OpenGFW: an open source implementation of China's Great Firewall

https://github.com/apernet/OpenGFW

by supriyo-biswas • 2 years ago

141 54 2 years ago

github.com

lucubratory• 2 years ago

So it's like a souped-up PiHole?

supriyo-biswas• 2 years ago

The focus here is on detecting the usage of VPN protocols based on signatures, entropy, and other characteristics (especially the ones that try to make themselves look like TLS traffic) rather than having a blocklist of hostnames as Pi-hole does.

Animats• 2 years ago

Ah. Not on content analysis, though.

eckelhesten• 2 years ago

I wonder if this could be used to block ads on TV apps, Youtube app etc.

pmontra• 2 years ago

For YouTube if you use Android you can install NewPipe from F-Droid. Not only there are no ads, you can even bookmark videos and subscribe channels without having an account on YouTube or without being logged in.

elia_is_me• 2 years ago

interesting

m00x• 2 years ago

My kids are about to learn the consequences of hurting my feelings by calling me a buttface on the internet.

out-of-ideas• 2 years ago

are you going to wear a mask of one of the dudes from star trek and set your phaser to stun?

tenlp• 2 years ago

Well...it's very suitable for people outside of mainland China to experience what Chinese people experience online.

est2• 2 years ago

Nah it's an interesting piece of technology of double-edged sword, like any other technology. A firewall can be used to censor information, but can be also used to block ads or malicious traffic.

darkwater• 2 years ago

It's always "malicious traffic". It is just the definition of "malicious" that varies ;)

Havoc• 2 years ago

The traffic classifier sounds interesting

kavalg• 2 years ago

Help you fulfill your dictatorial ambitions

This bullet on their features list made my day LOL :)

nusl• 2 years ago

It is funny but let’s hope someone doesn’t take it seriously or use it in that capacity else they’re gonna have to explain it in court

M95D3• 2 years ago

I'm shocked that nobody is worried that this lowers the barrier to implementation for other dictatorial governements.

JackSlateur• 2 years ago

It does not.

fmbb• 2 years ago

All they need is money. The global IT industry will sell them what they want.

reyqn• 2 years ago

So if they use this they might need less money. Isn't this lowering the barrier?

passwordoops2• 2 years ago

Ask Apple or Microsoft if they have trouble selling to dictatorial governments

M95D3• 2 years ago

I'm confused. Is GFW built by Apple or Microsoft?

seszett• 2 years ago

Apernet is especially active in enabling circumventing the GFW of China, so I'm pretty sure they are aware, and have thought about the consequences of this project. In fact I assume they developed it in order to test their circumvention methods.

luke-stanley3• 2 years ago

Having a model of how something works is really helpful to explore mitigations.

nirui4• 2 years ago

I been seeing people on Twitter mocking the project, but I need it...

You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers.

With this project, it's hopeful that in the future I can just not putting their domains in the TLS whitelist, even when they use DoH.

---

Off topic but BTW: "Fully Encrypted Traffic" is really a confusing term that can only be understood correctly if the context is correct too. How about calling those protocols "High Entropy" (HighE)? Which IMO is more specific than calling it "Fully Encrypted". It's just my two-cents suggestion.

luke-stanley3• 2 years ago

I briefly read a paper, I suspect it's more complex than "high entropy".

nirui4• 2 years ago

The strategy used to detect "Fully Encrypted Traffic" is indeed complex, but the protocols investigated by the paper (at least Shadowsocks, VMess. Not really sure about Obfs4) works by transforming the traffic to make it "look like nothing".

So I still believe "High Entropy" is a better description than "Fully Encrypted Traffic".

I mean, you can pack the entire data stream in Base64 after sending them through a SHA256 pipeline, and it will still be "Fully Encrypted", but the entropy (in terms of traffic classification by content scanning) is not the same compare to doing it without the Base64 step.

kneoghau• 2 years ago

I've had luck finding pi-hole blocklists on github for various products, if it's something quite common like a branded smart TV someone will have already done the hard work of figuring out what IP's they're trying to dial home to.

aacid• 2 years ago

But pihole is dns only, any requests directly to ip address will still pass.

benterix• 2 years ago

You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers.

You mean hardware products, right? In this case putting them in a separate VLAN would help. I you mean software running on your machine, you can set up a proxy and block all traffic not coming through it.

nirui4• 2 years ago

Mainly TV, TV box and phones with non-open-source ROMs etc. These devices do need Internet connection for normal operations, which is why it's so hard to block suspicious traffic from them.

FuriouslyAdrift• 2 years ago

TLS 1.3 with cert pinning and end-to-end encryption is making life hell for corporate compliance. Our Palo Alto firewalls are about as good as it gets but it's a constant battle to de-obfuscate traffic.

Google loves to mix traffic types (ad, telemetry, biz app) across protocols basically creating their own overlay which is a huge pain.

For Apple, we basically have to exempt the entire 17.0.0.0/8 as that is theirs and they pin everything.

Microsoft at least has several dynamic lists but I have my own list of their stuff that ISN'T on their lists (a few hundred IPs).

At this point I don't think there's any way to secure a network. You can't trust or verify much of the traffic.

Maybe using a synthetic NIC at the endpoint that is directly tied to the policy system is the only way forward.

pests• 2 years ago

How about the whole Zero Trust concept where network is assumed hostile and every service is properly authed?

creativeSlumber• 2 years ago

You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers.

I wonder if you can run this in observe only mode to analyze/log that traffic.

inemesitaffia2• 2 years ago

Link? To Twitter?

haunter• 2 years ago

Would be funny if this ends up like War Thunder. Some random chinese official making a pull request out of spite because some implementations are not as how the real GFW is doing it.

est2• 2 years ago

the gfw was not built by some random "chinese officials", it's powered by the IT industry with contractors all the way down. There isn't a monolith wall either. There are multiple generations of TCP/IP middle boxes sold to various levels of ISP over many years.

bayindirh• 2 years ago

Then consider, this one bringing better features of all of them, and some Chinese people send pull requests to refine this even further.

It's not impossible.

whazor• 2 years ago

I am sure this will be used by some government at some point.

s_m_r• 2 years ago

This project is like an open-source missile for regimes like Iran and North Korea. I do admire it, but some governments could abuse it to suppress freedom.

eunos• 2 years ago

Unless your government is technically inept they don't really need this project to have their own GFW and inept government won't be able to maintain it anyway.

Ingaz• 2 years ago

Iran and North Korea don't need open source missiles.

Maybe it's European countries need such projects to be on par with them

bluish29• 2 years ago

The publishing industry will probably now demand using this to block sci-hub and anna archive /s.

ksajadi• 2 years ago

wonderful. now the Iranian regime can stop their payments to China for their use of this tech to block Iranians from accessing open internet. funny how open source can do a full circle to prevent the very thing it set out to open.

bzmrgonz• 2 years ago

I agree, there are some genuine use-cases for such a product. SCHOOLS.. to keep distractions at minimum for instance. I worry about malware tho, anyone can vet the team behind this??

inemesitaffia2• 2 years ago

Any alternatives?

OpenGFW: an open source implementation of China's Great Firewall

Related Stories