DOCSEARCHbyAlgolia
Submit Docs

zapret DPI Circumvention Tool

repository·master·Indexed 12 days ago

https://github.com/bol-van/zapret

A stand-alone tool designed to bypass website blocking and speed shaping by manipulating TCP/UDP traffic to confuse Deep Packet Inspection (DPI) systems. It provides protocol-level manipulation (TCP segmentation, case modification) and packet-level manipulation via tools like nfqws and tpws. Supports Linux, OpenWrt, FreeBSD, OpenBSD, macOS, and Windows.

Tokens
58.7K
Snippets
129
Records
233
Agent score
87%

What's inside zapret

  1. What is zapret and what is it for

    master

    zapret is a stand-alone DPI (Deep Packet Inspection) circumvention tool that does not rely on 3rd party servers. It is designed to bypass HTTP(S) website blocking and speed shaping, and to resist signature-based TCP/UDP protocol discovery.

    Key Characteristics:

    • Target Platforms: Primarily OpenWRT, but also supports traditional Linux, FreeBSD, OpenBSD, Windows, and partially MacOS.
    • Core Purpose: To prevent DPI ban triggers from firing by sending traffic that breaks the DPI's recognition algorithms.
    • Scope: It targets DPI mechanisms, not full OS TCP/IP stacks or server-side applications.

  2. What is tpws and how to use it

    master

    tpws Overview

    tpws is a transparent proxy component of the zapret project. It can operate in two modes:

    1. Transparent Proxy: Intercepts network traffic via iptables/nftables rules and applies tampering strategies to bypass DPI.
    2. SOCKS Proxy: Acts as a standard SOCKS4/5 proxy server. In this mode, no special system privileges or redirection rules are required, but connections to local IPs are prohibited.

    Core Concepts

    • Strategies/Profiles: tpws supports multiple strategies (profiles). You can define different behaviors for different traffic types using filters (L3, TCP port, L7 protocol) or hostlists.
    • TCP Segmentation: tpws uses custom TCP segmentation to split data packets (e.g., splitting TLS ClientHello) to evade DPI. This is controlled via --split-pos.
    • Tampering: Beyond splitting, tpws can perform other tampering actions like changing header casing (--hostcase), adding padding (--hostpad), or sending out-of-band bytes (--oob).
    # Example: Running tpws as a SOCKS proxy
tpws --socks --port=1080

  3. What is zapret and its core purpose

    master

    zapret is an autonomous tool designed to counter Deep Packet Inspection (DPI) without requiring connection to third-party servers. It is used to bypass blocks or throttling of HTTP(S) websites and signature-based analysis of TCP and UDP protocols (e.g., for bypassing VPN blocks).

    Target Platforms:

    • Embedded devices: Primarily routers running OpenWrt.
    • Traditional Linux systems.
    • Other OS: FreeBSD, OpenBSD, and partial support for macOS.
    • Windows: Most functionality is available on Windows.

  4. Important notice regarding zapret2 and scams

    master

    Scammer Warning

    zapret is free and open source. Be wary of anyone claiming you must only download it from their specific resource or demanding you delete links/videos citing copyright; such actions violate the project's license.

    zapret2 (End-of-Life)

    Note that the zapret2 version is no longer under active development and is in EOL (End-Of-Life) mode. It only receives bug fixes; no new features will be added. For the current version, use zapret 2.

  5. Use winws for Windows DPI bypass

    master

    winws is the Windows version of nfqws, utilizing windivert to intercept and process packets.

    Requirements:

    • Administrator rights are required.
    • Requires windivert.dll and the corresponding windivert64.sys or windivert32.sys driver.
    • Does not support large IP sets (ipsets), forwarded traffic, or connection sharing.

    To find your network interface indexes for filtering, use netsh int ip show int or run winws --debug to see the index used by the application.

  6. What is winws and how does it work on Windows

    master

    Overview

    winws is a packet filter for Windows based on nfqws, utilizing the WinDivert driver. It is designed to handle traffic redirection and packet processing in user mode.

