Re: HOWTO bypass China's Great Firewall

On Fri, 30 Jun 2006 18:11:38 +0800
"Simon Cousins" <[email protected]> wrote:

> Instead, these subsiduary machines generate a series of TCP reset
> packets, which are sent to each end of the connection. When the resets
> arrive, the end-points assume they are genuine requests from the other end
> to close the connection — and obey.

This is great, but it only explains how the firewall works.  There is no realistic way around it mentioned in the article.  It says to bypass RST packets, but this needs to be done at both ends (Client/Server). 

This can easily be tested. 

Test 1: Goto Google.com and search for 'falun'
Result: You will get "connection reset" 

Now setup a firewall rule to "ignore reset"
$ sudo iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,FIN,RST RST -j DROP

Test 2: Goto Google.com and search for 'falun' (Maybe just reload the last query)
Result: You now get a connection timeout. google servers have reset their connections. They are not ignoring the RST packets. 

Soo... We go back to where we were before.  The best way to get around the china firewall is the oh so simple: "Secure Proxy"
-- 
                        Stafford M. Horne
Senior Engineer                                 高级工程师
SurfControl plc                                 美讯智科技
Peoples Republic of China, Beijing              中华人民共和国， 北京
Mobile: +86 13611014044                         手机：＋86 13611014044

        (Website) http://shorne.homelinux.com/wordpress (网站)

_______________________________________________
blug-general list
[email protected]
http://list.beijinglug.org/cgi-bin/mailman/listinfo/blug-general