Can you set your NAT to port forward a port to your ssh host?

I’m currently using yggdrasil to deal with this problem, though I’ve also used tor hidden services.

deleted by creator

I haven’t tried it myself but I’ve been looking at NetBird.

Elevator pitch page

Maybe others who’ve used it or know more can chime in on if this is a good idea or not?

Sing-box is a VPN tool built to evade censorship https://github.com/SagerNet/sing-box . It is extremely resilient and stealthy.

See also, xray and v2ray, which are similar, but in my experience sing-box is a bit better documented (at least in English) and has better maintained client apps.

Setting any of these up can be complicated, but LLMs can get you pretty far if you have safe access.

deleted by creator

Tor Hidden Services, easy to set up on the server side, can be annoying on the client side but HTTP and SSH are fine. Can be a bit slow but IMHO still usable.

Could use SSH tunnel to an entry point

Wireguard is blocked in my country

RIP

Best solution is to organize revolution to kick out the fascist that censored the internet by protocol

AmneziaWG is a Wireguard fork built against deep packet inspection, try that.

https://github.com/erebe/wstunnel seems like the obvious solution.

Or maybe OpenVPN over normal TLS on port 443.

You could try to run Wireguard on a different port which would be otherwise used by some very common service, maybe there’s some general exemption for port 21, 22, 53, 80, 443…

OpenVPN in TCP mode wrapped around Stunnel. That’s the thing that works.

I have it set up to bypass VPN restrictions in some networks, but it also serves to bypass a lot more stuff if you know what you’re doing.

DPI will only see TLS traffic, and assume it’s HTTP. You can even try to fool it by modifying the packet headers, so dumb enough DPI will think you’re connecting to the site you choose.

Self hosted networking! Legitimately one of my favourite topics

You won’t get around the requirement of a publicly reachable endpoint. That can either be a small server with a public ip or dynamic DNS to your home with port forwarding for the VPN.

A classic option is OpenVPN. You can run it on Port 443 in TCP mode and while it won’t be performant, it has a better chance of bypassing most simple blocks

Other than that I’m a fan of completely decentralized mesh VPNs.

The one I use and am most familiar with is Yggdrasil. Connections can be established over TCP, TLS or QUIC on any port you want.
I’ve written a somewhat lengthy comment under this post. One advantage to Yggdrasil would be its existing public network. If you can firewall of your home lab to the point where joining the public network doesn’t expose a security risk to your local network, you could use that to transport your traffic instead of having your own public node or port forwarding.

The same post also mentions Anywherelan, it’s intended to have better NAT handling out of the box by using community nodes.

Then there’s also EasyTier mentioned at the bottom, it is a Chinese project and those tend to have good censorship resistance.

Finally I’ll mention Nebula, it requires at least one coordination server but might also be an option

First, you need to verify whether you actually have a public IP or if your ISP has you stuck behind CG-NAT, because that dictates your options.

​If you’re behind CG-NAT, ​Cloudflare Tunnel (cloudflared): This is usually the easiest path if you are mostly trying to access web-based services (HTTP/HTTPS) on your server. Your home server initiates the outbound connection to Cloudflare, so CG-NAT doesn’t matter. You just set up a domain (or subdomains) for each service you want to reach. If you need full network-level or SSH access rather than just web apps, check out ZeroTier.

​If you have a direct public IP (even a dynamic one), you can run a reverse proxy like Caddy paired with a free DDNS provider like DuckDNS or FreeDNS. One nice thing about Caddy is that it handles getting and renewing real, valid Let’s Encrypt SSL certificates automatically, so you don’t have to deal with manual or self-signed certs at all.

​Dealing with the WireGuard block, if your country’s ISP is using Deep Packet Inspection (DPI) to identify and drop WireGuard traffic, traditional VPNs like OpenVPN might get blocked pretty quickly too. If you still want a true VPN setup, look into AmneziaWG (it’s a fork of WireGuard specifically modified to scramble packet signatures and bypass DPI) or obfuscated proxy protocols like V2Ray / Xray or Shadowsocks.

So this has been interesting to me as I’m travelling at the moment and wireguard has been blocked on the guest wifi I’ve been on across the hotels, I’ve had to rely on cellular instead.

I’ve just tried Teleport on my Unifi router and that works. I believe it uses wireguard, and it is taking up to 20secs to connect, but I’m now curious as to what it’s doing to bypass the VPN restrictions that are blocking plain wireguard.