Considerations for Setting Up a WebTunnel

[Tangerine]

Hey Friends,

I’m thinking of setting up one of the new WebTunnel bridges, and I have a couple questions about the self-hosted website and domain that are required. First, quoting from this post:

@system

[…] So, for an onlooker without the knowledge of the hidden path, it just looks like a regular HTTP connection to a webpage server giving the impression that the user is simply browsing the web.

[…] As a result, when someone attempts to visit the website at the shared network address, they will simply perceive the content of that website address and won’t notice the existence of a secret bridge (WebTunnel).

My questions are:

1. Domain Name and Website Appearance: How crucial are the selection of an inconspicuous domain name and the design of a plausible front-end website? Are these significant concerns, or should my focus be elsewhere?
2. Additional Considerations: Beyond domain naming and website facade, what other key aspects should I consider?

Thanks!

[gus]

@Tangerine

How crucial are the selection of an inconspicuous domain name and the design of a plausible front-end website?

When choosing a domain for a WebTunnel bridge, it’s important to avoid keywords that might trigger censorship, thus preventing users from accessing your bridge. For example, a domain containing the keyword torproject could potentially be flagged and filtered by censorship rules.

Citizen Lab published an interesting study on search censorship in China (2023): Missing Links: A comparison of search censorship in China - The Citizen Lab. For Chinese users, maybe avoid keywords mentioned in that research or that could be politically sensitive, for example, “freechina”, “freehongkong”.

Another interesting study is “TMC: A system designed to measure Turkmenistan’s censorship at scale”, where the authors developed a system to measure censorship in Turkmenistan and they’ve mapped 181k blocking rules: TMC Dashboard.

@Tangerine

Additional Considerations: Beyond domain naming and website facade, what other key aspects should I consider?

• ISP diversity: Sometimes censors blocks entire IP ranges of popular hosting providers like Digital Ocean, Linode and Hetzner as they are very common for VPNs. Finding other providers that are not associated with censorship circumvention tools to run your WebTunnel bridge is highly recommended.

• Do not log users IPs: Make sure that your web server is not logging IP addresses of WebTunnel users (See the NGINX template: WebTunnel: NGINX vhost example ($190) · Snippets · GitLab).

• Renew TLS certificate automatically - Don’t forget to create a cronjob to renew your domain’s TLS certificate automatically or your WebTunnel bridge will stop to work.

Thanks for these questions. Let us know if you have any issue to setup your WebTunnel bridge!