VPN providers were cracked down, open source anti-censorship tools were eliminated. This is what’s happening in China and has become even more severe than ever. Shadowsocks alone is no longer reliable due to more powerful deep packet inspection implemented at the GFW.
I am now replacing shadowsocks on my gateway with obfuscated SSH tunnel, based on Tor‘s obfsproxy. To the impatient ones, I will first give a concise summary of the necessary steps of my set up. You can follow it without drilling down the details. I will explain in more details later. But please note that you have to follow the other instructions in this blog post to complete the whole set up.
Quick Set up
On your server
Assume your server runs Debian 8 (jessie) or Ubuntu, and its IP is 220.127.116.11, run these commands:
802.11n can double the channel bandwidth of 802.11g from 20 MHz to 40 MHz, but this operation mode is not recommended in areas that the spectrums are congested and likely interfere with existing WIFI and bluetooth devices. As a result, hostapd will not enable 40 MHz when it finds other channels are being used, like what is seen from the hostapd log below:
However, this is unrealistic in modern cities. You should be grateful the primary channel you choose has not been used already, let alone the additional one for 40 MHz. What can we do? We have to force hostapd to turn on 40 MHz anyway. But since hostapd does not have any configuration options for that, we have to recompile hostapd from source. Actually, this has been done in other distros. For example, OpenWRT and Arch has patched their hostapd with the noscan patch, which adds an option to force 40MHz mode regardless of the environment.
Before turning on 40 MHz, the iwconfig on my laptop is like this, notice the bit rate is only 54 Mb/s:
Now let us start. First you need to add a deb-src source to apt so that we can download source packages. Note that I am still using Raspbian Wheezy. If you use Jessie, change the deb-src line according to your original deb line.
pi@raspberrypi$echo"deb-src http://mirrordirector.raspbian.org/raspbian/ wheezy main contrib non-free rpi"\
pi@raspberrypi$apt-getsource hostapd# download source of hostapd
pi@raspberrypi$apt-getbuild-dep hostapd# download all build dependencies
Assume you already have a Raspberry Pi configured as a WIFI router like mine shown below, but you live in China and have to deal with the fact that many websites can’t be accessed due to GFW. Don’t be despair and with some hacking you can get your Internet freedom back.
The mechanism is to use shadowsocks on your router which directs any traffic to a shadowsocks server in the free world. It’s simple to get it up and running on a local machine, but on a router you need to use redsocks to redirect traffic to the shadowsocks client running on your Raspberry Pi. DNS traffic has to be routed by redsocks as well otherwise your DNS replies will be contaminated. To remain as fast as normal when accessing China websites you also need to skip routing traffic to Redsocks for anything within the China IP ranges. Even if you don’t care about performance, this is still necessary in some circumstances like geoip restriction such as tv.sohu.com does not deliver contents if you live outside of China.
Finally, we want to improve the performance even further by using ChinaDNS. To avoid DNS poisoning, we can always resolve DNS over our secured shadowsocks connection, but this is not optimal if a China website have CDNs outside China. ChinaDNS queries local DNS servers to resolve Chinese domains and queries foreign DNS servers to resolve foreign domains, and from my testing it is useful to avoid DNS poisoning with the “DNS compression pointer mutation” option. (Update:I have switched from ChinaDNS to dnsmasq+dnscrypt, please read Securing DNS Traffic in China to see how it works.)
I assume that you have shadowsocks server running on a public server, so I will skip that part and only talk about the client side.
