How to hide ip: Simplified View of Internet Censorship – Part I

Simplified View of Internet Censorship – Part I

Posted: 18 Aug 2011 04:08 AM PDT

Last March, the buzz around the internet was that China is blocking access to some external sites, but since some clever users have figured out to using a VPN to overcome the issue, the Chinese government also begun to block some VPN implementations (PPTP and L2TP based VPN). Let’s take a simple look at how this kind of censorship can be established.

This actually is a simple explanation geared toward those who want a better understanding of how things work. So let’s say you are based in China. You know that whatever device you are plugging to the internet has a unique IP address attached to it. Every communication you make on the internet is “tagged” with this IP address. On the other side, any server or peer you are talking to on the internet also has an IP address. Just think of it as your postal address so that the factor knows which route to send your letter through.

The first censorship can be done on your computer. Let’s say for example that you are working within an organization that has some policies with regard to using the internet (you are probably facing it: major sites like facebook and youtube are not allowed to be browsed from your company’s network). In fact, some companies set some specific proxy configuration on your browser and do not allow you to change it. In fact, the IT administrator is forcing you to go through a proxy server by setting it on your browser. If you are falling into that specific scenario, you can be sure that the IT administrator has setup other ways to blocking you from accessing those websites. In fact, you usually are not allowed to change any settings on your browser. The only solution that comes to my mind for overcoming those kind of censorship is to use some web-based proxy servers. Although it’s not really convenient (most web proxy serve you a lot of ads), at least you can end up accessing some blocked websites.

Why does this solution work most of the times? It works since more often than not, when blocking websites, IT administrators limit it on a per-destination basis: which means that they centrally maintain a list of websites that their users are not allowed to browse instead of a deny-all and only authorize approved website policy. This actually means that there is a very high probability that the web proxy that you’ll be using won’t be included into the list of website that you are not allowed to browse.

On the part 1 of this serie about “simplified view of internet censorship”, we discussed about how this censorship can be performed on your corporate computer. Now let’s go a bit higher on the connection path and discuss about what can be done on the corporate firewall or proxy side of things.

Most of the times, corporates have one or two internet connections: this connection being a limited ressource, IT administrators tend to limit its usage. The censorship at this stage can take the form of bandwidth limitation (which is still fine since you can still browse most websites although it can be slow), or denial of access to some websites. This is usually done at the firewall side of the company’s router. Simply side, the filtering is done at the router that is acting as a gateway to the internet.

The filtering can be implementing via different solutions:

- either by checking against regular expressions (or regex) the URL of the destination website the user is trying to see. It is then common that IT administrators limit any file download that has the .mp3 extension (or .torrent, .mp4, …)

- or filtering by protocols and ports: this is what is actuallydone when the IT administrator denies applications like peer-to-peer since those applications actually need to initiate a communication via a specified port. This can be done at the corporate side or at the ISP side

- or by using some publicly maintained database of “blacklisted sites”. Most proxy servers nowadays can use those public database of blacklisted sites

- or by limiting by the originating IP address: as I told earlier, IT administrator has a clear map of IP address-computer database, because of that, they can say that for your particular IP address, some websites are not allowed to be reached. The only solution for you, for such case, is to use another computer that has eventually less restriction …

Those are simple explanations on what can be done at the corporate or ISP side when it comes to “censorship”, on the next article, we will address it on the country-level.

This is only the part one of this serie, on part two, we’ll be discussing about how censorship can be done at the country level. Stay tuned.

Post from: How to hide ip

Simplified View of Internet Censorship – Part I