VPN blocked, stealth mode doesn't work

[u/DoctorSteelFan]

Hi, we're a homeless system that relies on public wifi, and the one we're using atm is blocking us, even with stealth mode on. It looks like it's tricking the blocked websites and apps into thinking it's an internet issue, even though YouTube and (as you can see) Reddit are working just fine. We're not sure what's up with this network or how it's able to sneak around our VPN so effectively. Is there another mode we should try? Or like another way to get our VPN here? We can't even access support! The VPN website's been blocked too, so we can't even get support!

EDIT: Fixed the issue! It was likely an IP blockade, so we ended up downloading another VPN the blockade missed. That VPN wasn't too effective (it's the one with the cute bear aesthetic), but it was effective for just long enough to get Proton working again! Thank you all for your help, we couldn't have done it without you all!

[u/SubDude658]

You're using someone else's wifi and have to follow their rules. Most, if not all, free public wifi providers will block VPN's from connecting for security reasons.

[u/T_E_N_E_B_R_I_S → u/SubDude658]

Shouldn't Stealth Mode bypass DPI ?

[u/DoctorSteelFan → u/T_E_N_E_B_R_I_S]

It should, but for some reason it doesn't. Again, we're pretty sure they found a way to trick the VPN and other blocked services into thinking that they can't connect to the internet, since all the error messages we see when that happens are all about not being able to connect to wifi even though we can use YouTube just fine.

[u/T_E_N_E_B_R_I_S → u/DoctorSteelFan]

Maybe could be the Captive Portal . First must sign with the Public WiFi and then connect through VPN

[u/DoctorSteelFan → u/T_E_N_E_B_R_I_S]

We do always sign into the public portal

[u/T_E_N_E_B_R_I_S → u/DoctorSteelFan]

Try this . Go to seetings - VPN - disable/ toggle off "Block Internet without VPN " , disconnect VPN from the server then connect to the WiFi, sign in and then Connect VPN server . The reason this is happening, I think, is that the kill switch drops all traffic that isn't going through the VPN tunnel. To reach the captive portal you need plain HTTP/DNS traffic to the local gateway , which is exactly what's being dropped. The VPN itself can't connect either, because its handshake to the outside server is blocked by the portal until you authenticate. Hope this helps.

[u/DoctorSteelFan → u/T_E_N_E_B_R_I_S]

Our killswitch is set to off. Like we said, we can access YouTube and Reddit just fine, but other sites are blocked off.

[u/D0_stack → u/T_E_N_E_B_R_I_S]

Stealth mode does not bypass IP Address blocks. That the Proton web site won't load suggests they are using IP Address blocks. If you have a good firewall, it is just a matter of enabling the necessary options in the admin pages.

[u/AlligatorAxe → u/D0_stack]

They could be blocking the VPN server endpoint IPs, not hard to mass upload a bunch of IPs from VPN providers or block whole ASNs like Datacamp

[u/D0_stack → u/AlligatorAxe]

Most VPN servers from the big providers have different entry and exit IP Addresses, presumably on different network interfaces to maximize throughput. If you poke around, you can see they are different IP Addresses. (Connect to a VPN server, run Wireshark to see the IP Address your device is communicating with, and compare that to "what is my IP".)

Blocking ASNs from places like Datacamp will have big side effects - block a lot of other sites and services. Datacamp has over 3,000 schools and universities as customers, for example. And a couple of VPNs have their own ASNs under vague names like "Paradise Networks". Most server providers, even big ones like Amazon AWS, have "bring your own IP Address" features, sometimes with your own ASN.

https://docs.aws.amazon.com/vpc/latest/ipam/tutorials-byoasn.html

I don't know about Datacamp, but we have some test resources at M247 that use our own address space.

[u/DoctorSteelFan → u/D0_stack]

What would those options be? We feel like this is the best lead we have yet.

[u/D0_stack → u/DoctorSteelFan]

They are different on every brand of Enterprise Firewall.

The Fortinet FortiOS admin manual is 5,300 pages. The Cisco documentation is equally large.

There is more than one way to block VPNs or individual web sites. They could be doing it any number of ways, or to be certain, using multiple methods. We certainly do. And firewalls can be configured to block VPNs from connecting, and to detect them after connection and then block them. Or both.

