Tell HN: The Internet situation inside Iran
<i>the servers inside Iranian data centers still have access to the outside world.</i><p>Knowing that, the simplest and easiest solution that would avoid detection is to SSH tunnel into that datacenter and SSH-ProxyForward out of that datacenter into Amazon AWS via SSH and use that SSH proxy chain as a SOCKS proxy for browsers.  Make sure the browser is using the SOCKS proxy (SSH) for its DNS.  Many sites will make your friends solve captchas if they show up from Amazon so if you have a friend outside of Iran in the same AWS region that is willing to open SSH on their home router then one could add that private home router as their last hop in the SSH proxy forward.  Do not go directly from the datacenter to the home.  It is <i>normal</i> and <i>expected</i> for Datacenters to SSH to Amazon.<p>SSH Client -&gt; Iranian Datacenter &#x2F; Server -&gt; AWS VM -&gt; Home router in same region as AWS -&gt; Internet.<p>If many people are using the same server and VM then make sure that MaxStartups and MaxSessions have been increased in sshd_config as well as any PAM limits on the servers for open files on every node in the path.  Clients should enable ControlPath &#x2F; ControlMaster in their ssh_config or ~&#x2F;.ssh&#x2F;config.  To harden each hop configure PermitOpen to only allow the SSH hops and the final hop should also permit *:443<p>Examples of all these steps can be found on SuperUser  &#x2F; StackExchange &#x2F; ServerFault and are all public knowledge.  All above-board, no hacking involved.<p>[Edit] Removing the Squid MITM SSL-Bump proxy idea.  That would make follow on questions harder to explain.<p>[Edit from Fatnino&#x27;s input] If your Amazon VPC&#x27;s are too outbound-restricted then pick another VPS provider that is commonly used for hosting 3rd party tools for datacenters, preferably one already used by that datacenter.<p>[Edit] In theory hypothetically speaking every hop possible could have misconfigured but realistic looking syslog so that SSH connections are not logged on the server and in theory a log-less silent rule in the edge firewall to not log SSH connections.  Sometimes syslog disks also fill up by mistake.  SSH can also be performed in ephemeral diskless containers such as Docker, Podman and LXC.