VPN over TLS (was: site-to-site VPN with credential prompts?)

[Stefan Monnier <monnier@iro.umontreal.ca>]

> I was once sitting at a $(DAYJOB) where they blocked everything but
> 443 (and 80). I tunneled ssh over socat (with TLS, so that the handshake
> didn't look suspect, in case their firewall sniffed that).

Reminds me: I have an OpenVPN running on port 443, specifically to
minimize the chances that it's blocked by a firewall.

Yet, sometimes it *is* blocked (e.g. at the public wifi in the
hospital), presumably because it's not actually using TLS.
[ Funnily enough I can still use SSH from that hospital.  ]

I know there's a fair amount of "work" trying to recognize VPNs to block
them for censorship purposes, but I don't expect the local hospital to
be part of such games.  Any idea why OpenVPN-on-TCP/443 would be blocked
while other HTTPS connections work just fine?


        Stefan