Installing shadowsocks is very simple, note that it will be installed under
pi@raspberrypi$sudo apt-getinstall python-pip
pi@raspberrypi$sudo pip install shadowsocks
Running setup.pyegg_info forpackageshadowsocks
Installing collected packages:shadowsocks
Running setup.pyinstall forshadowsocks
Installing sslocal script to/usr/local/bin
Installing ssserver script to/usr/local/bin
Successfully installed shadowsocks
Start up shadowsocks while listening on local port 1080:
pi@raspberrypi$sslocal-s<shadowsocks server IP>-p<shadowsocks server port>-k<password>-b127.0.0.1-l1080
Install redsocks, simply apt-get from the archive:
pi@raspberrypi$sudo apt-get install redsocks
Then you need to change the START option in
/etc/default/redsocks from NO to YES, so that redsocks will start automatically at boot time and also can be started by
/etc/redsocks.conf. Most of the default settings work fine, just need to change
local_ip in the
redsocks section to your address of the network interface that accepts traffic from your local network. The default is 127.0.0.1, but that does not work well if you want to re-route traffic from other machines on your network, so change it to something like:
*use0.0.0.0ifyou want tolisten on every interface.
*`local_*'are used asport toredirect to.
But we want traffic from other hosts in your network to be redirected by redsocks to your local shadowsocks client, which in turn sent to the the remote shadowsocks server. We need to pay special attention to DNS traffic, as DNS poisoning is prevalent in China. We need to take special care to redirect DNS traffic through redsocks/shadowsocks.
We also want all China traffic NOT to go through shadowsocks for performance. This can be easily done by looking at the destination IP, if it is in the China IP range we skip going through the REDSOCKS china. First we need to get all network segments allocated to China and save it to a file called
iptables-tnat-L-n to make sure the rules have been added correctly. Now start up redsocks by
sudo/etc/init.d/redsocks start and let’s test it out by doing some web browsing on another computer in your local network. If that works fine, congratulations and you have set up everything correctly! If not, look at shadowsocks output and also turn on redsock’s
log_debug and check if there is anything useful in
ChinaDNS is not absolutely necessary, but as explained at the beginning it is desirable. There is no pre-built package so we need to compile it. It is simple to do:
After more than 10 years I traveled to Japan again. This time I went with my wife to Kyoto, Nara and Osaka. Here are some tips about travelling to these areas I want to share and also serve as notes to myself if I will ever go there again in future, which I will definitely do as Kansai is so beautiful and relaxing.
Getting mobile internet connection was not easy in the past since you need Japan residency to get a SIM from telco, but nowadays the market is more open and there are now many options. In this travel, I used a SIM card called Fuji card (富士卡), which I bought from Taobao at 76 CNY (about 1450 JPY or 12 USD). This card has 1.8GB 3G data, valid for 7 days, but does not have any voice call and cannot be recharged after you have used it up. This card is backed by China Unicom and Softbank, in my experience the data connection and coverage is very good. If you live in Hong Kong, you can find this card in Sham Shui Po as well.
If this card does not suit your purpose, you can find other alternatives:
Fuji card has a cheaper sibling which has 1GB data only, sold at 66 CNY, and a more expensive sibling which has double the data to 3.2GB, sold at 155 CNY.
Before the existence of Fuji card, there was Sakura card (櫻花卡). Sakura card still exists and offers 3GB of data with 7-day validity. From what I read it is slower than Fuji card’s 7.2Mbps and lesser coverage.
There is also a nameless SIM which offers unlimited data. The first 100MB data each day uses 3G speed but afterwards it falls back to 2G speed. It is cheaper but I bet no one want to suffer from slow speed especially during traveling.
If your phone does not support WCDMA or you are not good at fiddling mobile phone settings, you can rent a WIFI router. More expensive, and you have to return it after the trip which I find inconvenient.
So-net also sells pre-paid SIM cards at the airport, at a higher price than the Fuji card.
Valentine’s day is not a good day to travel to Japan not (just) because restaurants are fully booked but room rates could be more expensive than normal days 2 to 3 times, even for budget hotels like Toyoko Inn. I was very lucky that I found a really nice ryokan called Kitanoya (北野家) where the rates remained the same on the special day. Only available at Jalan, so knowing some basic Japanese is a pre-requisite. In general, check Jalan and Airbnb and you might find hidden gems.
Hotel near Kansai Airport
My flight landed almost at midnight so I chose to stay in a hotel close to the airport and began our journey the next day. There are not many options, the hotel at the airport is too expensive so I chose to stay at First Hotel. It is located in Izumisano (泉佐野) and very close to the Izumisano railway station, so you can take a train there, or if it is too late like my case, you can take the late night airport bus, the last stop is exactly the Izumisano railyway station.
