DOCSEARCHbyAlgolia
Submit Docs

udp2raw-tunnel

repository·unified·Indexed 27 days ago

https://github.com/wangyu-/udp2raw

A tool that converts UDP traffic into encrypted FakeTCP, UDP, or ICMP traffic using raw sockets. It is designed to bypass UDP firewalls, UDP QoS, or unstable UDP environments. It supports Linux, Android, OpenWRT, Raspberry Pi, Windows, and MacOS, and provides features such as automatic iptables rule management, OSI Layer 2 packet transmission, and configurable sequence modes for FakeTCP to evade ISP detection.

Tokens
9.3K
Snippets
20
Records
46
Agent score
89%

What's inside udp2raw

  1. Overview of udp2raw-tunnel

    unified

    udp2raw-tunnel is a tool that uses raw sockets to wrap UDP packets with TCP or ICMP headers. This allows users to bypass UDP blocking or QoS (Quality of Service) restrictions imposed by ISPs. It is particularly useful for stabilizing connections when using tools like kcptun or finalspeed in environments where UDP traffic is throttled or blocked.

    Key features include:

    • Traffic Masking: Wraps UDP in TCP or ICMP headers to bypass restrictions.
    • TCP Simulation: Simulates the TCP 3-way handshake and various TCP options (MSS, sackOk, TS, etc.) to make traffic look like standard Linux TCP traffic.
    • Connection Recovery: Supports heartbeats and automatic reconnection. It can recover a session even if the underlying network connection drops or the IP changes (e.g., after re-dialing), keeping the upper-layer application connection alive.
    • Security: Provides encryption (AES128CBC or XOR) and data integrity verification (HMAC-SHA1 or others), along with anti-replay protection.
    • Multiplexing: Supports multiple connections on the client side and multiple clients on the server side.

  2. Accelerate TCP traffic using udp2raw and finalspeed

    unified

    This guide demonstrates how to use udp2raw as a tunnel to wrap UDP traffic into fake TCP packets. This allows finalspeed (which uses UDP mode) to bypass ISP UDP QoS or blocking by sending packets that appear as TCP at the network layer. This method is more stable than finalspeed's native TCP mode, especially on OpenVZ architectures.

    Prerequisites

    • Server: Linux host with root privileges (supports OpenVZ or OpenWrt).
    • Local Client: Windows host with an OpenWrt router, Raspberry Pi, or a Linux Virtual Machine (configured in bridge mode).
    • Software:
      • udp2raw binaries (download from releases).
      • finalspeed installed on both server and local client.

    Workflow Overview

    1. Server: Run finalspeed server.
    2. Server: Run udp2raw in server mode to tunnel traffic to the finalspeed port.
    3. Local: Run udp2raw in client mode to connect to the server.
    4. Local: Configure finalspeed client to use the udp2raw local tunnel port.
    5. Access: Access services via the local finalspeed port.

  3. Compile udp2raw on local Linux platforms

    unified

    To compile udp2raw directly on a Linux machine (such as a PC or Raspberry Pi), follow these steps to install dependencies, clone the source, and build the binary.

    1. Install Git

    Debian/Ubuntu:

    sudo apt-get install git

    RedHat/CentOS:

    sudo yum install git

    2. Clone the source code

    git clone https://github.com/wangyu-/udp2raw-tunnel.git
cd udp2raw-tunnel

    3. Install build tools (g++, make, etc.)

    Debian/Ubuntu:

    sudo apt-get install build-essential

    RedHat/CentOS:

    sudo yum groupinstall 'Development Tools'

    4. Build

    Run the make command to generate the udp2raw binary.

    git clone https://github.com/wangyu-/udp2raw-tunnel.git
cd udp2raw-tunnel
make

  4. Configure OSI Layer 2 (Lower-Level) Transmission

    unified

    The --lower-level option allows you to bypass local iptables by sending packets at OSI level 2. This is useful when iptables are difficult to modify (e.g., on certain router firmwares).

