توجه

بعد از تغییرات جدید سامانه سانسور جاعش که در پی هلاکت ضحاک رخ داد ، این متد نیز به فیض شهادت رسید. لذا اگر تنظیمات دیفالت نتوانست اتصال را به سرور برقرار کند بیش از حد درگیر نشوید. نسخه lite experiment میتواند نشان دهد که پکت ارسالی به مقصد میرسد یا خیر. همچنین نسخه go binary با تنظیمات دیفالت باید به راحتی وصل شود و اگر نشد باید نت را با ساقط کردن حکومت اشغالگر باز کرد.

NEW: Go binary released

I recommend to use Go version :

• https://github.com/GFW-knocker/gfw_resist_tcp_proxy/tree/main/go%20implementation

Download stable binary (GO version) from here :

• https://github.com/GFW-knocker/gfw_resist_tcp_proxy/releases/latest/

one-line install on vps:

bash <(curl -fsSL 'https://raw.githubusercontent.com/GFW-knocker/gfw_resist_tcp_proxy/main/go%20implementation/scripts/gfk.sh') install

توجه

این متد اتصال، در قطعی اینترنت ناشی از سرکوب خونین مردم در دیماه 1404 کاملا جواب میداد. اما نیاز به خط اینترنت ثابت و دسترسی روت هم در vps و هم در pc دارد. ( در نت موبایل ، 4g ، td-lte و دانگل و هات اسپات و امثالهم جواب نمیدهد چون نیازمند ارسال پکت نامتعارف به شبکه است اما در خطوط ثابت و مودم های adsl استاندارد و همچنین سرور ایران که نت پهن باند دارند قابل استفاده است )

پیاده سازی این پروژه با گو : (https://github.com/GFW-knocker/gfw_resist_tcp_proxy/tree/main/go%20implementation)

نمونه دیگری پیاده شده با زبان گو : (https://github.com/hanselime/paqet)

اسکریپت نصب راحت نسخه پایتون : (https://github.com/SamNet-dev/paqctl)

gfw_resist_tcp_proxy

knock up GFW IP blockage

goodbye IP filtering & goodbye GFW mf'er

main Idea -> TCP violation:

• GFW needs to check every packet against large list of filtered ip in order to drop them
  
• since its not practical in huge traffic, they separate tcp handshake (SYN) and check them only.
  
• in fact, they only drop SYN packet with blocked ip in both direction.
• so we can bypass ip filtering by building communication link without tcp handshake.
  
  

how important is it?

• it bypass ip blockage, so it bypass principal core of filtering
• it change the paradigm of anti-censorship from "hiding traffic" / "escaping blockage" to "drilling whatever blocked"
• what more can a censorman do after detecting a VPN, beside blocking ip?
• similar to fragment that bypass filtered Domain/SNI , it operate at the lower network layer
• no matter which protocol used at upper level, it can drill everything, even blocked port

can GFW block tcp violation method?

• this method is not based on a bug nor a protocol at application layer
• it operate on lowest possible layer of network (transport and ip layer)
• need lots of dedicated Hardware to fight with (not achievable in software)
• we use TCP ACK/PUSH packets which is 100000X more frequent than SYN
• they have large list of blocked ip that want to drop
• they simply cant hold & check every single packet in high speed traffic. (unless with millions of dollar HW investment)

how to run

• need a VPS
• need root/admin access in both client & server to modify/send/sniff crafted packet
• we implement method1 : a prototype for proof-of-concept that can run on both windows & linux
• its not ready for production yet but we plan to build stable and standalone version in near future

what is Next?

• next step is to implement on xray-core
• thus anyone can easily create a "tcp violation" config and revive blocked vps ip