22 ms·
GoodbyeDPI: Deep Packet Inspection circumvention utility
- liberia 4y agoWorth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-heres-why https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar from being physically in their server room and inspecting their setup. Add to the VPN a DoH resolver that I own and control too, and it makes things even better. I also block port 80 on my machine as an extra measure. No need to be using port 80 in this day and age except for captive portals which I rarely ever have to use.
- ditsuke 4y agoIt's widely employed by Russian and Indian ISPs to censor access to websites. I've had a largely successful run with GoodbyeDPI 's circumvention.
- cyber_kinetist 4y agoSouth Korea also does this, and this tool is well known as one of the best circumvention methods (alongside with VPNs, but they cost money)
- izacus 4y agoMore importantly, it's widely deployed by HNers in US to snoop though everything you do on your phone, tablet and computer if you dare to use their wifi. The ops topics are full of people claiming how critically important it is for them to sniff through everything you do on "their" network for security. You don't need to go to Russia, China or India to have your privacy violated. Just go to work.
- kevin_thibedeau 4y agoYour privacy isn't violated if you avail yourself of someone else's property.
- b112 4y agoViolation and legality are two entirely different things.
- taneq 4y agoDepends whether you were aware of the consequences of accessing that property. If you walk through my front gate and I pants you, take photos of your junk and upload them, you'll probably be upset unless I had a sign on the gate saying (in clear language, not 14 pages of irrelevant 6pt legalese hiding a link to the actual 'privacy policy' document which admits in obfuscated language that pantsing is an option) that this would happen.
- 0xedd 4y agoNo. When all "gates" in a domain have this sign, it isn't less upsetting.
- izacus 4y agoThe networks of ISPs you're "availing yourself to" are their property.
- rogers18445 4y agoYou don't control the myriad of routers between you and your server, and between the server and its destination. One reason to use commercial VPNs is to at least attempt to launder your packets.
- patrakov 4y agoWell, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (the city uses a geo-restricting filter out of security concerns), and you will see foreign prices (which might be 5x higher in some cases!) on sites that differentiate based on the country. Also, extra latency in games. None of that applies with GoodbyeDPI. Edit: the above is written from the viewpoint of the past myself, before emigration to the Philippines.
- 5e92cb50239222b 4y agoI wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally compressed), and looks just like another SSH connection. I've used many other solutions (including WireGuard, etc.) on and off, but always come back to SSH.
- userbinator 4y agopoint your applications to That's the problem. Not all of them will implement tunneling their own traffic through SOCKS, and there's still other things like DNS that you might also want to go through the tunnel, but can't easily do so. A VPN sits at a lower layer, just looking like a regular network connection, so applications don't need to be aware.
- 5e92cb50239222b 4y agoWell, yeah, that's the problem (or the main advantage depending on your viewpoint). The post I was replying to mentioned how painful it is to avoid routing through VPN where it's not needed (although it's pretty easy to do on Linux with network namespaces, and IIRC policy routing, which I've never tried). I just want to point out the simplest solution which for some reason doesn't seem to be very popular, although it covers most users' use-cases better than a VPN connection does (IMHO). Don't know about other browsers, but Firefox is able to send DNS requests through socks, whether you're using DNS-over-HTTPS or not.
- pyinstallwoes 4y agoWhat VPN service did you choose, and what were the contenders if any?
- occamrazor 4y agoHaven’t you just replaced trust in your ISP with trust in the hosting provider of your VPN? (Depending on yourISP and provider this can be a good trade-off)
- wruza 4y agoreligiously route all my traffic through a VPN that I own and control Can you please share an easy way to do that? I’m usually not afraid of wading through configuration swamps, but when it comes to openvpn, I curl up in a corner crying.
- Zen1th 4y agoPersonally I use dsvpn (https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn) which is super simple to setup and use, and it's made by the guy who created libsodium.
- wruza 4y agoThanks! But from what I can see in sources (please correct me if that’s wrong), it is not a vpn, and a regular vpn client cannot connect to it. Nice idea along the lines of SOCKS proxy.
- dicknuckle 4y agoYou can just use Tailscale if all of this seems like a pushup. It's wireguard under the hood and everything JustWorks™
- Diris 4y agoThis is probably the easiest way. It uses wireguard instead of openvpn but I'm pretty sure it's better https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install
- blacksmith_tb 4y agoI have had good luck with Algo: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- DethNinja 4y agoFYI, your setup is great if you don’t trust your ISP but it doesn’t provide any privacy. Public VPNs act as a mixer and hide your tracks. IP correlation is very easy nowadays, so persistent single connection to your own VPN won’t protect you from certain entities that correlate your traffic. DoH is better than DNS but it doesn’t provide privacy. You should switch to DNSCrypt.
