SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Support obfuscation to work-around ISP blocking #422

New Issue
Open
opened 2025-11-20 05:11:09 -05:00 by saavagebueno · 12 comments
saavagebueno commented 2025-11-20 05:11:09 -05:00
Owner
Copy Link

Originally created by @kim0 on GitHub (Aug 20, 2023).

Is your feature request related to a problem? Please describe.
Certain countries like Egypt block WG. Would be great to have pluggable obfuscation layers that are integrated without needing to run external complex tunnels

Originally created by @kim0 on GitHub (Aug 20, 2023). **Is your feature request related to a problem? Please describe.** Certain countries like Egypt block WG. Would be great to have pluggable obfuscation layers that are integrated without needing to run external complex tunnels
saavagebueno added the feature-request label 2025-11-20 05:11:09 -05:00
saavagebueno commented 2025-11-20 05:11:09 -05:00
Author
Owner
Copy Link

@thedemonium commented on GitHub (Aug 29, 2023):

A much needed feature in the current realities!
I would be very happy (and I think that many will) of such a feature.

@thedemonium commented on GitHub (Aug 29, 2023): A much needed feature in the current realities! I would be very happy (and I think that many will) of such a feature.
saavagebueno commented 2025-11-20 05:11:10 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Sep 3, 2023):

@kim0 @thedemonium can you share a bit more details about the obfuscation layers?

@mlsmaycon commented on GitHub (Sep 3, 2023): @kim0 @thedemonium can you share a bit more details about the obfuscation layers?
saavagebueno commented 2025-11-20 05:11:10 -05:00
Author
Owner
Copy Link

@thedemonium commented on GitHub (Sep 4, 2023):

can you share a bit more details about the obfuscation layers?

From recent events. We realized that the Wireguard protocol is quite easy to detect.
Alternatively, at the same time, when blocking at the provider level, solutions using ShadowSocks continue to work. For example Outline.

It would be very cool. Be able to set a special flag at the level of node-peer settings.
If a special flag assigned to it, peer-to-peer connections by passing traffic through the shadowsocks tunnel.

@thedemonium commented on GitHub (Sep 4, 2023): > can you share a bit more details about the obfuscation layers? From recent events. We realized that the Wireguard protocol is quite easy to detect. Alternatively, at the same time, when blocking at the provider level, solutions using ShadowSocks continue to work. For example Outline. It would be very cool. Be able to set a special flag at the level of node-peer settings. If a special flag assigned to it, peer-to-peer connections by passing traffic through the shadowsocks tunnel.
saavagebueno commented 2025-11-20 05:11:10 -05:00
Author
Owner
Copy Link

@kim0 commented on GitHub (Sep 4, 2023):

In my mind a great obfuscation layer would

  • Be pluggable. We should be able to use any number of plugins to obfuscate. This is bec this is mainly a cat & mouse game.
  • Possibly, consider trying using Tor pluggable obfuscation tools (obfs4proxy, meek ...etc)
  • Maybe use generic preObfs and postObfs commands to start and stop obfuscation layers (eg start and stop shadowsocks). Ideally, those are tools that can be written in any language (eg external binaries) which get passed some info like what port to listen on ..etc.
  • Possibly netbird can use an internal quality monitor to measure if a particular is still working or not, if not, it could try a different one. Also if it's no longer needed, it would switch to the lower overhead of a direct WG connection. This is kind of subtle, but in Egypt they only block the initial WG handshake. So I would typically pass the handshake through shadowsocks, then almost immediately switch the endpoint wg set endpoint to the regular WG server with ss and it would continue working. But we can also imagine a case where obfs1 was working, a user switches wifi networks and the new wifi does not need obfs1 and can use a direct WG connection, or the new network needs obfs2. So I'm suggesting continuous quality monitors across multiple channels (direct, obfs1, obfs2...etc) with overhead information and selecting the best channel that works.
@kim0 commented on GitHub (Sep 4, 2023): In my mind a great obfuscation layer would * Be pluggable. We should be able to use any number of plugins to obfuscate. This is bec this is mainly a cat & mouse game. * Possibly, consider trying using Tor pluggable obfuscation tools (obfs4proxy, meek ...etc) * Maybe use generic `preObfs` and `postObfs` commands to start and stop obfuscation layers (eg start and stop shadowsocks). Ideally, those are tools that can be written in any language (eg external binaries) which get passed some info like what port to listen on ..etc. * Possibly netbird can use an internal quality monitor to measure if a particular is still working or not, if not, it could try a different one. Also if it's no longer needed, it would switch to the lower overhead of a direct WG connection. This is kind of subtle, but in Egypt they only block the initial WG handshake. So I would typically pass the handshake through shadowsocks, then almost immediately switch the endpoint `wg set endpoint` to the regular WG server with ss and it would continue working. But we can also imagine a case where obfs1 was working, a user switches wifi networks and the new wifi does not need obfs1 and can use a direct WG connection, or the new network needs obfs2. So I'm suggesting continuous quality monitors across multiple channels (direct, obfs1, obfs2...etc) with overhead information and selecting the best channel that works.
saavagebueno commented 2025-11-20 05:11:10 -05:00
Author
Owner
Copy Link

