Udp2raw tunnel

An Encrypted, Anti-Replay, Multiplexed UDP Tunnel which can help you Bypass UDP Block or QoS by tunneling UDP traffic through Fake-TCP or ICMP by using raw socket.It also acts as a Connection Stabilizer.

Features

Send / Receive UDP Packet with fake-TCP/ICMP headers

Fake-TCP/ICMP headers help you bypass UDP blocking, UDP QoS or improper UDP NAT behavior on some ISPs. Raw packets with UDP headers are also supported.In UDP header mode, it behaves just like a normal UDP tunnel, and you can just make use of the other features.

Simulate TCP Handshake

Simulates the 3-way handshake, along with seq and ack_seq. TCP options MSS, sackOk, TS, TS_ack, wscale are also simulated. Real-time delivery guaranteed, no TCP over TCP problem when using OpenVPN.

Encryption, Anti-Replay, No MITM

• Encrypt your traffic with AES-128-CBC.
• Protect data integrity by MD5 or CRC32.
• Defense replay attack with an anti-replay window, similar to IPSec and OpenVPN.
• Authenticate mutually, no MITM attacks.

Failure Detection & Stabilization (Connection Recovery)

Connection failures are detected by heartbeats. If timed-out, a client will automatically change the port number and reconnect. If reconnection is successful, the previous connection will be recovered, and all existing UDP conversations will stay valid.

For example, if you use UDP2RAW + OpenVPN, OpenVPN won’t lose connection after any reconnect, even if the network cable is re-plugged or the WiFi access point is changed.

Other Features

• Multiplexing One client can handle multiple UDP connections, all of which share the same raw connection.
• Multiple Clients One server can have multiple clients.
• NAT Support All of the 3 modes work in NAT environments.
• OpenVZ Support Tested on BandwagonHost.
• OpenWRT Support No dependencies, easy to build. Binary for ar71xx are included in the release.

Keywords

• UDP QoS Bypass
• UDP Blocking Bypass
• OpenVPN TCP over TCP problem
• OpenVPN over ICMP
• UDP to ICMP tunnel
• UDP to TCP tunnel
• UDP over ICMP
• UDP over TCP

Getting Started

Prerequisites

A Linux host (including desktop Linux, OpenWRT router, or Raspberry PI) with root access.

If you want to use it on MICRO$OFT Windows, you can use VMware or Hyper-V (both bridged mode and NAT mode are supported).

Changelog v20230206

Installing

Download binary release from https://github.com/wangyu-/udp2raw-tunnel/releases

Running

Assume your UDP is blocked or being QoS-ed or just poorly supported. Assume your server ip is 44.55.66.77, you have a service listening on UDP port 7777.

udp2raw-tunnel

version: Aug  5 2017 21:03:54

repository: https://github.com/wangyu-/udp2raw-tunnel



usage:

    run as client : ./this_program -c -l local_listen_ip:local_port -r server_ip:server_port  [options]

    run as server : ./this_program -s -l server_listen_ip:server_port -r remote_ip:remote_port  [options]



common options,these options must be same on both side:

    --raw-mode            <string>        avaliable values:faketcp(default),udp,icmp

    -k,--key              <string>        password to gen symetric key,default:"secret key"

    --auth-mode           <string>        avaliable values:aes128cbc(default),xor,none

    --cipher-mode         <string>        avaliable values:md5(default),crc32,simple,none

    -a,--auto-rule                        auto add (and delete) iptables rule

    -g,--gen-rule                         generate iptables rule then exit

    --disable-anti-replay                 disable anti-replay,not suggested

client options:

    --source-ip           <ip>            force source-ip for raw socket

    --source-port         <port>          force source-port for raw socket,tcp/udp only

                                          this option disables port changing while re-connecting

other options:

    --log-level           <number>        0:never    1:fatal   2:error   3:warn 

                                          4:info (default)     5:debug   6:trace

    --log-position                        enable file name,function name,line number in log

    --disable-color                       disable log color

    --disable-bpf                         disable the kernel space filter,most time its not necessary

                                          unless you suspect there is a bug

    --sock-buf            <number>        buf size for socket,>=10 and <=10240,unit:kbyte,default:1024

    --seqmode             <number>        seq increase mode for faketcp:

                                          0:dont increase

                                          1:increase every packet

                                          2:increase randomly, about every 3 packets (default)

    -h,--help                             print this help message

IPTABLES rule

This program sends packets via raw socket. In FakeTCP mode, Linux kernel TCP packet processing has to be blocked by an iptables rule on both sides, otherwise, the kernel will automatically send RST for an unrecognized TCP packet and you will sustain from stability/performance problems. You can use -a option to let the program automatically add/delete iptables rule on start/exit. You can also use the -g option to generate iptables rule and add it manually.

cipher-mode and auth-mode

It is suggested to use aes128cbc + md5 to obtain maximum security. If you want to run the program on a router, you can try xor + simple, which can fool packet inspection by firewalls the most of the time, but it cannot protect you from serious attacks. Mode none is only for debugging purpose. It is not recommended to set the cipher-mode or auth-mode to none.

seq-mode

The FakeTCP mode does not behave 100% like a real TCP connection. ISPs may be able to distinguish the simulated tcp traffic from the real TCP traffic (though it’s costly). seq-mode can help you change the seq increase behavior slightly. If you experience connection problems, try to change the value.

Performance Test

Test method:

iperf3 TCP via OpenVPN + udp2raw (iperf3 UDP mode is not used because of a bug mentioned in this issue: https://github.com/esnet/iperf/issues/296. Instead, we package the TCP traffic into UDP by OpenVPN to test the performance. Read Application for details.

iperf3 command:

iperf3 -c 10.222.2.1 -P40 

iperf3 -c 10.222.2.1 -P40 -R

Environments

• Client Vultr $2.5/monthly plan (single core 2.4GHz CPU, 512MB RAM, Tokyo, Japan)
• Server BandwagonHost $3.99/annually plan (single core 2.0GHz CPU, 128MB RAM, Los Angeles, USA)

Test1

raw_mode: fake TCP cipher_mode: xor  auth_mode: simple

(reverse speed was simliar and not uploaded)

Test2

raw_mode: faketcp cipher_mode: aes128cbc  auth_mode: md5

(reverse speed was similar and not uploaded)

Application

tunneling any traffic via raw traffic by using udp2raw +openvpn

1. bypasses UDP block/UDP QoS
2. no TCP over TCP problem (TCP over TCP problem http://sites.inka.de/bigred/devel/tcp-tcp.html,https://community.openvpn.net/openvpn/ticket/2 )
3. OpenVPN over ICMP also becomes a choice

more details at openvpn+udp2raw_guide

speed-up TCP connection via raw traffic by using udp2raw+kcptun

kcptun is a TCP connection speed-up program, it speeds-up TCP connection by using kcp protocol on-top of udp.by using udp2raw, you can use kcptun while UDP is QoSed or blocked. (kcptun, https://github.com/xtaci/kcptun)

speed-up TCP connection via raw traffic by using udp2raw+finalspeed

final speed is a TCP connection speed-up program similar to kcptun, it speeds-up TCP connection by using kcp protocol on-top of UDP or tcp.but its TCP mode doesn’t support OpenVZ, you can bypass this problem if you use udp2raw+finalspeed together, and ICMP mode also becomes available.

Tutorial

Copyright (c) 2017 Yu Wang (wangyucn at gmail.com)

Source: https://github.com/wangyu-/