    Format: if_name#dest_mac_adress (e.g., eth0#00:23:45:67:89:b9).

    How to find parameters:

    1. Client Side:
      • Run traceroute <server_ip> to find the gateway IP.
      • Run arp -s <gateway_ip> to find the interface name (if_name) and the gateway's MAC address (dest_mac_adress).
      • If using PPPoE, use the virtual interface (e.g., ppp0) and set the MAC to 00:00:00:00:00:00.
    2. Server Side:
      • If the client has a public IP, run traceroute <client_ip> and follow the same steps.
      • If the client is behind NAT, run traceroute google.com and follow the same steps.

    Tip: You can try --lower-level auto first. If it fails, provide the parameters manually.

  5. Cross-compile udp2raw for OpenWrt

    unified

    To build udp2raw for platforms requiring cross-compilation (such as OpenWrt routers), perform these steps on your PC.

    1. Install Git

    Debian/Ubuntu:

    sudo apt-get install git

    RedHat/CentOS:

    sudo yum install git

    2. Prepare the Toolchain

    1. Download the OpenWrt SDK corresponding to your router's OpenWrt version and CPU model from downloads.openwrt.org.
    2. Unzip the SDK to a directory.
    3. Locate the g++ cross-compiler within the SDK's staging_dir/toolchain-.../bin/ directory (e.g., mips-openwrt-linux-g++).

    3. Configure and Compile

    1. Open the Makefile and modify the first line to point to your cross-compiler path:
    cc_cross=/path/to/your/sdk/staging_dir/toolchain-.../bin/mips-openwrt-linux-g++
    1. Run the cross-compilation command:
    make cross

    The generated udp2raw_cross is the binary for your router.

    Note on Static Binaries: make cross generates a non-static binary. If you encounter execution issues on the target device, attempt to compile a static binary using one of the following commands:

    • make cross2
    • make cross3

    If your toolchain supports static compilation, one of these will succeed and produce a udp2raw_cross file.

  6. Supported Platforms for udp2raw-tunnel

    unified

    udp2raw-tunnel is designed for Linux hosts with root privileges or the cap_net_raw capability.

    • Supported Linux Architectures: amd64, x86, arm, mips_be, mips_le (pre-compiled binaries available in Releases).
    • Compatible Devices: PCs, Android phones/tablets, OpenWrt routers, and Raspberry Pi.
    • Windows and macOS: Use the binaries from the udp2raw-multiplatform repository.
    • iOS and Game Consoles: Run udp2raw on a local network machine or virtual machine (e.g., an OpenWrt/LEDE/Merlin router).

  7. Run udp2raw on a rooted Android device (ARM CPU)

    unified

    To run udp2raw on an Android device, the device must be rooted to allow the use of raw sockets. There is no GUI; you must use a Terminal emulator.

    Prerequisites

    1. Root Access: Required for raw socket operations.
    2. Terminal Emulator: Installed on the device.
    3. Binary: Download udp2raw_arm from the official releases.
    4. Storage: Copy udp2raw_arm to your internal storage. Note that copying it to an SD card will not work.

    Execution Steps

    1. Generate iptables rules

    Run the binary with the -g flag instead of the usual -a flag. This step is used to generate the necessary iptables rules.

    ./udp2raw_arm -c -r 44.55.66.77:9966 -l 0.0.0.0:4000 -k1234 --cipher xor -g

    2. Apply iptables rules manually

    Locate the iptables rule generated in the output from the previous step and apply it manually using the iptables command. For example:

    iptables -I INPUT -s 44.55.66.77/32 -p tcp -m tcp --sport 9966 -j DROP

    3. Start the tunnel

    Run the binary normally without the -g flag to start the tunnel.