@thedemonium commented on GitHub (Sep 4, 2023):

In my mind a great obfuscation layer would

  • Be pluggable. We should be able to use any number of plugins to obfuscate. This is bec this is mainly a cat & mouse game.
  • Possibly, consider trying using Tor pluggable obfuscation tools (obfs4proxy, meek ...etc)
  • Maybe use generic preObfs and postObfs commands to start and stop obfuscation layers (eg start and stop shadowsocks). Ideally, those are tools that can be written in any language (eg external binaries) which get passed some info like what port to listen on ..etc.
  • Possibly netbird can use an internal quality monitor to measure if a particular is still working or not, if not, it could try a different one. Also if it's no longer needed, it would switch to the lower overhead of a direct WG connection. This is kind of subtle, but in Egypt they only block the initial WG handshake. So I would typically pass the handshake through shadowsocks, then almost immediately switch the endpoint wg set endpoint to the regular WG server with ss and it would continue working. But we can also imagine a case where obfs1 was working, a user switches wifi networks and the new wifi does not need obfs1 and can use a direct WG connection, or the new network needs obfs2. So I'm suggesting continuous quality monitors across multiple channels (direct, obfs1, obfs2...etc) with overhead information and selecting the best channel that works.

This is what I had in mind when I wrote the answer above.

@thedemonium commented on GitHub (Sep 4, 2023): > In my mind a great obfuscation layer would > > * Be pluggable. We should be able to use any number of plugins to obfuscate. This is bec this is mainly a cat & mouse game. > * Possibly, consider trying using Tor pluggable obfuscation tools (obfs4proxy, meek ...etc) > * Maybe use generic `preObfs` and `postObfs` commands to start and stop obfuscation layers (eg start and stop shadowsocks). Ideally, those are tools that can be written in any language (eg external binaries) which get passed some info like what port to listen on ..etc. > * Possibly netbird can use an internal quality monitor to measure if a particular is still working or not, if not, it could try a different one. Also if it's no longer needed, it would switch to the lower overhead of a direct WG connection. This is kind of subtle, but in Egypt they only block the initial WG handshake. So I would typically pass the handshake through shadowsocks, then almost immediately switch the endpoint `wg set endpoint` to the regular WG server with ss and it would continue working. But we can also imagine a case where obfs1 was working, a user switches wifi networks and the new wifi does not need obfs1 and can use a direct WG connection, or the new network needs obfs2. So I'm suggesting continuous quality monitors across multiple channels (direct, obfs1, obfs2...etc) with overhead information and selecting the best channel that works. This is what I had in mind when I wrote the answer above.
saavagebueno commented 2025-11-20 05:11:10 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Sep 4, 2023):

Great, thanks for the feedback @kim0 and @thedemonium we will review it internally and provide you a feedback soon.

I have another question. We are working on an HTTP (with TLS) relay. Still, I would like to learn more about your experience using Wireguard encapsulated with a similar protocol approach, like this or our current approach with TURN (with TLS)?

That will help us consider this with the current development.

