Autore Topic: Udp2raw-tunnel - A UDP Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket [Bypass UDP FireWalls]  (Letto 122 volte)

0 Utenti e 1 Visitatore stanno visualizzando questo topic.

Offline Flavio58

Advertisement
Udp2raw-tunnel - A UDP Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket [Bypass UDP FireWalls]


A UDP Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket, helps you Bypass UDP FireWalls (or Unstable UDP Environment). Its Encrypted, Anti-Replay and Multiplexed.It also acts as a Connection Stabilizer.

Support Platforms
A Linux host (including desktop Linux, Android phone/tablet, OpenWRT router, or Raspberry PI) with root access.
For Winodws/MacOS, a virtual image with udp2raw pre-installed has been released, you can load it with Vmware/VirtualBox.The virtual image has been set to auto obtain ip, udp2raw can be run immediately after boot finished(make sure network mode of virtual machine has been set to bridged)(only udp2raw has to be run under a virtual machine, all other programs run under Windows/MacOS as usual).

Features

Send / Receive UDP Packet with fake-tcp/icmp headers
Fake-tcp/icmp headers help you bypass UDP blocking, UDP QOS or improper UDP NAT behavior on some ISPs. Raw packets with UDP headers are also supported.In UDP header mode, it behaves just like a normal UDP tunnel, and you can just make use of the other features.

Simulate TCP Handshake
Simulates the 3-way handshake, along with seq and ack_seq. TCP options MSS, sackOk, TS, TS_ack, wscale are also simulated. Real-time delivery guaranteed, no TCP over TCP problem when using OpenVPN.

Encryption, Anti-Replay, No MITM
  • Encrypt your traffic with AES-128-CBC.
  • Protect data integrity by MD5 or CRC32.
  • Defense replay attack with an anti-replay window, similar to IPSec and OpenVPN.
  • Authenticate mutually, no MITM attacks.

Failure Detection & Stabilization (Connection Recovery)
Connection failures are detected by heartbeats. If timed-out, the client will automatically change port number and reconnect. If reconnection is successful, the previous connection will be recovered, and all existing UDP conversations will stay valid.
For example, if you use UDP2RAW + OpenVPN, OpenVPN won't lose connection after any reconnect, even if the network cable is re-plugged or the WiFi access point is changed.

Other Features
  •   Multiplexing One client can handle multiple UDP connections, all of which share the same raw connection.
     
  •   Multiple Clients One server can have multiple clients.
     
  •   NAT Support All of the 3 modes work in NAT environments.
     
  •   OpenVZ Support Tested on BandwagonHost.
     
  •   OpenWRT Support No dependencies, easy to build. Binary for ar71xx are included in release.
     

Keywords
UDP QoS Bypass UDP Blocking Bypass OpenVPN TCP over TCP problem OpenVPN over ICMP UDP to ICMP tunnel UDP to TCP tunnel UDP over ICMP UDP over TCP

Getting Started

Installing
Download binary release from https://github.com/wangyu-/udp2raw-tunnel/releases

Running
Assume your UDP is blocked or being QOS-ed or just poorly supported. Assume your server ip is 44.55.66.77, you have a service listening on udp port 7777.
# Run at server side:
./udp2raw_amd64 -s -l0.0.0.0:4096 -r 127.0.0.1:7777  -a -k "passwd" --raw-mode faketcp

# Run at client side
./udp2raw_amd64 -c -l0.0.0.0:3333  -r44.55.66.77:4096 -a -k "passwd" --raw-mode faketcp

Server Output:


Client Output:



Now, an encrypted raw tunnel has been established between client and server through TCP port 4096. Connecting to UDP port 3333 at the client side is equivalent to connecting to port 7777 at the server side. No UDP traffic will be exposed.

Note
to run on Android, see Android_Guide

Advanced Topic

Usage
udp2raw-tunnel
version: Aug 18 2017 00:29:11
repository: https://github.com/wangyu-/udp2raw-tunnel

usage:
    run as client : ./this_program -c -l local_listen_ip:local_port -r server_ip:server_port  [options]
    run as server : ./this_program -s -l server_listen_ip:server_port -r remote_ip:remote_port  [options]

