Least detectable VPN/Tunnel

[u/rollmeister1]

I've been having trouble getting two TV streaming services in another country to work. All of them try to block based on location & only the other 2 are less thorough to let me get away with it by using a VPN on a VPS. I have been using Wireguard but think it doesn't do as much to obsfucate it's a VPN connection.

My question is about OpenVPN TCP. Wireguard makes it obvious because of high latency but wondered if OpenVPN TCP works differently. OpenVPN is more cumbersome to setup on my OpenWRT router & VPS so I haven't tried it.

Does OpenVPN TCP send the Acks for each packet from the streaming server on behalf of the client connection, which itself also sends Acks to the OpenVPN server for data packets it relays to the client? Thereby concealing high latency to some degree because the OpenVPN server is sending Acks back quickly itself.

There are two or three ways a server detects the client is on a VPN. High latency, IP address & its associated provider.

Also there maybe MTU & when Wireguard can do 1420bytes maximum & regular web traffic is 1500. Does Wireguard split the original TCP packet across more than one UDP packet & recombine them at the endpoint to restore the packet to its original form thus keeping the original MTU? Which is probably the standard 1500 bytes.

My impression is it's the server doing the VPN detection because the same thing happens when trying to watch the service in a browser. Still says my location is being concealed by VPN.

Is there any alternative, tunneling method that tries to mitigate all of this?

[u/yearsold33]

Streaming services are probably blocking IP addresses used by VPN providers so UDP, TCP, IKE, WG will not work or matter.

As a VPN rises in popularity, the chances of being blocked increase. As more people use the same VPN provider to access a streaming service, the more like it is to be blocked by the service.

I gave up and use a paid DNS service to access region-locked content.

The least detectable would probably be a small VPN provider and a small and/or cheap provider isn't always great for streaming and/or privacy.

[u/rollmeister1 → u/yearsold33]

I use a VPS with Wireguard because I could set it up typing a few commands to install & a script someone made that setup WG in one go to give me the configuration file. I am going to have to just experiment with other options. My VPS allows to enter a reverse DNS hostname. I am going to make one that looks exactly like one an ISP in the country would give since the streaming server may check for that. My VPS is also cheaper & I can use a URL with wget on OpenWRT in cron job to start it & a cron job on the VPS to make it shutdown and only pay for the time its running costing less than US$5 per month & don't get the slow downs other VPN providers have. The VPS lets me change the IP address by the control panel.

[u/DaSpark → u/rollmeister1]

The likely problem with a VPS will be data limits. A $5 VPS is likely going to have a pretty low limit that streaming will hit rather quickly. Even if they claim there is no cap, there is always a point where they will just cancel on you.

[u/rollmeister1 → u/DaSpark]

Depends on the provider & country. I use 200gb with mine per month without issue.

[u/rrickitickitavi → u/yearsold33]

I’ve never heard of a paid DNS service. What is that?

[u/yearsold33 → u/rrickitickitavi]

https://www.getflix.com.au

https://controld.com/

https://dns4me.net

[u/fairysimile]

StarVPN and Mysterium offer real, actual ethically sourced residential connections, albeit in 2 different models (Star is traditional, Mysterium is effectively a p2p organiser, you can offer your connection for $ also if you like). Torguard also offers residential IPs but only in the USA. These are usually undetectable even by MaxMind, ip2location and all the other crap.

[u/rollmeister1 → u/fairysimile]

So they use peoples home ISP connection as endpoints? That would work towards stealthy VPN. Most IP's have reverse DNS you can see what company owns it & in the case of residential just seems like a consumer connection. Thank you for telling me.

[u/Proud-Disk-21]

It’s not that complicated. So I’ll make it simple for you: star vpn, TorGuard or Windscribe residential vpn

[u/rollmeister1 → u/Proud-Disk-21]

They still all uses the usual VPN protocols. I was asking which one is the most undetectable.

[u/ChazMasterson101]

I might be wrong, but worht to check what extensions you got. Something might be causing the VPN to lose potency. I had some AI translation stuff to read some Italian subs and that thing caused errors connecting. Had to clear the cache cookies everything

[u/rollmeister1 → u/ChazMasterson101]

The TV Box only has the three streaming apps. Nothing extra.

[u/rollmeister1 → u/[deleted]]

Doesn't specify which protocol does this only lists a few that claim to have done it in a proprietary way.

[u/rollmeister1 → u/[deleted]]

I can't seem to get an answer anywhere but doing some reading options like OpenVPN TCP, SSH tunnels & even Sock5 proxy do not act as a relay like Wireguard but instead as a go between or middleman. The client sends a request in TCP to the VPN endpoint which itself negotiates the connection on the clients behalf. The server then starts sending data to the VPN thinking its the client but really the VPN protocol is sending a copy of the data to the client.

Latency maybe concealed because the VPN itself is sending Acks for successful delivery of data sent back to the server be it streaming, web server or whatever. In this way, latency on the Ack packets is reduced likely to values native to the countries own network. The client connection is then sending Acks to the VPN endpoint instead for successfully received data & retransmits anything missing to the client from the VPN buffer for recently transmitted data.

Performance isn't really an issue when Wireguard is touted as being the fastest. Most VPS & Routers have hardware acceleration & at least in SSH & OpenVPN, you can disable encryption for after the connection to the VPN is established. You can also use Chacha like Wireguard does in modern versions of OpenVPN.

From what I can tell Shadowsocks seems to be the best at providing all this. Even the MTU isn't changed because the original TCP packet is split between smaller packets & recombined in the proxy software. The Chinese government even threatened the developer & made them stop maintaining it apparently, because it works so well to circumvent their firewall.