Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Advertise on LowEndTalk.com
Pakistan ISPs blocking IPs using VPN, etc.
New on LowEndTalk? Please Register and read our Community Rules.

Pakistan ISPs blocking IPs using VPN, etc.

rskrsk Member, Provider
edited March 2014 in General

Hello,

We have some clients from Pakistan, who use their purchased VPSs as VPNs.

They have used normal openvpn, as well as the "encrypted/scrambled" approach.

Give it a week or two, and the IP gets blocked at the ISP level from within Pakistan.

Any ideas / solutions to bypass this?

Thanks :-)

«1

Comments

  • Using encryption is illegal in Pakistan. Maybe that's why.

    -

  • rskrsk Member, Provider

    @rds100 said:
    Using encryption is illegal in Pakistan. Maybe that's why.

    There must be a different approach. They'd go without any VPN, but also there are voice servers running, which another thing that gets blocked ... hence the VPN server.

  • Try to make it not look like VPN, maybe using non-default ports like 80 or 443.

    Thanked by 10xdragon

    -

  • rskrsk Member, Provider

    @rds100 said:
    Try to make it not look like VPN, maybe using non-default ports like 80 or 443.

    VPN already runs on 443, still same issue... :(

    I am completely off the hook these days ...

  • WilliamWilliam Member, Provider

    The largest telco uses Chinese DPI tech - Likely due to less total throughput (no, not likely, reality) they can run more deeper anylsis and block easier.

    SSH tunnels should work.

  • @rsk said:
    Hello,

    We have some clients from Pakistan, who use their purchased VPSs as VPNs.

    They have used normal openvpn, as well as the "encrypted/scrambled" approach.

    Give it a week or two, and the IP gets blocked at the ISP level from within Pakistan.

    Any ideas / solutions to bypass this?

    Thanks :-)

    Actually they are not blocking VPNs specifically but the new infrastructure which they have introducted to block illegal content is not well optimized yet so that is causing a problem for legit users as well.

    The only way I can think of fixing this as of now is asking your clients to report the IP blocking of their VPS at [email protected] & tell them that they are not doing anything illegal on their IP like hosting pornographic or content contaiing religious hatred and then PTA(Pakistan Telecommunication Authority) would unblock their IPs in 3 or 4 working days.

    Thanked by 1Myelin
  • rskrsk Member, Provider

    K2Bytes said: The only way I can think of fixing this as of now is asking your clients to report the IP blocking of their VPS at [email protected] & tell them that they are not doing anything illegal on their IP like hosting pornographic or content contaiing religious hatred and then PTA(Pakistan Telecommunication Authority) would unblock their IPs in 3 or 4 working days.

    Have you tried this method?

  • Shoaib_AShoaib_A Member
    edited March 2014

    @rsk said:
    Have you tried this method?

    Yes the European IPs of several of the game servers that we run for our gaming community were blocked in Pakistan. I emailed them about it with Gametracker links & they unblocked them within 3 or 4 days.

  • rds100 said: Using encryption is illegal in Pakistan.

    LOL no. That's not true.

  • Abdussamad said: LOL no. That's not true.

    According to http://www.techglobex.net/2011/08/pakistan-to-ban-encryption-software-and.html it seems to be the case though.

  • A vpn using port 8080 or maybe 21 or maybe 1080, is it possible?

  • WilliamWilliam Member, Provider

    Unlikely, it's DPI which (with ZTE/Huawei) does not rely on port info.

  • Try Softether, it is suppose to bypass DPI and disguise the vpn traffic as normal https traffic if you set it to run at port 443.

  • FritzFritz Member

    Use ICMP VPN. That might help.

    I'm Good!

  • john564john564 Member
    edited March 2014

    If they are blocking IP, have you tried ipv6 IP's ?
    please give feedback on IPV6 if you try it.

    if SSH is working, you can route your vpn via SSH connection
    e.g. with openvpn client script using TCP add (if socks port is 8080)
    "socks-proxy localhost 8080"
    openvpn via SSH is useful for skype and other applications.
    if only web browsing, use web browser SSH socks

    Till now, scramble openvpn working from China, except during busy hour
    to europe, when you get lots of TLS handshake and reset errors,
    outside busy hour it connects first time.

    Thanked by 1Myelin
  • AsimAsim Member

    rsk said: Have you tried this method?