@mlsmaycon commented on GitHub (Sep 4, 2023): Great, thanks for the feedback @kim0 and @thedemonium we will review it internally and provide you a feedback soon. I have another question. We are working on an HTTP (with TLS) relay. Still, I would like to learn more about your experience using Wireguard encapsulated with a similar protocol approach, like this or our current approach with TURN (with TLS)? That will help us consider this with the current development.
saavagebueno commented 2025-11-20 05:11:10 -05:00
Author
Owner
Copy Link

@thedemonium commented on GitHub (Nov 2, 2023):

Please!
Pay attention to this project: https://github.com/amnezia-vpn/amnezia-wg
Perhaps your dear developers will be able to use these developments in their project

@thedemonium commented on GitHub (Nov 2, 2023): Please! Pay attention to this project: https://github.com/amnezia-vpn/amnezia-wg Perhaps your dear developers will be able to use these developments in their project
saavagebueno commented 2025-11-20 05:11:10 -05:00
Author
Owner
Copy Link

@thedemonium commented on GitHub (Dec 26, 2023):

Perhaps this project will help add a function to netbird:

https://github.com/el3xyz/wireguard-linux-compat
notWG - obfuscated secure tunnel for Linux 3.10 - 5.14, based on WireGuard

There are several ways DPI can detect WireGurad traffic
The handshake initiation, response and cookie message have fixed sizes
All messages have 4 byte tag where the first byte indicates message type [1-4] and remaining three bytes are zeroes.
Handshake packet header contains sender and receiver indexes which are sent unencrypted and can be tracked.
Packet is obfuscated using two techniques
Random junk bytes are appended to handshake and cookie packets
Packet header is encrypted with blake2s hash of interface public key and random nonce.

@thedemonium commented on GitHub (Dec 26, 2023): Perhaps this project will help add a function to netbird: [https://github.com/el3xyz/wireguard-linux-compat](https://github.com/el3xyz/wireguard-linux-compat) notWG - obfuscated secure tunnel for Linux 3.10 - 5.14, based on WireGuard There are several ways DPI can detect WireGurad traffic The handshake initiation, response and cookie message have fixed sizes All messages have 4 byte tag where the first byte indicates message type [1-4] and remaining three bytes are zeroes. Handshake packet header contains sender and receiver indexes which are sent unencrypted and can be tracked. Packet is obfuscated using two techniques Random junk bytes are appended to handshake and cookie packets Packet header is encrypted with blake2s hash of interface public key and random nonce.
saavagebueno commented 2025-11-20 05:11:11 -05:00
Author
Owner
Copy Link

@umutzd commented on GitHub (Sep 29, 2024):

How does placing an option to choose the custom proxy settings/virtual tun ethernet device sound? People can install a tun0 virtual interface that proxies traffic to their own censorship evasion proxy servers to handle it in a very flexible way with constantly changing needs of this field. They can co-locate their servers with their peers too. This way the proxy protocol can be changed easily and is transparent to users/apps. This would allow separation of concerns too, best tools would be used in their respective places. Netbird does what it does best and catching up with censorship evasion at the same time is another huge work. Tor allows you to configure a proxy before reaching internet

@umutzd commented on GitHub (Sep 29, 2024): How does placing an option to choose the custom proxy settings/virtual tun ethernet device sound? People can install a tun0 virtual interface that proxies traffic to their own censorship evasion proxy servers to handle it in a very flexible way with constantly changing needs of this field. They can co-locate their servers with their peers too. This way the proxy protocol can be changed easily and is transparent to users/apps. This would allow separation of concerns too, best tools would be used in their respective places. Netbird does what it does best and catching up with censorship evasion at the same time is another huge work. Tor allows you to configure a proxy before reaching internet
saavagebueno commented 2025-11-20 05:11:11 -05:00
Author
Owner
Copy Link

@RTechSn commented on GitHub (May 21, 2025):

AmneziaWG is an almonst drop-in replecement to WG.
But you need to add a couple of additional lines to config.

@RTechSn commented on GitHub (May 21, 2025): AmneziaWG is an almonst drop-in replecement to WG. But you need to add a couple of additional lines to config.
saavagebueno commented 2025-11-20 05:11:11 -05:00
Author
Owner
Copy Link

@dot-file commented on GitHub (Sep 3, 2025):

Any progress with it?

@dot-file commented on GitHub (Sep 3, 2025): Any progress with it?
saavagebueno commented 2025-11-20 05:11:11 -05:00
Author
Owner
Copy Link

@alexcupertme commented on GitHub (Nov 13, 2025):

+1 I am interested too

@alexcupertme commented on GitHub (Nov 13, 2025): +1 I am interested too
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#422
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?