- diasan 4y agoThe problem / disconnect with that DPI is dead article is that corporations still want to use use, as they control their employees computers. Hence I've recently been asked to implement a URL inspecting firewall, which implies a HTTPS intercepting MiTM proxy. They will probably require some exception list where things get passed through 'unmolested', but for a white listed sub-set of sites (say well known health, banking, etc). The one thing which can break that is cert pinning, but then the corporations can simply mandate that apps requiring/using cert pinning not be used from the corporate machines. There are some bumps in the techniques caused by HTTPS RRs, AltSvc and HTTP/3, but they will be worked around, at worst by forced downgrades. The "they'll never no argument" carries no weight, as employers up front tend to inform their employees that the communications are monitored, hence giving the corporation legal cover. That said, I do generally agree with the aim of that article, but changing the corporate mindset is a different (non technical) problem; it is all about providing the corporation with a colorable argument towards reducing their liability in certain scenarios.
- from 4y ago> I religiously route all my traffic through a VPN that I own and control. But then you are losing the anonymizing effect of the VPN. If you are doing something illegal this is obviously bad but I guess it otherwise doesn't really matter. Companies like Mullvad have tens of thousands of users which means that the actions of one VPN IP address can not be attributed to just one person. You're just transferring the ability to surveil you from your ISP to whoever hosts your VPN server.
- checkyoursudo 4y agoWhy not run everything through TOR then? Or is that too limiting?
- SergeAx 4y agoBut why exactly do you do this? Own a server somewhere, admin it, replace or repair it in case of trouble - what for?
- blahgeek 4y agoHaha that’s cute. Here in china the GFW now simply routes the IPs to blackhole. False positive by virtual host or CDN you ask? They don’t care :)
- laughinghan 4y agoThat's what domain fronting is for, and even though the GFW attempts to filter by SNI, genetic algorithms like Geneva are able to find workarounds: https://geneva.cs.umd.edu/papers/foci21.pdf https://geneva.cs.umd.edu/papers/foci21.pdf
- ignoramous 4y agoIP Fronting too: https://research.cloudflare.com/publications/Fayed2021/ https://research.cloudflare.com/publications/Fayed2021/
- Avamander 4y agoESNI/ESH is coming soon, I guess we'll see soon enough how that plays out.
- grishka 4y agoSince the project at the OP link is mostly/initially aimed at Russia, in my own experience, it's not always just DPI — it's often DPI combined with a firewall. Roskomnadzor can order to block access to a domain, but then they can also specify an IP or a subnet instead. For example, that's what happened when they tried to block Telegram, which does not use DNS at all.
- userbinator 4y agoLooks like it uses WinDivert as the filtering driver, which says on its site that "Windows Server 2016 systems must have secure boot disabled"; not entirely surprising and a reminder of what a lot of the "security" stuff is really securing.
- buwrtgu 4y ago"secure boot must be disabled" is the equivalent of "in case of permissions error, just chmod 777". secure boot literally protects the user first, and is configurable with user provided keys on the vast vast majority of open platform computers (i.e. amd64) "prevent injection of a driver that can divert all my shit at the kernel level" is exactly what you want secure boot protecting you from. there is no limitation of user rights because the user can turn it off and/or load their own keys at will. secure boot fear mongering is bullshit nonsense
- denkmoon 4y agoSad to see this downvoted without any response, because as far as I see he's exactly right.
- 0xedd 4y agoNo. That's just propaganda. The purpose is to further vendor lock you. MS has a minute share in the world of OS, completely outclassed by Linux. They're trying to force their way in by fooling people like you that something like Pluton is required. The only reason they dominate the PC market share is because their spyware OS is installed by default and people don't go around switching OSes. An anecdote about security; at my workplace, one of the top 5 security firms in the world, secure boot isn't required nor is MS. Makes you wonder.
- Avamander 4y agoI'm not sure if you don't know or don't want to know what SB does, but it's not propaganda, neither is it vendor-locking. Most widespread vendor locks don't use SB, neither is the functionality only usable for that (well duh, it could be, because you can choose your root of trust, but you can choose the root). You might as well call other tech Linux doesn't play well with "vendor-locking" as this point with no concern, even if there are no real "locks" like that, just lack of support. "TME doesn't work? Literally vendor-locking and Microsoft propaganda!1!" Security corporations, known for their cargo culting in addition to the usual corporate bullshit, aren't a great example. But bringing then up like they somehow were... makes you wonder indeed.
- navigate8310 4y agoIs there a network wide DPI circumvention tool that can be easily deployed using Docker?
- mmwelt 4y agoDoesn't work in China, though: https://github.com/ValdikSS/GoodbyeDPI/issues/123 https://github.com/ValdikSS/GoodbyeDPI/issues/123
- userbinator 4y agoFor that, you need something more like obfsproxy or some other steganographic tunnel, which of course also requires an endpoint on the other side much like a VPN.
- erebe__ 4y agoWebsocket tunneling is known to work against the GFW. Many people reported me that they managed to use wstunnel to bypass https://github.com/erebe/wstunnel https://github.com/erebe/wstunnel (linux + mac + windows)
- ValdikSS 4y agoIf anyone gets me a network link to China, I'm ready to test and implement new techniques. Last time I asked why such tools are not built in China, the developer of very popular anti-censorship tool told me that there are punishment for censorship circumvention in China, and such tools which openly punch DPI could be more dangerous for the end user in the legal sense.