    Does not work

    Ask clients to use WITRIBE instead of PTCL as ISP. WITRIBE is fighting with PTA to fight against this blockade. Im using VPNs on WITRIBE even VONAGE devices without any issues since years

    If you intend to use PTCL, just prioritize traffic via IPv6 and get an HE IPv6 tunnel. Works for me. I can even stream youtube ;)

    Thanked by 1TahirInsha
  • @Asim said:

    Any idea why on earth is PTA blocking legitimate traffic?

  • @K2Bytes said:
    Any idea why on earth is PTA blocking legitimate traffic?

    The government doesn't give two s**ts about anything other than keeping content in line with their religious and idealistic beliefs.

    Thanked by 2tszilassi muratai
  • rskrsk Member, Provider

    Asim said: If you intend to use PTCL, just prioritize traffic via IPv6 and get an HE IPv6 tunnel. Works for me. I can even stream youtube ;)

    Having an HE IPv6 tunnel (far from Pakistan) would bring some issues as the devices are routing voice, etc.

  • neroux said: it seems to be the case though.

    It's just a random article with no source. The only thing the govt. cares about here is to block unlicensed international call termination gateways. They want to protect the monopoly of PTCL.

    When it comes to Pakistan don't believe everything you read in the western media. According to me and millions of people who actually live in Pakistan encryption is not banned. SSL, SSH, PGP etc are all working fine. NADRA itself uses PKI to secure ID data of our citizens. Also see my site. If encryption is banned how come I'm not in jail :) ?

    Thanked by 1Shoaib_A
  • Microlinux said:

    The government doesn't give two s**ts about anything other than keeping content in line with their religious and idealistic beliefs.

    The government doesn't care about religion. It's actually some people who start protesting so they have to enact some token blocks to appease them. So politics basically.

    Only 1% of the population has broadband so most people have no idea what they are protesting even.

  • @Microlinux said:
    The government doesn't give two s**ts about anything other than keeping content in line with their religious and idealistic beliefs.

    VPNs got nothing to do wit their religious beliefs as far as I know.

  • I don't see that reported problem have any concern with VPN, Encryption or political blockage. I think, it is a case of Illegal call termination aka grey traffic.

    And interesting fact about it is that, It is very hard to bypass, when they are monitoring for symmetrical bandwidth (incoming =~ outbound) !

    Thanked by 1TahirInsha
  • rskrsk Member, Provider

    @nasirbest said:
    I don't see that reported problem have any concern with VPN, Encryption or political blockage. I think, it is a case of Illegal call termination aka grey traffic.

    And interesting fact about it is that, It is very hard to bypass, when they are monitoring for symmetrical bandwidth (incoming =~ outbound) !

    While this is true ... voice traffic is not very high when compared to video for example.

  • MicrolinuxMicrolinux Member
    edited March 2014

    @Abdussamad said:
    The government doesn't care about religion.

    Surely you are joking. They have blasphemy laws for christ's sake.

    @Abdussamad said:
    So politics basically.

    That falls under the idealistic beliefs I mentioned.

    @K2Bytes said:
    VPNs got nothing to do wit their religious beliefs as far as I know.

    VPNs allow the people to access information the government feels it has a right to withhold from them.

  • AbdussamadAbdussamad Member
    edited March 2014

    Microlinux said: Surely you are joking. They have blasphemy laws for christ's sake.

    No I'm not joking. Pakistani laws are based on English laws. Pakistan used to be a British colony and most of our laws are inherited from that time period. Blasphemy laws are of course newer but an example of the sort of laws the British left us with:

    http://tribune.com.pk/story/677009/judicial-review-christian-divorce-law-is-insulting-to-women/

    Anyway, generally speaking, laws are not enforced here. This is a pretty lawless country.

  • hosthatchhosthatch Member, Provider

    @Asim said:

    You have to wonder why PTCL doesn't protest against it. Maybe, just maybe youtube being blocked has nothing to do with an "anti-religious" video and it has to do with the millions they save in bandwidth costs while still charging the same to the customers.

    And the reason they block VoIP so PTCL can maintain it's monopoly and because "it costs the Pakistani economy" is no different than killing someone who invents a cheaper alternative of petroleum.

    Premium SSD VPS in Sweden, Norway, Austria, US, Hong Kong and Netherlands w/ DDoS protection available!

  • The way people seem to get around this in other countries like UAE, Saudi Arabia is to use two way satellite. Its slow/expensive but you don't get this type of interference.

  • rskrsk Member, Provider

    @MarkTurner said:
    The way people seem to get around this in other countries like UAE, Saudi Arabia is to use two way satellite. Its slow/expensive but you don't get this type of interference.

