Dialerproxy and Fragment

[Ahmad-2213]

Hello there!
I'm struggling with a problem where in android , when i set fragment to tlshello and interval 0 , it works, however, on pc it just works if only i set to packet 1-1 and the size must not be over 4 and the interval is also 0
so I thought to use dialerproxy and try to chain tlshello and packet 1-1 , so both will be fragmented and my config would be unified.
but the problem came when i saw dialerproxy won't forward fragmented packets to frag1-1.
please help me figure this out.

the routing is set to fragtls.
on android, using packet 1-1 would not work.

{
"tag": "fragtls",
"protocol": "freedom",
"settings": {
"streamSettings": {
"sockopt": {
"dialerProxy": "frag1-1"
}
},
"fragment": {
"packets": "tlshello",
"length": "2",
"interval": "0"
}
}
},
{
"tag": "frag1-1",
"protocol": "freedom",
"settings": {
"redirect": "myserver:0",
"domainStrategy": "ForceIP",
"fragment": {
"packets": "1-1",
"length": "1",
"interval": "0"
}
}
}

[Ahmad-2213]

@patterniha
do you think there's a bug in dialerproxy?

[patterniha]

the tlshello-fragment(fragtls) length must be at least 6.(you set 2)
the tcp-fragment(frag1-1) interval must be at least 1.(you set 0)

[Ahmad-2213]

@patterniha
seems not working again.

{
"tag": "fragtls",
"protocol": "freedom",
"settings": {

   "streamSettings": {
    "sockopt": {
      "dialerProxy": "frag1-1"
    }
  },
    
    "fragment":{
      "packets": "tlshello",
      "length": "6",
      "interval": "0"
    }
  }
},
 {
  "tag": "frag1-1",
  "protocol": "freedom",
  "settings": {
   "redirect": "myserver.com:0",
    "domainStrategy": "forceip",
    "fragment": {
      "packets": "1-1",
      "length": "4",
      "interval": "1"
    }
  }
}

[patterniha]

کامل رو بفرست

[Ahmad-2213]

{
"log": {
"loglevel": "debug",
"dnsLog": true,
"access": "none"
},
"dns": {
"hosts": {

},
"servers": [
  "8.8.4.4"
  
],

"disableCache": true,
"disableFallback": true,
"tag": "dns_query"

},
"inbounds": [
{
"tag": "dns-in",
"port": 10853,
"protocol": "dokodemo-door",
"settings": {
"address": "127.0.0.1",
"port": 5300,
"network": "tcp,udp"
}
},
{
"tag": "socks-in",
"port": 10808,
"protocol": "socks",
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls",
"quic"
],
"routeOnly": false
},
"settings": {
"udp": true
}
}
],
"outbounds": [
{
"tag": "ws",
"protocol": "vless",
"settings": {
"vnext": [
{
"address": "ip",
"port": 443,
"users": [
{
"id": "uuid",
"email": "[email protected]",
"security": "auto",
"level": 1,
"encryption": "none"
}
]
}
]
},
"streamSettings": {
"network": "ws",
"security": "tls",
"tlsSettings": {
"allowInsecure": true,
"serverName": "hostad20.workers.dev",
"alpn": [
"h3"
],
"fingerprint": ""
},
"wsSettings": {
"path": "/ws/",
"host": "hostad20.workers.dev"
}
}
},
{
"tag": "direct",
"protocol": "freedom",
"settings": {
"domainStrategy": "ForceIP"
}
},

{
  "tag": "dns-out",
  "protocol": "dns",
  "settings": {
    "nonIPQuery": "skip",
    "network": "tcp",
    "address": "8.8.4.4",
    "port": 53
  },
  "streamSettings": {
    "sockopt": {
      "dialerProxy": "fragtls"
    }
  }
},
{
  "tag": "fragtls",
  "protocol": "freedom",
  "settings": {
   
   "streamSettings": {
    "sockopt": {
      "dialerProxy": "frag1-1"
    }
  },
    
    "fragment":{
      "packets": "tlshello",
      "length": "6",
      "interval": "0"
    }
  }
},
 {
  "tag": "frag1-1",
  "protocol": "freedom",
  "settings": {
   "redirect": "myserver:0",
    "domainStrategy": "forceip",
    "fragment": {
      "packets": "1-1",
      "length": "4",
      "interval": "1"
    }
  }
}

