OpenVPN counters censorship
Open Source Software Helps Surmount China's "Great Firewall" Instrument Of Censorship
ByJournalists at the 2008 Olympic Games in Beijing will not have unfettered access to the Internet. However, GPL software OpenVPN can be used to easily circumvent such censorship.
IOC President, Jacques Rogge, was recently forced to back-pedal under a barrage of criticism when it became clear that assurances that the press corps would have "unrestricted" Internet access were no more than piecrust promises. Nevertheless, the technology behind the "Golden Shield Project", which is apparently a means of protecting the Chinese from criminal content and has earned the nickname "Great Firewall of China", is relatively simple. Journalists in the Olympic village, as well as western corporations and even private individuals have a range of tools at their disposal to ensure their Internet access is both full and unmonitored. However, most of these are based on anonymizing services, such as gateways, proxies or web services, that massage the content and smuggle it in under the censor's nose. In the past, the Chinese authorities have regularly blocked web sites that offer such services. Furthermore, mass anonymizer services such as gateways have a bad reputation, since they also provide a safe haven for users wishing to conduct other, potentially illegal or criminal dealings. Courts in Europe have already revealed the darker side of these services.
There is, though, a solution that is available for those running Windows, Linux and Mac systems, which can be implemented in many different ways and which Chinese authorities have a real problem in counteracting - OpenVPN. Since this free (as in beer and as in speech) GPL software uses technologies that are vitally important for many Chinese companies, simply closing down this solution is not really an option to the Chinese government. Users can work on their own servers, without needing to tell any other users about them, in complete security.
At the same time, OpenVPN helps users to surf the web, send and receive e-mail, and use all the usual web services at all times, quickly and with full access to the Internet, away from the eyes of the snoops. Since this is all done under the protection of secure, military-grade encryption, unwanted eavesdroppers such as the Chinese state apparatus, security services, hackers or restrictive local network administrators must stand aside, relatively powerless. Most of the time, they won't even know there is an OpenVPN tunnel on their network.
According to the opinions of many experts, encrypted HTTPS connections are not affected by the censors. Research into the "Golden Shield" (see box) advises, therefore, that HTTPS can provide free, unrestricted access to the Internet.
OpenVPN - a solution
Normally, Virtual Private Networks (VPNs) provide field workers and telecommuters with secure access to corporate networks, or use the Internet to connect several branches of the same company. Computers that connect to the VPN then form part of a single, virtual network, on which staff can work as though they were sitting in an office at the company's headquarters. The classic examples of VPN are the many variants of IPSEC, or the PPTP protocol which is often used by Microsoft. However, since these solutions are either unsecure (PPTP) or complex (IPSEC) they do not always live up to expectations. James Yonan, the man behind OpenVPN, experienced this at first hand as he traveled around the countries of the former Soviet Union at the time of the millennium, trying to keep in touch with his employers as he went.
Out of necessity, he initiated Openvp, a software solution that had to be both flexible and simple, yet meet the ultimate demands in terms of security. The project gained momentum rapidly, and now Openvp is the coolest VPN solution there is - and represents the third generation of VPN system. Thanks to the numerous encryption methods that it supports, and the comprehensive program options, users can enjoy fast, secure connections with military-grade encryption almost anywhere.
Since the tool uses the same common mechanisms as are used by HTTPS connections, access to private networks is available from any location at which clients have unrestricted access to URLs that start with the https:// prefix. The broad use of the SSL/TLS libraries in many different fields ensures that programming errors, exploits and bugs are found and fixed immediately by those operating the numerous electronic banking and e-commerce portals that also use the technology.
OpenVPN - as easy as 1-2-3
The way OpenVPN works is extremely simple: The software creates its own virtual network interface on the client system, and establishes an encrypted connection to the server. Any network packets that are sent through the virtual interface (which uses standardized TUN/TAP devices) are sent by the software in encrypted form to the OpenVPN server. If the "redirect-gateway" option is set, then the client routes all traffic via this tunnel, rather than just the packets that are intended for the local network.
A local firewall on the client device (such as a notebook) and a central, corporate firewall on the server provide almost perfect protection for remote employees. Full Internet access can be granted and encrypted through the VPN tunnel. Malicious eavesdroppers in the local network and at all points in between will merely see encrypted packets, while the firewalls prevent undesired connections. In ideal situations, the central firewall will also allow the remote notebook to access the Internet through the tunnel, at best using the technique of IP masquerading.
OpenVPN has also proven itself to be very flexible, especially in comparison with other VPN solutions. It requires just one port and one protocol (either UDP or TCP) to establish a connection - both are freely definable. Users that find themselves on networks on which connections are severely restricted should use port 21 (FTP) or 443 (HTTPS), for example. Whether administrators want to use UDP or TCP is of lesser importance. UDP provides significantly greater performance, but also supports fewer options than TCP.
