obfuscated wg can be detected by dpi

[AlexHighTower]

Hello,

several days ago all my wg tunnels from RF to EU obfuscated by xt_wgobfs stopped to work

wg show tell that there is no handshake for a long time

I found that if I change --key string tunnel became up and running for several seconds, but after a while it not working.

tcpdump on server shows only outgoing traffic to clients and no incoming that time!!!

also tried to change port - same behavior (((

and I have problems only via ipv4, via ipv6 by tunnel broker - still works as before!

any ideas?

[infinet]

Hard to tell.
Can you try https://github.com/infinet/xt_wgobfs/tree/longpadding , it uses longer random bytes padding. This version is compatible with the main branch so you should be fine even only use it on one peer.

[AlexHighTower]

failed to compile
starts with this

  You are using:           gcc-12 (Ubuntu 12.3.0-1ubuntu1~22.04.2) 12.3.0
  CC [M]  /opt/xt_wgobfs/src/xt_WGOBFS_main.o
In file included from /opt/xt_wgobfs/src/xt_WGOBFS_main.c:11:
/opt/xt_wgobfs/src/chacha.h:30:6: warning: no previous prototype for 'chacha_hash' [-Wmissing-prototypes]
   30 | void chacha_hash(const u8  in[CHACHA_INPUT_SIZE],
      |      ^~~~~~~~~~~
In file included from /opt/xt_wgobfs/src/xt_WGOBFS_main.c:15:

there is no ";" at src/chacha.h at the end on line 31

after adding is compiles but it looks like I got kernel panic or smth similar, last message I saw in console was
kernel:[7852656.669357] watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [kworker/u16:0:1122636]
and server stopped to respond by ssh
only reboot helped...

[infinet]

Sorry about that... I just force pushed to that branch. Can you try again?

[AlexHighTower]

In my case no changes.
Connection is established, first few seconds there is traffic (several kilobytes) and that's all, no more traffic in tunnel.
If I switch from ipv4 to ipv6 - works as it should be

looks like local dpi some how detects fact on tunnel and throttle speed or drops data packets, not handshake...

[sh0rch]

You’ll need at least two VPS servers, one in Russia and another somewhere else. Then just follow the “As a relay” scenario from the README.

If you’re already using this setup and it’s still not working, try switching the RU VPS provider. By the way, if it’s not a secret, which provider are you using? 😊

Server-side DPI is a different story, unusual traffic patterns are generally normal for server traffic, so that alone shouldn’t be a problem.