasn't really a problem. A fresh ec2 box with a basic web server wasn't effected.
So, early yesterday I set up an OpenVPN server on ec2 (eu-west-1) to try to get some slow but functional internet access. What we saw was that about 15-30 seconds after the TLS handshake the connection would stall and drop out. To me this says they're doing some deep packet inspection to find TLS and dropping those firewall states. I also noticed while running `tcpdump` that almost every tcp segment from a BY address had incorrect CRC's after the IDS kicked in.
Tonight we're going to try using an xor tcp proxy to obfuscate the VPN traffic. The system we're using has a name, but I'm not going to say it to risk KGB (yes it's still called that there) creating IDS signatures and killing our VPN. I'm sure that after a few hours it will start dropping these connections as well, but if we can buy some time that's worth while.
This, really, is the real problem with the internet. In many small countries there's only one IX, often under government ownership or supervision. You might think that they know better than to do stuff like this, but push comes to shove they'll all lock it down as soon as there's a threat to their authority.