    Key Characteristics

    • Driver Requirement: Requires WinDivert (works from Windows 7+). On systems with Secure Boot enabled, you may need to disable secureboot or enable testsigning mode due to driver signing requirements.
    • Permissions: Must be run with Administrator privileges.
    • Limitations:
      • ipset functionality is implemented in user mode, so filtering by a very large number of IP addresses is not possible.
      • Processing shared/passed-through traffic is not supported.
      • Unix-specific parameters like --uid or --user are excluded.
    • Mechanism:
      1. Traffic is identified and redirected in kernel mode via WinDivert.
      2. Redirected packets are passed to winws in user mode for processing.

    Performance Tip

    Filtering is performed in the kernel via WinDivert. To minimize CPU usage and prevent network speed bottlenecks, use WinDivert filters (via --wf-raw-part or --wf-raw) to drop unwanted traffic in the kernel rather than redirecting everything to winws for user-mode decision making.

  7. What is nfqws?

    master
    nfqws is a packet modifier and NFQUEUE handler. It is used to manipulate network packets to bypass censorship or DPI (Deep Packet Inspection). For BSD systems, an adapted version called dvtws is available, which is built from the same source code.

  8. How zapret bypasses DPI

    master

    zapret works by preventing DPI triggers rather than just mitigating their consequences. It uses several strategies to confuse DPI algorithms:

    1. Protocol-level manipulation (Application Layer)

    Some DPIs fail to recognize requests if they are modified slightly:

    • TCP Segmentation: Splitting an HTTP request (e.g., GET / HTTP/1.1...) into multiple segments so the DPI cannot see the full signature in one go.
    • Case Modification: Changing the case of headers (e.g., Host: to host:).
    • Whitespace/Punctuation: Adding extra spaces after the method (e.g., GET / $\rightarrow$ GET /) or adding a dot at the end of the hostname (e.g., Host: kinozal.tv.).

    2. Packet-level manipulation (Transport Layer)

    For more advanced active DPIs, zapret uses 'magic' at the packet level to break the DPI's recognition algorithm. This involves sending data in ways the DPI does not expect, which can be achieved through tools like nfqws and tpws (details in their respective sections).

  9. Understand DPI desync combinations

    master

    The --dpi-desync parameter accepts up to 3 comma-separated modes, which must be specified in ascending phase order:

    1. 0 Phase (Connection Establishment): Modes like synack, syndata, --wsize, or --wssize. These occur during the initial handshake.
    2. 1st Phase (Fake Injection): Modes like fake, rst, or rstack. Fakes are sent before the original data.
    3. 2nd Phase (Data Modification): Modes like fakedsplit or ipfrag2. The original data is sent in a modified way.
    --dpi-desync=synack,fake,fakedsplit

  10. Use Lookup Tables and ipfw on FreeBSD

    master

    On FreeBSD, if ipfw is present, the scripts in ipset/*.sh work with ipfw lookup tables. These are direct analogs to Linux ipset and can contain both IPv4 and IPv6 addresses/subnets simultaneously.

    If ipfw is missing, behavior depends on the LISTS_RELOAD variable in your config:

    • If LISTS_RELOAD is set, the command specified in that variable is executed.
    • If LISTS_RELOAD=-, table population is disabled even if ipfw is present.
    • Otherwise, nothing happens.

  11. Why OpenWrt is recommended for zapret

    master

    OpenWrt is the preferred platform for zapret because it provides a complete Linux environment for embedded devices, addressing the common limitations of factory firmware:

    • Full Root Access: Provides shell access required for configuration.
    • R/W Root Filesystem: Unlike many factory firmwares that use a read-only squashfs root, OpenWrt allows for writing files and persistent configuration.
    • Extroot/Overlay: Supports moving the root filesystem to external media.
    • Package Management: Uses opkg to install missing kernel modules (e.g., iptables modules) and standard utilities without needing to rebuild the kernel.
    • Flow Offload Control: Provides predictable and selective management of flow offloading.
    • SDK Availability: Allows building missing components if necessary.

  12. Understand SYNDATA and SYNACK modes

    master

    SYNDATA Mode

    This mode adds data to the SYN packet. Most operating systems ignore this data unless TCP Fast Open (TFO) is active. DPI engines may misinterpret this extra data. By default, 16 null bytes are added to the SYN packet.