A VPN that survives DPI
A private access contour for the family: it works where the ISP only lets a whitelist through.
- Relatives connect through a bot — no conversations about configs and QR codes
- 'Why isn't it working' is answered by a diagnostic agent, not by reading logs by hand
- Keys are issued and revoked from chat, with connection stats in the same place
The problem
A home ISP filtering to a whitelist killed not just access but the public address of the control panel itself. An ordinary VPN didn't help: the channel you'd use to fix things went down with the traffic it carried.
How it works
sing-box with several connection profiles — masquerading as ordinary TLS traffic as the primary path, fallbacks alongside it, plus a separate protocol for the messenger. The configuration is generated from sources rather than hand-edited; otherwise parts of it inevitably drift apart. Administrative access moved onto a private overlay network, where the filtering has nothing to inspect.
The hard part
Choosing the cover site for masquerading turned out to be pure empiricism: theory predicts it badly and measurements settled it. The winner was whatever blends into that region's ordinary traffic. The other half of the work wasn't networking but people: the interface has to be good enough that a relative connects without asking a single question.
Evidence
- A separate family contour with its own bot and its own limits
- The diagnostic agent is deployed and answers commands directly in chat
- A harness routinely checks the whole channel end to end rather than individual services