FakeTCP functionality?

[iopq]

Hysteria 1 had FakeTCP which prevented UDP blocks. No current software has support for this, so my UDP connections get dropped after after an hour. Could this be implemented in xray?

[iopq]

The design is as follows:

The packets to the server will look like syn/ack and so forth to establish it, and it will appear like a TCP connection over SSL - exactly like connecting to a normal website. But actually it's transmitting UDP packets out of order as the payload.

All of the middleboxes will see it as TCP connections to some website while you're playing some p2p game over UDP or having some kind of a call

[sagilith]

As a temporary solution, you can take a look to udp2raw, it can turn udp traffic to fake tcp, identically as hysteria does. It can bypass blocking udp via firewall, but the only problem lies if your ISP tends to block raw sockets (for example, via deep packet inspection in case of Russia)

Adding this functionality directly into xray core would be still better, so I think that's a good idea

[iopq]

I am actually going to go install udp2raw as you suggested, but it presents a lot of extra challenges since I already use a GUI. If I'm just running a random program it needs to be carefully routed so I don't make a loop, I need to make sure I have full cone NAT, etc.

Xray basically already works, except for, you know, getting disconnected when there's UDP traffic. I would love to be able to just use the same web panel and GUI and flip some switches to use FakeTCP for the UDP connections

[sagilith]

I guess it would be good to turn this discussion into an issue, since it's an important feature

As far as I know, Russian government is developing a system for blocking voice calls in messangers. For sure, it will be just a DPI extension that completely disables UDP frames.
Since Russia allies with China in terms of having these experiments, I've got an idea that they have target of mainly blocking VPNs (most of vpn protocols use udp). Thus, DPI tends to block the traffic is had failed to determine for some ISPs
It won't be very good if those 2 things will combine - deep packet inspection will be able to block every VPN that doesn't mask it's traffic. Lots of people still would want to use UDP because of it's speed, so FakeTCP is an important feature

[iopq]

As a temporary solution, you can take a look to udp2raw, it can turn udp traffic to fake tcp

So I was able to tunnel wireguard through udp2raw and obfuscate it, but the issue is it looks like random encrypted traffic to the GFW, which leads you to getting a 3 minute block after you use the connection long enough

I basically replicated Hysteria 1 which is fake TCP fully encrypted traffic

Is there a way to actually do it with Reality? I will try to set it to use h3, which will make it UDP, but coming out it will go through phantun (a light version of udp2raw with no obfuscation or encryption), go to the server as fake TCP, get converted on the server back to UDP/h3

[iopq]

#4452

So I show that I need to do

xray 7443 -> udpspeeder 6443 -> udp2raw 443 -> | udp2raw 6443 -> udpspeeder 7443 -> nginx 8443 -> xray

This set-up works, but it needs to use TLS instead of Reality because QUIC is not supported (can be detected by connection migration):

#1903

so save for the feature being implemented in xray, it can't be done in an ideal way which would be something like

tpoxy -> xray REALITY FakeTCP with FEC | xray server

which is to say for optimal UDP performance xray would transmit UDP packets out of order with no retransmission, but use FEC settings to actually increase the bandwidth to lower packet loss

but to an outside observer it would just look like encrypted TCP traffic on port 443 coming from a legitimate website (because REALITY will still be working)