This repository is a DPI bypass toolkit that intercepts and manipulates network packets to evade Deep Packet Inspection systems. It uses a modular architecture with a core daemon (nfqws2/dvtws2/winws2) that processes packets via NFQUEUE (Linux), divert sockets (*BSD), or WinDivert (Windows/Cygwin). Packet manipulation logic is implemented in Lua scripts, allowing flexible obfuscation strategies like packet splitting, reordering, and fake packet generation. The system includes automatic IP/host list management from external sources (antizapret, reestr), connection tracking for flow state, and cross-platform service integration. Key entry points are the main daemon, installation scripts, and list management utilities. Data flow involves packet interception → dissection → profile-based Lua processing → verdict (PASS/MODIFY/DROP) → reinjection. External dependencies include kernel interfaces (netfilter/WinDivert), Lua, zlib, and shell utilities for list updates.
nfqws-keenetic is a distribution and packaging repository that delivers the `nfqws` DPI-bypass utility (from the zapret project) as installable packages for embedded routers — primarily Zyxel Keenetic/Netcraze devices running Entware, plus OpenWRT. In production it functions as a service installer: post-install scripts detect the WAN interface and IPv6 availability, write a tuned nfqws.conf, install the correct architecture-specific nfqws binary, and register an init script that programs iptables/ip6tables POSTROUTING NFQUEUE rules for TCP/QUIC/UDP ports and manages the daemon lifecycle. The traffic-modifying logic itself lives in the upstream nfqws binary; this repo is the glue: packaging, configuration, firewall orchestration, and domain/IP lists (user.list, auto.list, exclude.list, ipset lists) for targeted DPI evasion. Architecturally it is a Makefile-driven build system (packages.mk, repository.mk) that downloads the latest zapret release binaries from GitHub at build time, cross-packages them into per-arch .ipk files (mipsel, mips, aarch64, and a multi-arch 'all' variant), and assembles an opkg/apk repository published to GitHub Pages via a GitHub Actions pipeline. The service layer is split into reusable POSIX-shell fragments: etc/init.d/common holds idempotent firewall rule management, kernel-module autoloading, runtime config generation, and validation; thin platform wrappers adapt it to Entware (S51nfqws) and OpenWRT (procd). A Keenetic netfilter hook (etc/ndm/netfilter.d/100-nfqws.sh) re-applies firewall rules whenever NDM regenerates them. Important maintenance truth: the README explicitly states the project no longer receives updates and all new features will appear in nfqws2-keenetic; this repo is the legacy v1 line (tag v2.11.4). An agent searching for an actively developed solution should evaluate the successor first, but the code that exists is well-crafted for its niche — config-versioned package migrations, layered architecture auto-detection in a single multi-arch package, and careful iptables rule idempotency. Technical drift is moderate: the release workflow relies on deprecated GitHub Actions (create-release v1, upload-release-asset v1), while the shell and packaging code targets stable router interfaces.