1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
## NAME
dpibreak - simple and efficient DPI circumvention tool in Rust.
## SYNOPSIS
**dpibreak** \[*OPTIONS*\]
## DESCRIPTION
**DPIBreak** is a simple and efficient tool for circumventing Deep
Packet Inspection (DPI), especially on HTTPS connections. It fragments
the TCP packet carrying the TLS ClientHello so that certain DPI devices
cannot extract the Server Name Indication (SNI) field and identify the
destination site.
It only applies to the first outbound segment that carries the TLS
ClientHello; Other packets are not queued to userspace and pass through
the kernel normally, unmodified. UDP/QUIC (HTTP/3) is not affected.
This program is cross-platform and runs the same way on both Linux and
Windows. No manual firewall configuration is required: starting the
program enables it system-wide; stopping it disables it.
## REQUIREMENTS
**Linux**
Root privileges (or capabilities **CAP_NET_ADMIN** and **CAP_NET_RAW**)
are required to install rules and attach to NFQUEUE. The **nft** command
should be available. If it is not, **dpibreak** try to fallback
**iptables** and **ip6tables.** Kernel support for **nfnetlink_queue**
and **xt_u32** (when **nft** is not available) is required. (these
modules are typically auto-loaded)
<!-- -->
**Windows**
Administrator privilege is required to open the WinDivert driver; the
program opens the driver automatically at startup.
## OPTIONS
**-D**, **--daemon**
Run as a background daemon. Logs are written to **/tmp/dpibreak.log.**
If a daemon is already running, it will fail with "unable to lock pid
file". To stop it, run **kill \`cat /tmp/dpibreak.pid\`** as root.
On Windows, this option enters the service controller entry point.
Example: **sc create dpibreak binPath= "dpibreak.exe -D" start= auto; sc
start dpibreak**
**--delay-ms *\<u64\>***
Delay in milliseconds to apply between fragmented pieces of the
ClientHello. Typical values are 0–1000; larger values may increase
handshake latency. (Default: 0)
**--fake**
Enable **fake** ClientHello packet injection before sending each packet
fragmented. TCP/IP header fields follow the original packet unless you
override it using the **--fake-\*** options described below. Packets are
transmitted in an interleaved order: (fake 1), (orig 1), (fake 2), (orig
2), ...
**--fake-ttl *\<u8\>***
Override ttl (IPv4) / hop_limit (IPv6) of **fake** packet. Implicitly
enables **--fake**. (Default: 8)
**--fake-autottl**
Automatically infer the hop count (TTL/Hop Limit) to the destination by
analyzing the SYN/ACK packet. It assumes the server's initial TTL is
either 64, 128, or 255. The inferred value is used for **fake** packet
transmission to ensure they reach the censor but not the destination. By
default, it uses a delta of 1. If the hop count cannot be determined, it
falls back to the value specified by **--fake-ttl**. Implicitly enables
**--fake**.
**--fake-badsum**
Corrupts the TCP checksum of **fake** packets. When enabled, **fake**
packets cannot pass through most routers and will not behave as
expected. It can be useful if your router/firewall provides an option to
disable TCP checksum verification. Implicitly enables **--fake**.
**--queue-num *\<u16\>***
NFQUEUE number to attach to. The same queue number is used for IPv4 and
IPv6. (Default: 1)
**--nft-command *\<string\>***
Custom nftables command to be executed. (Default: nft)
**--log-level *\<debug\|info\|warning\|error\>***
Set the logging level (Default: warning). Aliases: **warn** -\>
**warning**, **err** -\> **error**.
**--no-splash**
Disable splash messages at startup.
**-h**, **--help**
Show usage information and exit.
## EXAMPLES
Run with default options:
> **dpibreak**
Run as daemon with **fake** feature:
> **dpibreak -D --fake-autottl**
Run with a 10 ms delay and verbose logging:
> **dpibreak --delay-ms 10 --loglevel debug**
Use a custom NFQUEUE on Linux:
> **dpibreak --queue-num 3**
Run with **fake** feature:
> **dpibreak --fake-autottl**
## BUGS
Although the program works reliably in the author's region and ISP,
different regions, ISPs, or organizations may deploy different DPI
equipment. In such cases, there is a chance that **dpibreak** does not
function as expected. If you encounter such issue, please report
symptoms and, if possible, packet capture logs (e.g., collected with
Wireshark) or hints such as cases where alternative tools like
GoodByeDPI succeed with specific settings to the bug tracker listed
below.
When sharing packet capture logs, please make sure they do not contain
sensitive personal information (e.g., passwords or session cookies). It
is usually enough to capture only the initial handshake packets showing
the issue, rather than full sessions.
Any other problems not covered above are also appreciated.
Report bugs at \<https://github.com/dilluti0n/dpibreak/issues\>.
## SECURITY AND PRIVACY
The program does not store or transmit your traffic. Fragmentation is
performed locally on the host; no external proxy or relay is used.
## EXIT STATUS
Normally, **dpibreak** runs continuously until interrupted by the user
(e.g. with Ctrl+c) or the system. In such cases it exits with status 0.
Non-zero exit codes are returned if the program fails to start (for
example, due to insufficient privileges, missing iptables/WinDivert, or
invalid options).
## SEE ALSO
**nft**(8), **iptables**(8), **ip6tables**(8), **tcpdump**(1),
**wireshark**(1)
GoodByeDPI \<https://github.com/ValdikSS/GoodbyeDPI\>
## AUTHOR
Written by Dilluti0n \<[email protected]\>.
|
