Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

Re:Analysis of the GFW's Unconditional Port 443 Block on Aug... by molticrystal on Wednesday August 20, 2025 @03:13AM (#44959453)

Well for starters recreate the situation and test out different approaches. Thanks to the detailed analysis that can be done.

If I understand right, a good next step would would be with eBPF or some type of proxy ignore the forged RST+ACK at the beginning.

Then it would come testing to see if sending a bunch of ACK packets, perhaps with sequence numbers that would when reconstructed could complete the handshake. Trying to send them alongside the SYN+ACK or even before if it can be predicted. Maybe try sending some packets with sequence id 0 as well to see what happens.

[ Parent | on HN ]

Re:Analysis of the GFW's Unconditional Port 443 Block on Aug... by kotri on Wednesday August 20, 2025 @06:06AM (#44960461)

> ignore the forged RST+ACK

See <Ignoring the Great Firewall of China> in 2006. That won't work if RST/ACK was injected to both sides.

> Then it would come testing to see if sending a bunch of ACK packets, perhaps with sequence numbers that would when reconstructed could complete the handshake. Trying to send them alongside the SYN+ACK or even before if it can be predicted. Maybe try sending some packets with sequence id 0 as well to see what happens.

This is an interesting approach already being utilized, namely TCB desync. But currently most people tend to buy VPN/proxy services rather than studying this.

[ Parent | on HN ]

Re:Analysis of the GFW's Unconditional Port 443 Block on Aug... by billy99k on Friday August 22, 2025 @05:43PM (#44990203)

I've been using Astrill to bypass the GFW for almost a decade. It's a bit expensive, but worth it.

[ Parent | on HN ]