common options, these options must be same on both side:
    --raw-mode            <string>        avaliable values:faketcp(default), udp, icmp
    -k, --key              <string>        password to gen symetric key, default:"secret key"
    --cipher-mode         <string>        avaliable values:aes128cbc(default), xor, none
    --auth-mode           <string>        avaliable values:md5(default), crc32, simple, none
    -a, --auto-rule                        auto add (and delete) iptables rule
    -g, --gen-rule                         generate iptables rule then exit
    --disable-anti-replay                 disable anti-replay, not suggested
client options:
    --source-ip           <ip>            force source-ip for raw socket
    --source-port         <port>          force source-port for raw socket, tcp/udp only
                                          this option disables port changing while re-connecting
other options:
    --log-level           <number>        0:never    1:fatal   2:error   3:warn
                                          4:info (default)     5:debug   6:trace
    --log-position                        enable file name, function name, line number in log
    --disable-color                       disable log color
    --disable-bpf                         disable the kernel space filter, most time its not necessary
                                          unless you suspect there is a bug
    --sock-buf            <number>        buf size for socket, >=10 and <=10240, unit:kbyte, default:1024
    --seqmode             <number>        seq increase mode for faketcp:
                                          0:dont increase
                                          1:increase every packet
                                          2:increase randomly,  about every 3 packets (default)
    --lower-level         <string>        send packet at OSI level 2,  format:'if_name#dest_mac_adress'
                                          ie:'eth0#00:23:45:67:89:b9'.Beta.
    -h, --help                             print this help message

IPTABLES rule
This program sends packets via raw socket. In FakeTCP mode, Linux kernel TCP packet processing has to be blocked by a iptables rule on both sides, otherwise the kernel will automatically send RST for an unrecongized TCP packet and you will sustain from stability / peformance problems. You can use -a option to let the program automatically add / delete iptables rule on start / exit. You can also use the -g option to generate iptables rule and add it manually.

cipher-mode and auth-mode
It is suggested to use aes128cbc + md5 to obtain maximum security. If you want to run the program on a router, you can try xor + simple, which can fool packet inspection by firewalls the most of time, but it cannot protect you from serious attacks. Mode none is only for debugging purpose. It is not recommended to set the cipher-mode or auth-mode to none.

seq-mode
The FakeTCP mode does not behave 100% like a real tcp connection. ISPs may be able to distinguish the simulated tcp traffic from the real TCP traffic (though it's costly). seq-mode can help you change the seq increase behavior slightly. If you experience connection problems, try to change the value.

Peformance Test

Test method:
iperf3 TCP via OpenVPN + udp2raw (iperf3 UDP mode is not used because of a bug mentioned in this issue: https://github.com/esnet/iperf/issues/296 . Instead, we package the TCP traffic into UDP by OpenVPN to test the performance. Read Application for details.

iperf3 command:
iperf3 -c 10.222.2.1 -P40 
iperf3 -c 10.222.2.1 -P40 -R

Environments
  • Client Vultr $2.5/monthly plan (single core 2.4GHz cpu, 512MB RAM, Tokyo, Japan)
  • Server BandwagonHost $3.99/annually plan (single core 2.0GHz cpu, 128MB RAM, Los Angeles, USA)

Test1
raw_mode: faketcp cipher_mode: xor  auth_mode: simple


(reverse speed was simliar and not uploaded)

Test2
raw_mode: faketcp cipher_mode: aes128cbc  auth_mode: md5


(reverse speed was simliar and not uploaded)

Application

tunneling any traffic via raw traffic by using udp2raw +openvpn

  1. bypasses UDP block/UDP QOS
     
  2. no TCP ovr tcp problem (tcp over tcp problem http://sites.inka.de/bigred/devel/tcp-tcp.html , https://community.openvpn.net/openvpn/ticket/2 )
     
  3. openvpn over icmp also becomes a choice
     
more details at openvpn+udp2raw_guide

speed-up tcp connection via raw traffic by using udp2raw+kcptun
kcptun is a tcp connection speed-up program, it speeds-up tcp connection by using kcp protocol on-top of udp.by using udp2raw, you can use kcptun while udp is QoSed or blocked. (kcptun, https://github.com/xtaci/kcptun)

speed-up tcp connection via raw traffic by using udp2raw+finalspeed
finalspeed is a tcp connection speed-up program similiar to kcptun, it speeds-up tcp connection by using kcp protocol on-top of udp or tcp.but its tcp mode doesnt support openvz, you can bypass this problem if you use udp2raw+finalspeed together, and icmp mode also becomes avaliable.

Other

Easier installation on ArchLinux
yaourt -S udp2raw-tunnel # or
pacaur -S udp2raw-tunnel



Source: Udp2raw-tunnel - A UDP Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket [Bypass UDP FireWalls]


Consulente in Informatica dal 1984

Software automazione, progettazione elettronica, computer vision, intelligenza artificiale, IoT, sicurezza informatica, tecnologie di sicurezza militare, SIGINT. 

Facebook:https://www.facebook.com/flaviobernardotti58
Twitter : https://www.twitter.com/Flavio58

Cell:  +39 366 3416556

f.bernardotti@deeplearningitalia.eu

#deeplearning #computervision #embeddedboard #iot #ai

 

Related Topics


Sitemap 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326