zapret2 Documentation

The nfqws2 processing pipeline follows these stages:

1. Interception: Packets are passed from the OS kernel to the nfqws2 user-mode process via interception methods (e.g., Linux netfilter).
2. Dissection: The packet is parsed into a dissect structure representing OSI layers (IP, IPv6, TCP, UDP, and data fields).
3. Conntrack: The built-in conntrack subsystem tracks flows (L3/L4 data), monitors direction, packet/byte counts, and TCP sequence numbers. It handles message reassembly and decryption if necessary.
4. Payload Identification: Signatures identify payload types to determine the flow protocol.
5. Profile Classification: Profiles containing filters (L3, L4, L6/L7) and actions are scanned in order. The first matching profile is selected and cached in the conntrack entry.
6. Lua Execution: Actions within a profile are executed as Lua function instances via --lua-desync parameters.
7. Verdict Aggregation: Each Lua instance returns a verdict (VERDICT_PASS, VERDICT_MODIFY, or VERDICT_DROP). The final verdict is determined by priority: DROP > MODIFY > PASS.
8. Transmission: The final packet (original or modified) is sent back to the kernel.

The ipset directory contains shell scripts that manage files with fixed names. These files are categorized into two types:

1. User lists: Managed manually by the user and not modified by the software. They can contain hostnames, IPv4/IPv6 addresses, or CIDR subnets.
2. Generated lists: Produced by the software (e.g., via downloading or resolving hostnames). These should not be edited manually as changes may be overwritten.

Key File Naming Conventions:

• IPv6 lists: Append 6 before the extension (e.g., zapret-ip-user6.txt).
• Compressed lists: If GZIP_LISTS is enabled in config, generated lists may have a .gz extension.

zapret2 is a packet manipulation project designed to bypass Deep Packet Inspection (DPI) or perform protocol obfuscation. The architecture is split into a C core for interception and a Lua layer for traffic modification logic.

Core Components

• nfqws2 (Linux), dvtws2 (BSD), or winws2 (Windows): The primary C-based packet manipulator. It handles interception, filtering, protocol recognition, and raw packet transmission. It does not contain traffic modification logic; it calls Lua code to perform those tasks.
• Lua Libraries: The actual traffic modification logic resides in Lua scripts called by the C core. Key libraries include:
  • zapret-lib.lua: Base helper library.
  • zapret-antidpi.lua: DPI attack library.
  • zapret-auto.lua: Orchestration library for dynamic decision-making.
  • zapret-obfs.lua: Protocol obfuscation.
  • zapret-pcap.lua: Traffic capture to .cap files.

Kernel Interception

Traffic redirection is handled by the following kernel tools depending on the OS:

• Linux: iptables or nftables.
• FreeBSD: ipfw.
• OpenBSD: pf.
• Windows: Built into winws2 via the WinDivert driver.

Secondary Tools

• blockcheck2: Tool for automated strategy testing.
• mdig: Multi-threaded hostlist resolver for large lists.
• ip2net: Aggregates individual IP addresses into subnets.
• Startup Scripts: Linux scripts (init.d, common, ipset, etc.) used to coordinate nfqws2 and kernel tables. These scripts use a configuration file located in the project root.

You can apply different strategies based on the network connection (e.g., Wi-Fi vs. Ethernet).

Wi-Fi Filtering (SSID):

• Linux: Use --filter-ssid. nfqws2 resolves the SSID on the active interface and matches it against the provided list.
• Windows: Use --ssid-filter. It monitors all Wi-Fi adapters. To use different strategies for different SSIDs, you must run multiple instances of winws2, as the filter activates/deactivates interception globally for that instance.

Network List Manager (NLM) Filtering:

• Use --nlm-filter[=all] or --nlm-list[=all] to filter by network GUIDs.
• --nlm-list[=all] returns a list of GUIDs for connected networks.
• Provide a comma-separated list of GUIDs to --nlm-filter to target specific networks recognized by the OS.
• Note: On newer Windows systems, you may need to manually assign GUIDs via PowerShell or Registry if the system categorizes them incorrectly.