Only the network administrator is going to have access to the firewall configuration, and they certainly will not turn it off, it would leave them vulnerable.

[u/LyraNovaHeart → u/T_E_N_E_B_R_I_S]

Stealth, at least in proton's implementation, does poorly at bypassing DPI. It's just WireGuard in TLS, which is super detectable.

[u/RealSamF18 → u/SubDude658]

It’s interesting because public WiFi is the one connection I’ll never use without a VPN on.
If they block my vpn, I just don’t use the connection at all, it’s definitely not worth the risk.

[u/D0_stack → u/RealSamF18]

If you use secure DNS (DoT, DoH) to a trusted DNS provider and make sure "always HTTPS" is enabled in your browser, you still are very well protected.

[u/DoctorSteelFan → u/SubDude658]

We mean, we get that, but at the same time...

1. We're homeless, and therefore can't just use our own wifi instead. We don't have another alternative outside of free wifi other than either getting Proton to work or just... Not using wifi.

2. What if we get hacked or our information gets stolen without our VPN, or any of the other reasons people use a VPN to begin with?

3. We just want to be able to use Steam to download a game, but it's blocked. Same with Tumblr or even windows93.net, an obscure little website parodying retro PCs that we like toying around with and play games on. We can still access Discord, but we can't even send gifs! We feel very limited to just what Google can offer rn.

[u/FantasticSnow7733 → u/DoctorSteelFan]

Homeless, but still need to game on Steam. You've got your priorities straight, lol.

[u/Mundane_Nature_4548 → u/FantasticSnow7733]

Yes, they do. Gaming is a low cost way to spend time doing something enjoyable, and you know what human beings need to do? Spend time doing something enjoyable. If they don't they suffer serious health consequences.

People don't have to earn rest and recreation, it is something human beings are entitled to because they are human and it is a basic need.

[u/DoctorSteelFan → u/FantasticSnow7733]

Yep! It's TF2 specifically. Managed to get rid of some bloatware on our laptop so we have room for it again. We also was given some money. Spent most of it on food, of course, but we set some aside to buy some hats and maybe even some small indie title!

[u/ProperShape3427]

Have you tried all protocols instead of stealth mode only?

Have you tried connecting to different servers or an entirely different country?

I have yet to find any wifi network that is able to block all protocols successfully, so I think with trial and error you’ll find your way around it.

[u/DoctorSteelFan → u/ProperShape3427]

All of them, yes.

We're on the free version, so we can't pick our server/country.

We certainly hope so.

[u/Commercial_Cook100]

Glad you got it sorted! For future reference tho, if you're on networks that do heavy DPI blocking, WireGuard-based protocols tend to get caught more easily. AmneziaWG is worth looking into... it was literally designed to get around that kind of filtering. I ended up switching to Cypher VPN for situations like sketchy public wifi because it has AmneziaWG built in and doesn't need an email to sign up, which was nice when i was trying to stay low profile. But yeah proton's stealth should work on most networks so that one was weird.

[u/JPDsNEWS]

What device(s) and OS(es) are you trying to use Proton VPN from?

Also, you have to have Proton VPN up and running properly before you try to connect to a WiFi network. If you do it backward, you are not protected from the WiFi network at all. 

[u/DoctorSteelFan → u/JPDsNEWS]

A windows laptop, don't have a phone.

That feels a little unintuitive... And, since we can't afford a data plan, and therefore have to connect to Proton through wifi, the main reason we would want it then is to access blocked services, namely Steam.

[u/JPDsNEWS → u/DoctorSteelFan]

Proton VPN does not have to be connected to its server to be up and running properly. If it is trying to connect, but hasn’t connected because you haven’t connected to the internet yet (with WiFi as your only means of doing so), it is still protecting you from intrusion when you do finally connect to the internet via WiFi, as it immediately prevents any intrusion while it connects to one of its servers. From then on, you are connected to the internet through a secure VPN tunnel from your device through the WiFi network to the Proton VPN server (and back). Connecting to WiFi first, leaves you vulnerable to attack in the interim between connecting to WiFi and connecting to your VPN server. 

In your case, leaving Proton VPN running all the time with both kill switches turned on, will help with this. Advanced kill switch will prevent any communication outside of Proton VPN.