- slt2021 4y agoWireguard solves this, no need this
- graynk 4y agoThat’s assuming that the wireguard protocol is not blocked by that same DPI that you’re trying to circumvent. The more tools - the better
- jokowueu 4y agoWiteguard isn't made to do this . Even the author said so . It's blocked in many countries
- tomxor 4y agoNo, it used to as a side-effect, but DPI circumvention is an unpopularity contest... wiregaurd is no longer unpopular enough, DPI targets it, and wiregaurd's purpose is not to play the circumvent DPI game, so it's not going to continually make arbitrary changes to do so.
- mrshadowgoose 4y agoNot at all. The protocol has a very well defined structure, and one only has to foul the handshake packets to block connections.
- NoOn3 4y agoIt's only for Windows. Linux didn't supported. :(
- shmde 4y agoIt IS supported on Linux, they have a tar file on the downloads page. https://github.com/ValdikSS/GoodbyeDPI/releases https://github.com/ValdikSS/GoodbyeDPI/releases
- denkmoon 4y agoIs this some kind of bad joke?
- 5e92cb50239222b 4y agoYou mean the source tarball? It doesn't work on Linux, it doesn't even compile — the Makefile hardcodes CC to the MinGW compiler. Almost every .c file includes windows.h. Looking at the project's issue list, they don't support other operating systems.
- zorgmonkey 4y agoThat source tarball is autogenerated by github when you make a release and it in no way implies linux compatibility, it is simply a way to download the source code without git.
- jacooper 4y agoThere is a similar project that supports Linux, but its much more focused on Russian censorship. https://github.com/bol-van/zapret https://github.com/bol-van/zapret
- rixrax 4y agoLooking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?
- progbits 4y agoCensorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.
- nnx 4y agoOr perhaps some good talent somehow ending up working there made sure the system is full of plausibly deniable holes.
- friendlyHornet 4y agoI would like to believe that; it makes me feel warm and comfortable
- userbinator 4y agoInteresting to see the two meanings of good appear in both your and your parent's comment.
- gjulianm 4y agoIt's not as much about talent but about tradeoffs. I work in traffic monitoring tools (not censorship, just observability tools for infrastructure) there's always the decision of how many edge cases you want to cover vs how fast you want your tool to go. At millions of packets per second, an extra "if" might make a big difference in the throughput you're able to monitor. So maybe it's actually reasonable to ignore the .1% that use "hoSt" instead of "Host" to avoid losing .5% of the packets.
- someguydave 4y ago
- weinzierl 4y agoThe nice thing about this is that passive mode should be undetectable. Active mode on the other hand will probably not be useful for long because it is basically based in negligent implementation on the the DPI side and trivial to fix.
- deleted 4y ago[deleted]
- jeroenhd 4y ago> Active DPI is more tricky to fool. Currently the software uses 7 methods to circumvent Active DPI: > TCP-level fragmentation for first data packet > TCP-level fragmentation for persistent (keep-alive) HTTP sessions > Replacing Host header with hoSt > Removing space between header name and value in Host header > Adding additional space between HTTP Method (GET, POST etc) and URI > Mixing case of Host header value > Sending fake HTTP/HTTPS packets with low Time-To-Live value, incorrect checksum or incorrect TCP Sequence/Acknowledgement numbers to fool DPI and prevent delivering them to the destination DPI middleboxes are truly terrible. They're incompatible with even basic TCP without any good reason. I wonder if these ISPs use the same vendors as your average "enterprise" network.
- Avamander 4y ago> DPI middleboxes are truly terrible. They're incompatible with even basic TCP without any good reason. Thanks to them things like TCP Fast Open are unfortunately still a rarity. > I wonder if these ISPs use the same vendors as your average "enterprise" network. Most likely, yes. Takes a bit too much effort to handle the bandwith necessary, that everyone would be able to do and sell it as a service.
- kebman 4y agoSorry, might be a dumb question, but isn't this simply a matter of encrypting your packets or using a VPN?
- negus 4y agoYou certainly can pass all blocked traffic through VPN. But this is a cheaper (and because of that is more scalable) way to pass through.
- kebman 4y agoSorry, wouldn't that simply constitute security by obscurity?
- psydvl 4y agoDefault user just want to access blocked resources. Free VPN... Can we trust them? Paid VPN are paid.
- witrak 4y ago>Free VPN... Can we trust them? Paid VPN are paid. Paid VPNs are paid. Can we trust them more?
- neurostimulant 4y agoPeople who live in a country with strict censorship often can't pay foreign vpn company due to the lack of payment processors support. Can't pay with visa/mastercard if you live in Russia or Iran.
- ValdikSS 4y agoSeveral issues: * VPNs are mostly not free, and with current situation in Russia, you can't easily pay for the Europe/US service due to absent Visa/MC service * Popular VPN providers are getting blocked in Russia recently * For the major websites, such as Instagram and Twitter, VPN access almost instantly triggers additional checks, cellphone number validation, account block, etc. * VPN connection increases latency and reduces speed While GoodbyeDPI is free and autonomous. AND it can unblock VPNs, too! For example, the latest build can unblock blocked ProtonVPN by inserting fake TLS packet during OpenVPN TCP handshake.
- deleted 4y ago[deleted]