    ./udp2raw_arm -c -r 44.55.66.77:9966 -l 0.0.0.0:4000 -k1234 --cipher xor
    #!/bin/bash
# Example sequence for Android
./udp2raw_arm -c -r 44.55.66.77:9966 -l 0.0.0.0:4000 -k1234 --cipher xor -g
iptables -I INPUT -s 44.55.66.77/32 -p tcp -m tcp --sport 9966 -j DROP
./udp2raw_arm -c -r 44.55.66.77:9966 -l 0.0.0.0:4000 -k1234 --cipher xor

  8. Build udp2raw for Linux (Local Compile)

    unified

    To build udp2raw directly on a Linux platform (such as a PC or Raspberry Pi), follow these steps to install dependencies, clone the repository, and compile the binary.

    1. Install Git

    Debian/Ubuntu:

    sudo apt-get install git

    RedHat/CentOS:

    sudo yum install git

    2. Clone the Repository

    git clone https://github.com/wangyu-/udp2raw-tunnel.git
cd udp2raw-tunnel

    3. Install Compilation Tools

    Debian/Ubuntu:

    sudo apt-get install build-essential

    RedHat/CentOS:

    sudo yum groupinstall 'Development Tools'

    4. Compile

    Run the following command to compile the binary:

    make

    The resulting udp2raw file is the compiled binary.

    git clone https://github.com/wangyu-/udp2raw-tunnel.git
cd udp2raw-tunnel
make

  9. Accelerate TCP traffic using udp2raw and kcptun

    unified

    This guide demonstrates how to accelerate TCP traffic (using SSH as an example) by tunneling it through kcptun and then through udp2raw. This setup uses udp2raw to wrap the KCP traffic in a simulated TCP header to bypass network restrictions.

    Prerequisites

    • Two Linux hosts (e.g., OpenWrt routers, Raspberry Pi, or rooted Android) with root privileges.
    • For Windows/macOS clients, refer to the project wiki for GUI instructions.

    Installation

    1. Download the latest releases for both kcptun and udp2raw from their respective GitHub release pages:
    2. Unpack the binaries on both the client and server sides.

  10. Configure the udp2raw tunnel (Server and Client)

    unified

    To establish the tunnel, you must run udp2raw in server mode on the remote host and client mode on the local host.

    1. Remote Server Setup: Run udp2raw in server mode (-s) to listen on a public port and forward traffic to the local KCP server port.

    2. Local Client Setup: Run udp2raw in client mode (-c) to listen on a local port and forward traffic to the remote udp2raw server IP/port.

    Note: Both sides must use the same --raw-mode and -k (password) for successful connection.

  11. Run udp2raw-tunnel in Server and Client modes

    unified

    To establish an encrypted tunnel that bypasses UDP blocking or QoS, run udp2raw on both the server and the client. The tunnel encapsulates UDP traffic into FakeTCP, ICMP, or UDP headers.

    Important Requirements:

    • Commands must be run as root (or with cap_net_raw).
    • Use the -a flag to automatically add required iptables rules for stable operation. If you prefer to manage iptables manually, use the -g option instead of -a.

    Example Scenario:

    • Server IP: 44.55.66.77
    • Service listening on server UDP port: 7777
    • Tunnel port on server: 4096
    • Tunnel port on client: 3333
    • Shared password: passwd
    • Mode: faketcp
    # Run at server side:
./udp2raw_amd64 -s -l0.0.0.0:4096 -r 127.0.0.1:7777    -k "passwd" --raw-mode faketcp -a

# Run at client side
./udp2raw_amd64 -c -l0.0.0.0:3333  -r44.55.66.77:4096  -k "passwd" --raw-mode faketcp -a

  12. Send Commands via FIFO (Named Pipe)

    unified

    You can use the --fifo <string> option to specify a named pipe for sending commands to a running instance.

    On the client side, you can force a reconnection (which changes the port but keeps the upper-layer connection alive) by writing to the FIFO:

    echo reconnect > /path/to/your/fifo.file

    Note: This command currently has no effect on the Server side.