    Not viable for budget providers .. surely not for $5 per month :P

  • I am not meaning for the provider but the user

  • cececece Member

    wow, I thouth GFW of China have the best technology to block vpn and ssh forward. Now It seems Pakistan beat us.

  • WilliamWilliam Member, Provider
    edited March 2014

    @MarkTurner said:
    The way people seem to get around this in other countries like UAE, Saudi Arabia is to use two way satellite. Its slow/expensive but you don't get this type of interference.

    And in some countries there you go to jail or end on a crane with a rope in your neck for this.

    cece said: wow, I thouth GFW of China have the best technology to block vpn and ssh forward. Now It seems Pakistan beat us.

    Pakistan is using Chinese ZTE/Huawei tech.

  • @William - that all depends on the country and your connections. Last time I was in Dubai, almost all of my colleagues had licensed two way satellite systems just to avoid slow network of Etisalat at home.

    In Pakistan, you can also obtain a license for a business to operate a two way system, its just a matter of having the right level of contacts at MOC/MOITT.

  • Also I think it is not ZTE/Huawei but Netsweeper out of Ontario, CA who actually provides the filtering software.

    Thanked by 1TahirInsha
  • I have two ISPs here in Pakistan, one is simply reselling two others & i can't use VPN from that. But i can easily use on PTCL (Biggest ISP here).

    Thanked by 1TheKiller

    I don't have any relation/affiliation with any LET Host, All of my comments are my own
    Simple bash script to clean compromised wordpress site [cPanel/WHM specified]

  • BrianHarrisonBrianHarrison Member, Provider

    @rds100 said:
    Using encryption is illegal in Pakistan. Maybe that's why.

    https://www.google.com.pk

    Whoops!

    Reprise Hosting (AS62838) Intel Xeon L5520, 1TB SATA, 4GB RAM, 10TB BW, $27/mo with DED10 promo! Cheap dedicated servers.
    VPSHostingDeal.com - Low-cost self-managed OpenVZ + Xen cheap VPS hosting. Plans starting at $12 PER YEAR! Cheap VPS.

  • Do a traceroute, this is not in Pakistan ;-)

    -

  • BrianHarrisonBrianHarrison Member, Provider

    @rds100 said:
    Do a traceroute, this is not in Pakistan ;-)

    But it is presumably visited by users in Pakistan :-)

    Or do they completely block https? I guess I've never checked...

    Reprise Hosting (AS62838) Intel Xeon L5520, 1TB SATA, 4GB RAM, 10TB BW, $27/mo with DED10 promo! Cheap dedicated servers.
    VPSHostingDeal.com - Low-cost self-managed OpenVZ + Xen cheap VPS hosting. Plans starting at $12 PER YEAR! Cheap VPS.

  • Shoaib_AShoaib_A Member
    edited September 2014

    @BrianHarrison said:
    Or do they completely block https? I guess I've never checked...

    When you type google.com(in your web browser) in Pakistan, it does redirect you to google.com.pk. And it is not hosted in Pakistan because bandwidth is more expensive than you can even imgine.

    @rds100 using encryption is allowed & there are uncountable websites in Pakistan using encryption. What is not allowed is VPN & VOIP on unregistered IPs as after army did operation against terrorists in areas close to Afghanistan, they started using that stuff for communication. But you can use VPN & VOIP freely once you register your IPs by sending an email to [email protected] And you need to register your IPs only if you are using foreign IPs for VPN/VOIP. If you're hosting a teamspeak/mumble & they see traffic from Pakistan to it, they would block the IP until you register it.

  • Now you guys can understand now it feels for those in Chinese Mainland... I mean I do feel sorry for that.

    You can:

    1. Try Goagent. Google this project, this should work for your guys since Google is not blocked there.

    2. Try Openvpn/ssh with obfuscate. Also run that on 443 or 53.

    3. With multiple SaaS available , try Wallproxy.

    4. Why not give Shadowsocks a try? After Openvpn , photo and l2tp being blocked, this tool is getting popular. Cross platform, easy to setup.

    5. Soft ether VPN is a good choice if you trust those random servers. Better host ur own server.

  • @superwbd said:
    Now you guys can understand now it feels for those in Chinese Mainland... I mean I do feel sorry for that.

    Yes we do feel for Chinese as there almost everything is blocked but in Pakistan they only block porn sites. Other than that you can use pretty much everything.