The bus station is just outside the exit of the departure hall. After exiting the airport, turn right, look for the stand numbered ’12’. No need to buy ticket beforehand, pay when you take off, so better make sure you have 1000 yen notes or coins, which I did not have. Luckily the bus driver was able to find a lady who had ten 1000 yen notes to change for my 10000 yen note, otherwise I don’t know what would end up.
In my journey I made a mistake of buying the one-way instead of the round-trip, thinking that I would take the Nankai railway back as many people suggest. Later I found out my hotel actually is closer to Tennoji (天王寺) where there is JR station, so at the end I took the JR Hanwa line rapid train to the airport, that costs 1060 JPY, and in total it is more expensive than the round-trip “ICOCA and Haruka” ticket set. So check the location of your hotel carefully, Google Maps is your friend.
The ticket set is sold on the 2nd floor of the JR office at Kansai airport, show them the passport when buying.
The railway system in Japan is complicated and could be astounding to new individual travelers, so
do your homework carefully in advance.
Travel in Kyoto
Kyoto is well connected with buses, they are very frequent and can reach all the popular attractions in the city. I took the bus almost exclusively in Kyoto, so I highly recommend buying the one-day bus pass. The pass costs 500 JPY and each bus ride costs 220 JPY, so the pass makes sense if you take more than 3 bus rides, not to mention you free your mind from worrying coins.
There are other passes that let you take subway as well, but since there are only two subway lines in Kyoto, I find bus to be more convenient and so subway passes may not be worth buying.
Travel in Nara
As Nara is not big and most attractions are close to each other, most people go to Nara as a day trip and stay in Osaka or Kyoto at night. For me, I stayed in Osaka and went to Nara in the morning by taking Kintetsu train to Nara Kintetsu station. Kintetsu has discount tickets called Nara-Ikaruga one-day pass (奈良・斑鳩1dayチケット) that offers unlimited bus rides in Nara and round-trip Kintetsu trains from/to Nara. Like Kyoto, you can go to many places just by bus so this ticket is highly recommended.
Depending on which city you buy the ticket, there are additional benefits. As I bought in Osaka, I could also enjoy unlimited rides on bus, subway and new tram in Osaka.
In Osaka, the ticket can be bought at the subway station supervisor office (駅長室), which is surprisingly located after passing the gate, which could be hard to find in maze-like Osaka subway stations.
Travel in Osaka
Osaka has a good subway system that covers most key destinations so getting a one-day pass is a smart choice.
The most basic form of the one-day pass is the Enjoy Eco card, which costs 800 JPY on week days and 600 JPY on weekends and national holidays. It can be bought directly from ticket machines. This card can be used on New Tram and bus as well, and offers discounts to some attractions like Osaka Castle and Floating Garden Observatory.
If you ever come across the Osaka Visitors’ Ticket and wonder what it is, forget it if you do not live in Hong Kong, Taiwan or Korea. It has the same benefits as the Enjoy Eco card, but with a lower price and is only sold in these 3 regions.
There are many other passes, such as Osaka Amazing Pass and Osaka Kaiyu Ticket, see which one suits you best here.
If you buy the “ICOCA and Haruka” ticket set, you will then have the ICOCA e-money card with 1500 JPY in it, which can be used to take trains and subways. But it is not too useful as a means in buying stuffs as many shops do not accept it, except convenient stores like 7-11. In Osaka, I found vending machines accepts PiTaPa rather than ICOCA as well.
Before leaving Japan, ICOCA can be returned at JR office and you can get 500 JPY deposit back. 220 JPY will be charged as handling fee from the remaining amount in your card, so if you have spent all the money in the card then it means no handling fee. If you think you will visit Kansai again in 10 years, you can keep the card and recharge it next time when you come back to Japan.
That’s it! Hope you enjoy Japan and find my tips useful.
where Open Source technology and Middle Kingdom meet