spoofdpi is a cross-platform proxy tool that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes. It operates in three modes: HTTP proxy, SOCKS5 proxy, or TUN interface (transparent proxy). In production, it intercepts outgoing connections, reads the TLS ClientHello, splits it into segments using configurable strategies (SNI-split, random, chunk, first-byte, or custom plans), optionally sends fake packets before the real data, and may disorder segments by manipulating the TTL field so that DPI middleboxes misparse the connection while the destination server reassembles it correctly. It also includes a built-in DNS resolver with UDP, HTTPS (DoH), and system backends, and a rule system for per-domain/per-IP configuration. The architecture is a single Go binary with modular internal packages: config (TOML+CLI loading), desync (TLS/UDP desynchronization), dns (multi-backend resolver), netutil (connection management, dialing, TTL setting), packet (raw packet capture/injection via pcap or Linux raw sockets), proto (HTTP, SOCKS5, TLS parsing), rule (domain and CIDR matching), server (HTTP, SOCKS5, TUN server implementations), session (context-based tracing), trie (generic trie structures), cache (sharded LRU and TTL caches), and logging (zerolog-based structured logging). The TUI mode uses bubbletea for a terminal interface showing real-time speed and logs. Key entry points are cmd/spoofdpi/main.go (main function) which parses CLI flags, loads configuration, and starts the selected server. External dependencies include gopacket for packet manipulation, wireguard-tun for TUN device support, gvisor for TCP/IP stack in TUN mode, and various Go packages for CLI, TOML, DNS, and logging. The code is well-structured with extensive use of interfaces, generics, and concurrency primitives (context, channels, goroutines).
GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship by fragmenting the TLS ClientHello so the SNI never appears whole in a single packet, and by resolving DNS over encrypted channels (DoH/DoT). It is a ground-up TypeScript rewrite of the original GreenTunnel, fixing numerous bugs from v2 (backpressure, timeouts, HTTP framing corruption, DNS cache expiry, system proxy crash safety). The repository is a monorepo containing a core engine library, a CLI tool (`gt`), and an Electron desktop app. The engine implements a full HTTP/HTTPS proxy with TLS fragmentation, HTTP request rewriting (absolute-form to origin-form), a caching DNS resolver with TTL-based expiration and in-flight deduplication, and a system-proxy management layer with snapshot/restore and crash recovery. The desktop app provides a 340px frameless window with a live log panel (virtual list), tray integration, and non-intrusive advocacy prompts. The codebase is exceptionally well-documented (CLAUDE.md serves as the authoritative design document), uses modern Node.js features (parseArgs, styleText, pipeline), and has a strong emphasis on correctness and edge-case handling (e.g., stranded proxy detection, HTTP framing awareness, signal handling for clean shutdown).
This repository is a DPI bypass toolkit that intercepts and manipulates network packets to evade Deep Packet Inspection systems. It uses a modular architecture with a core daemon (nfqws2/dvtws2/winws2) that processes packets via NFQUEUE (Linux), divert sockets (*BSD), or WinDivert (Windows/Cygwin). Packet manipulation logic is implemented in Lua scripts, allowing flexible obfuscation strategies like packet splitting, reordering, and fake packet generation. The system includes automatic IP/host list management from external sources (antizapret, reestr), connection tracking for flow state, and cross-platform service integration. Key entry points are the main daemon, installation scripts, and list management utilities. Data flow involves packet interception → dissection → profile-based Lua processing → verdict (PASS/MODIFY/DROP) → reinjection. External dependencies include kernel interfaces (netfilter/WinDivert), Lua, zlib, and shell utilities for list updates.
nfqws-keenetic is a distribution and packaging repository that delivers the `nfqws` DPI-bypass utility (from the zapret project) as installable packages for embedded routers — primarily Zyxel Keenetic/Netcraze devices running Entware, plus OpenWRT. In production it functions as a service installer: post-install scripts detect the WAN interface and IPv6 availability, write a tuned nfqws.conf, install the correct architecture-specific nfqws binary, and register an init script that programs iptables/ip6tables POSTROUTING NFQUEUE rules for TCP/QUIC/UDP ports and manages the daemon lifecycle. The traffic-modifying logic itself lives in the upstream nfqws binary; this repo is the glue: packaging, configuration, firewall orchestration, and domain/IP lists (user.list, auto.list, exclude.list, ipset lists) for targeted DPI evasion. Architecturally it is a Makefile-driven build system (packages.mk, repository.mk) that downloads the latest zapret release binaries from GitHub at build time, cross-packages them into per-arch .ipk files (mipsel, mips, aarch64, and a multi-arch 'all' variant), and assembles an opkg/apk repository published to GitHub Pages via a GitHub Actions pipeline. The service layer is split into reusable POSIX-shell fragments: etc/init.d/common holds idempotent firewall rule management, kernel-module autoloading, runtime config generation, and validation; thin platform wrappers adapt it to Entware (S51nfqws) and OpenWRT (procd). A Keenetic netfilter hook (etc/ndm/netfilter.d/100-nfqws.sh) re-applies firewall rules whenever NDM regenerates them. Important maintenance truth: the README explicitly states the project no longer receives updates and all new features will appear in nfqws2-keenetic; this repo is the legacy v1 line (tag v2.11.4). An agent searching for an actively developed solution should evaluate the successor first, but the code that exists is well-crafted for its niche — config-versioned package migrations, layered architecture auto-detection in a single multi-arch package, and careful iptables rule idempotency. Technical drift is moderate: the release workflow relies on deprecated GitHub Actions (create-release v1, upload-release-asset v1), while the shell and packaging code targets stable router interfaces.
This repository provides a Windows-based tool for bypassing Deep Packet Inspection (DPI) blocking of services like Discord, YouTube, and others. It is primarily a collection of Batch scripts that launch the zapret utility (winws.exe) with various parameter combinations (called 'strategies') to evade network censorship. A service manager script (service.bat) allows installing/uninstalling the bypass as a Windows service, toggling game/ipset filters, updating host files, and running diagnostics. The repository also includes a PowerShell-based test harness that can systematically evaluate different strategies against a set of targets and record results. The core technical mechanism relies on WinDivert, a kernel-level packet interception driver. The project is heavily configurable and aimed at end-users in regions with internet restrictions, and it does not contain application code in a traditional sense—it wraps existing binaries with configuration logic.