  • After the price increase for inbound voip traffic , the grey routes increased significantly , in order to tackle it , they introduced this new system. For them Voice server is a no no

  • Hey...I am from Pakistan
    Just buy a cheap vps ..And disable apache service and set ssh to listen on port 443 and some other port too
    Then download software bitvise tunnelier and setup socks proxy forwarding and there you go....:-) Problem solved .

  • Are you sure ip is blocked by Govt and not by specific isp ?

    .............................................................................................Short Url

  • raza19raza19 Member
    edited September 2014

    I am 100% sure they can not block any kind of encrypted traffic. Pakistan blocks youtube but you can open youtube using https. Several people I know have used openvpn from pk with success & they have been doing it for years. What you describe is a result of something not encrypted ! Yes the giant firewalls do read inside unecrypted packets . If you are using gre tunnels or other methods to create a vpn where packets are readable then no method can save you.

    & if there are still unresolved issues that have to do with ports blocking from within pk (pathetic) then simply use encrypted 443 ! They can't kick their own bread & butter by blocking it ! Once on it, its almost virtually impossible to distinguish the contents of traffic.

    We are star-stuff. We are the Universe, made manifest, trying to figure itself out.

  • @raza19 said:
    I am 100% sure they can not block any kind of encrypted traffic. Pakistan blocks youtube but you can open youtube using https. Several people I know have used openvpn from pk with success & they have been doing it for years. What you describe is a result of something not encrypted ! Yes the giant firewalls do read inside unecrypted packets . If you are using gre tunnels or other methods to create a vpn where packets are readable then no method can save you.

    & if there are still unresolved issues that have to do with ports blocking from within pk (pathetic) then simply use encrypted 443 ! They can't kick their own bread & butter by blocking it ! Once on it, its almost virtually impossible to distinguish the contents of traffic.

    They indeed are able to. I signed up with PureVPN, set it up onmy router using PPTP. For a week or so, VoIP using a SPA3000 worked intermittently, i.e. would work for a day or 2, and then fail to register, I would then choose antoher vpn server from the multitudes PureVPN have and it would work again, another day or so, and then fail again.. as of yesterday, VPN has stopped working completely, as in, if I try to set my Internet Connection type to PPTP and enter vpn credentials, the router fails to connect - no internet. Any way around this?.

  • Broken English. Obviously a fake or amateur news site.

    Interesting also that several people from Pakistan have posted and said there's no problem.

    I wonder what is really going on with the OP.

  • @raza19 said:
    I am 100% sure they can not block any kind of encrypted traffic. Pakistan blocks youtube but you can open youtube using https. Several people I know have used openvpn from pk with success & they have been doing it for years. What you describe is a result of something not encrypted ! Yes the giant firewalls do read inside unecrypted packets . If you are using gre tunnels or other methods to create a vpn where packets are readable then no method can save you.

    & if there are still unresolved issues that have to do with ports blocking from within pk (pathetic) then simply use encrypted 443 ! They can't kick their own bread & butter by blocking it ! Once on it, its almost virtually impossible to distinguish the contents of traffic.

    If they buy technical from China then it's easy to block all encrypted traffic especially for PPTP and OPENVPN.

  • Greyhound said: If they buy technical from China then it's easy to block all encrypted traffic especially for PPTP and OPENVPN.

    It may be easy, but do they?

  • raza19raza19 Member
    edited July 2015

    @rizsher said:
    They indeed are able to. I signed up with PureVPN, set it up onmy router using PPTP. For a week or so, VoIP using a SPA3000 worked intermittently, i.e. would work for a day or 2, and then fail to register, I would then choose antoher vpn server from the multitudes PureVPN have and it would work again, another day or so, and then fail again.. as of yesterday, VPN has stopped working completely, as in, if I try to set my Internet Connection type to PPTP and enter vpn credentials, the router fails to connect - no internet. Any way around this?.

    This is a matter of encryption, I visit Pakistan often & every time I use 256 bits encrypted vpns, there might be something else going on, maybe they are gauging the use of public vpn ips & blocking entire subnets.

    Try getting a small vps from here & then installing your own openvpn server with high encryption cipher . I am sure it will work & if it still doesn't then use an ssl proxy on top of the vpn /stunnel, I can guarantee you it will work because they cannot in their right mind block all https communication. Plus use ports like 443, 80, 21,22, etc.

    It works, you just gotta put in some little effort.

    We are star-stuff. We are the Universe, made manifest, trying to figure itself out.

Sign In or Register to comment.