When it comes to the most demanding requirements, OpenVPN can even offer a simple cluster solution. The client configuration then contains several servers that the software addresses in turn. Any IP address blacklists imposed by suspicious network operators can then be circumvented easily, but if even that is not enough, how about port sharing? Since version 2.1, OpenVPN has supported the option of sharing a port with other software, for example an Apache web server. Users or attackers that access the port with non-OpenVPN packets simply see the web server, while authenticated users end up in the VPN. Anyone snooping on this traffic could only begin to guess what web sites are being visited on the basis of the quantity of data being sent and the traffic profile.
Minimum requirements
In order for this solution to work, the client software requires direct access to the port of a specific server (for example, port 443). In China's case, this is obviously permitted, so that any sports journalist who can access his newspaper's content management system (CMS) via HTTPS from Beijing can also obtain full and uncensored Internet access through an OpenVPN tunnel.
Since OpenVPN uses the standardized TUN/TAP devices, both the VPN server and clients work on Linux, Windows and also Mac systems. Connections are stable, very tolerant of errors and thanks to adaptive compression and freely definable encryption key lengths, both fast and secure. The author has used the software on his laptop for almost five years to surf secretly, without problems and independent of the bandwidth available, using connections as diverse as GPRS, UMTS, Wireless LAN, dial-up or Ethernet.
Occasionally it is necessary to provide OpenVPN with the IP address of a proxy server, for example using the "http-proxy" option in the configuration file. The software is then able to disguise itself, and appear to the proxy as a Mozilla or Internet Explorer web browser of whatever generation you choose. Authenticating proxies that use NTLM, for example, are also supported. As long as the proxy permits direct connection to HTTPS pages, as is required by the operators of secure banking portals, online shops or intranets, then the OpenVPN connection can be established and uncensored surfing is possible.
Available everywhere
An impressive number of GUI tools is available for OpenVPN. The software comes in Windows, Mac and Linux versions, and it has been a standard part of the major Linux distributions for years. Users of Debian, Ubuntu, Red Hat and openSUSE can install the software comfortably using their distribution's package management systems, while more and more appliances are also integrating OpenVPN. Over the course of its development, the VPN software has won over many fans, thanks to its comprehensive functionality and high degree of flexibility. Ease of configuration and great performance and security mean it is a practical tool that can solve a wide range of networking problems with ease. With OpenVPN even able to speed up typical setups considerably, the software is also very popular among those who like to play games online. Perhaps they will soon be joined by the journalists in their fervor for the solution.
See article on configuring openVPN here.
next page » 1 2
Comments
comments powered by DisqusSubscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Red Hat Enterprise Linux 9.5 Released
Notify your friends, loved ones, and colleagues that the latest version of RHEL is available with plenty of enhancements.
-
Linux Sees Massive Performance Increase from a Single Line of Code
With one line of code, Intel was able to increase the performance of the Linux kernel by 4,000 percent.
-
Fedora KDE Approved as an Official Spin
If you prefer the Plasma desktop environment and the Fedora distribution, you're in luck because there's now an official spin that is listed on the same level as the Fedora Workstation edition.
-
New Steam Client Ups the Ante for Linux
The latest release from Steam has some pretty cool tricks up its sleeve.
-
Gnome OS Transitioning Toward a General-Purpose Distro
If you're looking for the perfectly vanilla take on the Gnome desktop, Gnome OS might be for you.
-
Fedora 41 Released with New Features
If you're a Fedora fan or just looking for a Linux distribution to help you migrate from Windows, Fedora 41 might be just the ticket.
-
AlmaLinux OS Kitten 10 Gives Power Users a Sneak Preview
If you're looking to kick the tires of AlmaLinux's upstream version, the developers have a purrfect solution.
-
Gnome 47.1 Released with a Few Fixes
The latest release of the Gnome desktop is all about fixing a few nagging issues and not about bringing new features into the mix.
-
System76 Unveils an Ampere-Powered Thelio Desktop
If you're looking for a new desktop system for developing autonomous driving and software-defined vehicle solutions. System76 has you covered.
-
VirtualBox 7.1.4 Includes Initial Support for Linux kernel 6.12
The latest version of VirtualBox has arrived and it not only adds initial support for kernel 6.12 but another feature that will make using the virtual machine tool much easier.
Internet designed to defeat censorship
Fast forward to now. The Internet uses the same basic message packet design features. When censorship is attempted the network is looks for a different way to deliver the messages. This alternative routing has become a part of the culture surrounding the Internet. Not only is the network looking for alternative routes but people are now behaving like the network. They immediately look for ways to use available network resources and software to achieve the free flow of blocked messages.
Free and Open Source Software(FOSS) plays an important role by providing software that can be molded to new and unanticipated uses. FOSS provides the tools, in this case OpenVPN, to get the messages through the blockages.
Been there, done that
He connected to a UK server with OpenVPN and could use Skype fine over the tunnel.
Cryptography is the saviour of Internet privacy.