[split] Chinese firewall

[RichardGv]

But you paid for the VPN, right?

The West Chamber project is quite interesting, how exactly does work?

- A third thing is, that this is probably getting a bit off-topic, and perhaps should be split into another thread?

Huh, yeah, this is off-topic, but I have no permissions to split them to another thread (or I did not find the correct button?).
@Moderator/Admin Please split all replies since post #7 to a new thread. Thanks.

Yes, I payed for the VPN. $20 per year, it costs.

The mechanism of West Chamber is rather complicated and technical. I would try to explain it with my limited knowledge. Sorry if there's something wrong in my explanation.
The project is formed by 3 components: zhang, cui, and another component to look for corrupted DNS responses.
The zhang/cui component is primarily used to deal with TCP reset packets sent by Great Firewall. (zhang and cui are both names of chacters in Romance of the West Chamber, a novel from which the name of the project came.)
This is how Great Firewall detects and interrupts connections with TCP reset packets, firstly:


(Ignore the Chinese titles, please. Source of these graphs: https://twitter.com/gfwrev )
This is how "zhang" part works:

1. The client (Bob) sends a SYN segment to the server (Alice), Alice returns a SYN packet, as what normally would happen.
   
2. West-chamber injects a RST packet on Bob's side with wrong sequence number (?), letting the firewall (Mallory) believe the connection from Bob to Alice is closed. (The firewall does not record the old TCP sequence numbers due to performance considerations, so it cannot detect whether a TCP packet is valid or not, while Bob and Alice can.)
   
3. West-chamber (on Bob's side, of course) sends Alice a ACK segment with wrong acknowledgement number. According to TCP standard, Alice returns a RST segment. When Mallory discovers the RST segment, he thinks the connection is already closed, and stop monitoring the traffic between Bob and Alice, but in fact it's not closed.
   
4. Bob then finishes the 3-way-handshake and continues to talk with Alice, without Mallory interrupting.
   

"cui" works in a similar way.
The DNS component detects fake DNS responses returned from the firewall with some sort of predefined fingerprints and discard them.
The explainations is mostly translated from a Chinese article: http://blog.youxu.info/2010/03/14/west-chamber/