],

"routing": {
"domainStrategy": "IPifnonmatch",
"rules": [
{
"outboundTag": "dns-out",
"inboundTag": [
"dns-in"
]
},
{
"outboundTag": "dns-out",
"inboundTag": [
"socks-in"
],
"port": 53
},

  {
    "outboundTag": "direct",
     "domains": [
      "domain:ir",
      "domain:ttvnw.net",
      "domain:aparat.com",
      "domain:telewebion.com",
      "domain:namasha.com",
      "domain:varzesh3.com",
      "domain:tsetmc.com",
      "domain:speedtest.net",
      "domain:emofid.com",
      "domain:mofidonline.com"
    ]
  },
  {
    "outboundTag": "direct",
    "ip": [
      "192.168.1.1"
    ]
  },
  {
    "outboundTag": "direct",
    "port": "49152-65535"
  },
  {
    "outboundTag": "ws",
    "ip": [
     "0.0.0.0/0"
    ]
  },
  {
    "outboundTag": "fragtls",
    "network": "tcp,udp"
  }
]

}

}

@patterniha

[Ahmad-2213]

The configuration main logic is as follows:
ips must go through proxy.
the rest will be redirected to myserver:0
now, on pc, i have to tcp slice in order to work and the tcp slice (packet 1-1 ) size must not be over 4 , if it goes over 4 , then Discord Desktop won't work ,but sites will open normally and no interval is needed.
which means on pc the configuration below works:
"fragment": {
"packets": "1-1",
"length": "1-4",
"interval": "0"
}

tlshello does not work at any condition On PC.
and for android it's vice versa
tlshello works without interval.
for Android, two configs work, the first;
"fragment": {
"packets": "tlshello",
"length": "1",
"interval": "0"
}

the second:
"fragment": {
"packets": "1-1",
"length": "1",
"interval": "2"
}

and the first is the most efficient and has incredibly no delay compared to second one. (obviously)

[patterniha]

"redirect": "myserver:0" ???

این چیه دیگه؟

[Ahmad-2213]

یه سروره که دامنه ها بهش redirect میشن.
آی‌پی سرور رو نذاشتم.

[Ahmad-2213]

@patterniha
https://xtls.github.io/config/outbounds/freedom.html#outboundconfigurationobject

[Ahmad-2213]

اگر مشکل همینه میشه برداشتش؛ ولی مشکل از این نیست.
کلا مکانیزم منطقا باید اینجوری باشه که اول از روتینگ دامنه ها میرن سمت fragtls ، بعد از اونجا tlshello فرگمنت میشه و فرستاده میشه به frag1-1 و از اونجا فرستاده میشه بیرون.
اما الان اینجور نیست.
به fragtls میرسه درجا میفرسته بره.
الان به فرض من اگر redirect رو بذارم tlsfrag ، کانفیگ برای گوشی درست میشه ولی همچنان برای PC جواب نمیده.

[patterniha]

خلاصه هدفت رو متوجه نشدم. باید با vless ی چیزی وصل شی به سرورت، سرور از کجا بفهمه به کجا باید وصل شه بعدش، مخصوصا وقتی فرگمنت هم بشه sniffing هم سمت سرور کار نمیکنه دیگه

[Ahmad-2213]

@patterniha
سرور وقتی ریکوئست میرسه بهش چون نمیدونه میاد جست و جو میکنه اون چیزی که به دستش رسیده رو.
مکانیزم پروکسی آی‌پی توی کد وب سوکت کلادفلر همین کار رو انجام میده. یه تی‌سی‌پی میزنه به سرور هدف و دامنه رو میفرسته براش.
سرور چون نمیدونه این پکت رو چیکار کنه میاد و محتوا رو ریزالو میکنه و برمیگردونه به کلاینت.
ما بحثمون چیز دیگری هست، اینکه روی یه سری تنظیمات خاص داره کار میده برای گوشی و همون تنظیمات روی کامپیوتر جواب نمیدن.

[Ahmad-2213]

حالا توی این کد که دادم ما چیکار میکنیم؟
یه کانکشن مستقیم میزنیم به سرور و سرور خودش هندل میکنه.
ولی یه مشکل هست و اونم فایرواله.
چون فایروال توی این کانکشن مستقیم متوجه دامنه های فیلتر شده میشه؛ بنابراین ما حتما به fragment نیاز داریم.

[Ahmad-2213]

Found a way.
Thanks.