

OpenVPN in TCP mode wrapped around Stunnel. That’s the thing that works.
I have it set up to bypass VPN restrictions in some networks, but it also serves to bypass a lot more stuff if you know what you’re doing.
DPI will only see TLS traffic, and assume it’s HTTP. You can even try to fool it by modifying the packet headers, so dumb enough DPI will think you’re connecting to the site you choose.




I work as a sysadmin (luckily I work mostly with Linux). We have lots of tools for windows server setup on our company, and for most deployments, we have templates and checklists to deploy as quickly as possible.
It still takes at least 2 hours to deploy windows server from a checkpoint, and that’s skipping all the initial installation. Most of that time is spent updating, debloating, and setting the most basic stuff up.
It takes me less time to set up a Linux server from scratch, without any checkpoints, than it takes my coworkers to set up a windows server for the 9999th time, with a decade worth of tools.