New update in GFW #2102

itsamirhn · 2022-10-25T04:10:02Z

itsamirhn
Oct 25, 2022

As you may knew, the Great Firewall rolled out an update that blocks TLS-based circumvention tools, such as trojan, Xray, V2Ray...
More detail;
https://www.top10vpn.com/best-vpn/china/

I was wondering how we are going to bypass censorship if GFW completely blocks this service?

Is there any solution to avoid this blocking?

Or other than v2ray, Is there any undetectable protocol that we can use?

kingwilliam · 2022-10-25T07:16:41Z

kingwilliam
Oct 25, 2022

please calm down, until now I still using v2fly for daily and work perfectly.

My config:

1st client(v2fly vless+tls+grpc) server(haproxy+v2fly) self sign certificate
2nd client(gost tls+grpc) server(haproxy+gost) self sign certificate
final backup client(gost ss+tcp+shadow-tls) server(haproxy+shadow-tls+gost)

ALL still work fine

1 reply

itsamirhn Oct 25, 2022
Author

Would you please give a tutorial for setting up your "final backup" solution?
It's ok to be in Chinese language.

kingwilliam · 2022-10-25T22:37:31Z

kingwilliam
Oct 25, 2022

建议先了解 shadow-tls 是什麽和如何工作

concept

client
gost/v2 -(ss+tcp)-> shadow-tls

server
shadow-tls -> gost/v2

client

gost -L :8080 -F ss://AEAD_CHACHA20_POLY1305:[email protected]:8001

shadowtls client --listen :8001 --password stls-456789 --server {IP/Domain}:443 --sni {伪装domain}

server

shadowtls server --listen :443 --password stls-456789 --server 127.0.0.1:8002 --tls {伪装domain}:443

gost -L ss://AEAD_CHACHA20_POLY1305:[email protected]:8002

gost/v2 也可以连接shadow-tls

关於shadow-tls问题, 可看看以下连结
报告: 中间盒如何识别代理流量

补充:
以上方式也不是绝对安全, 只可算是最后一根救命草. 在墙下,没有一个科学上网是绝对安全和不能被探测. 我们一般网民只能尽量避免给墙钉上. 至于如何不被钉上只能八仙过海各显神通.

最後
顺道说句, 什麽是精准识别? openvpn 就是精准识别的好例子.
今天的情况只算是提高识别率而已

2 replies

seakfind Nov 5, 2022

@kingwilliam Would you mind sharing the haproxy configuration?

cxjava Feb 2, 2023

这个客户端和服务端的配置，用go-gost/gost 和 ginuerzh/gost ，shadow-tls 0.2.8 都不行。不知道楼主怎么成功的

kingwilliam · 2022-11-06T01:14:52Z

kingwilliam
Nov 6, 2022

I highly recommend visit XTLS Vision, TLS in TLS, to the star and beyond #1295 first. To know what is "TLS over TLS" in Today, and why grpc can SURVIVE at this moment(just only more a little bit).

remarks:
0. *** ONLY FOR REFERENCE ***

i use ..... to hidden common command
in "frontend in-path_filter" ca-file CA_crt.pem verify optional, need client cert to access v2_gost server.

2a if without client cert, only to default-web-server
2b so, mobile may be not accepted on this config

global
        .....
        .....
        .....
        maxconn 5120
        tune.ssl.default-dh-param 2048
        tune.h2.initial-window-size 10485760

        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets

        ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets


defaults
        log     global
        mode    tcp
        option  tcplog
        option  tcp-smart-accept
        option  tcp-smart-connect
        option  dontlognull
        http-reuse always
        timeout http-request 5s
        timeout connect 5s
        timeout client  5m
        timeout server  5m
        timeout tunnel  1h
        .....
        .....
        .....


frontend in-00
    bind *:443 alpn h2 allow-0rtt
    acl v2_gost_tls    req.ssl_sni -i www.v2_gost.com
    acl shadow_tls     req.ssl_sni -i www.microsoft.com

    tcp-request inspect-delay 5s
    tcp-request content reject if !{ req_ssl_hello_type 1 }
    tcp-request content reject if !v2_gost_tls !shadow_tls

    use_backend bkend_v2_gost_tls     if v2_gost_tls
    use_backend bkend_shadow_tls      if shadow_tls



backend bkend_v2_gost_tls
    server svr_v2_gost abns@path_filter.sock send-proxy-v2

backend bkend_shadow_tls
    server svr_shadow 127.0.0.1:8001




frontend in-path_filter
    bind abns@path_filter.sock ssl crt www.v2_gost.com.pem ca-file CA_crt.pem verify optional accept-proxy alpn h2 allow-0rtt

    acl chk-02_h2 ssl_fc_alpn -i h2
    acl chk-02_ccrt  ssl_fc_has_crt

    acl grpc-01a path  -m str /gost-gRPC/tunnel
    acl grpc-01b path  -m str /v2-vl-gRPC/Tun

    use_backend bkend_go-h2-01    if grpc-01a chk-02_h2 chk-02_ccrt
    use_backend bkend_v2-grpc-01  if grpc-01b chk-02_h2 chk-02_ccrt

    default_backend default-web-server


backend bkend_go-h2-01
    mode http
    server svr_go-h2-01 127.0.0.1:11112 proto h2


backend bkend_v2-grpc-01
    mode http
    server svr_v2_h2-01 127.0.0.1:11102 proto h2





backend default-web-server
    mode http
    server svr_local-99 127.0.0.1:8000