On: Tell HN: The Internet situation inside Iran

[RupertEisenhart]

I would recommend trying to set up tailscale[0] in the servers instead of a VPN, its similar to the reply about SSH ProxyForwarding but it has a lot more tricks under the hood. Of course you need somewhere (aka an AWS server in eg. europe) to connect to.

Also have a look at their blog post about NAT traversal for some potential inspiration: https://tailscale.com/blog/how-nat-traversal-works/

Good luck out there! I'll have a look at your github repo now.

[0]: https://tailscale.com/

[georgyo → RupertEisenhart]

Tailscale is a VPN...

And it requires a control server with auth. Simply cutting off access to the control server would disable clients from connecting.

While there is headscale, configuring the tailscale clients is tricky and would not scale to hundreds or thousands of non technical people.

/!/ Also tailscale is a mesh network. It would only take one rouge client to revel all other clients. This is very very dangerous given the use case.